Privacy policy

Last updated: 30 October 2026

Data controller

NOD³ is operated by NOD³ Solutions AB, corporate identity number 559596-1706. We are the data controller for the processing described here.

If you have questions about your personal data or want to exercise any of your rights, email privacy@nod3.se or use the contact form.

When you contact us

What data: first name, last name, email address, phone number (if you provide it), company name and your message. We also store which page you sent the form from and which language you used.

Why: to respond to your inquiry and, if you wish, to continue the conversation about a possible engagement.

Legal basis: our legitimate interest in being able to answer questions about our services (Article 6(1)(f) of the General Data Protection Regulation). If the inquiry concerns a possible contract with you, the basis is steps taken prior to entering into a contract (Article 6(1)(b)).

How long: 12 months from when you contacted us. If the contact leads to an engagement, we move the data we need to our customer records and keep it for as long as the customer relationship lasts, and after that for as long as the law requires (for example under the Swedish Bookkeeping Act).

When you subscribe to the newsletter

What data: email address, language, the time of your sign-up and confirmation, and the exact consent text you accepted.

Why: to send you the newsletter. You first receive an email in which you confirm your subscription. Without confirmation, we send nothing further.

Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time via the link in every mailing.

How long: until you unsubscribe. We then delete the data within 30 days. Sign-ups that are never confirmed are deleted after 30 days.

Protection against spam and abuse

To stop spam and repeated submissions, we store a one-way fingerprint (known as a hash) of your IP address and, for the contact form, of your browser type. The IP address itself is never stored. The basis is our legitimate interest in protecting the website (Article 6(1)(f)). The fingerprint is kept for as long as the form data.

Cookies and visitor statistics

We only use the cookies needed for the website to work, and statistics cookies only if you accept them. Read more on our page about cookies, where you can also change your choices.

If you accept statistics, we use Google Analytics to see how the website is used. Google Analytics does not store your IP address, and we do not link the data to you as a person. The statistics data is kept for 14 months and then deleted automatically. The basis is your consent (Article 6(1)(a)), and you can withdraw it at any time via Cookie settings.

Who helps us (data processors)

We use a few suppliers that process data on our behalf and according to our instructions, under data processing agreements:

• Hetzner Online hosts our server in Finland. The website runs there, form data and newsletter sign-ups are stored there, and our automation tool (n8n) sends notifications and confirmation emails from there.

• Google provides our email (Google Workspace). If you accept statistics cookies, we also use Google Tag Manager and Google Analytics.

• Storyblok is our content management system. Images on the website are loaded from Storyblok, which means your IP address is visible to them when an image loads.

• Attio is our customer relationship management (CRM) system. When you contact us, your name, email address, phone number (if you provide it), company and message are stored there so we can follow up on your inquiry. If you subscribe to our newsletter, your subscription status is stored there too. Data in Attio is kept for the same periods as stated above for inquiries and the newsletter.

Transfers outside the EU/EEA

Form data and newsletter sign-ups are stored within the EU, on our own server in Finland. Google may process statistics data in the USA if you accept statistics. We protect such transfers with the European Commission's standard contractual clauses, or with the EU–US Data Privacy Framework where the supplier is certified under it.

Attio stores the data within the EU (Google Cloud in Belgium). Attio is a UK company and uses some sub-processors in the USA. The UK has an adequacy decision from the European Commission, and transfers to the USA are protected by the European Commission's standard contractual clauses in Attio's data processing agreement with us.

Your rights

You have the right to:

• find out what data we hold about you and receive a copy,

• have inaccurate data corrected,

• have your data erased,

• restrict processing,

• object to processing based on legitimate interest,

• receive data you have given us in a machine-readable format (data portability),

• withdraw your consent at any time.

Email privacy@nod3.se or use the contact form and we will reply within one month. If you believe we are handling your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se (opens in a new tab).

Changes

We update this policy when the way we handle personal data changes. The date at the top shows when it was last changed.