Privacy Policy

1. Introduction

At NanoNord A/S, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal data when you visit our website www.nanonord.com, contact us, or interact with our services. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

2. Data Controller

NanoNord A/S Skjernvej 3 DK-9220 Aalborg, Denmark Tel: +45 96 34 15 90 Email: info@nanonord.com VAT No.: DK25995554

3. Personal data we collect

We collect and process personal data in several ways, depending on how you interact with us.

a. Data collected automatically (via website cookies)

• • When you visit our website, we typically collect:
  • Technical data about your computer, tablet, or mobile phone
  • Browser type and version
  • IP address (anonymized where possible)
  • Operating system and device type
  • Your approximate geographic location
  • Pages you visit and what you click on (usage data/interests)

This information is collected through cookies and similar technologies. Please see our Cookie Policy for full details.

b. Data you provide voluntarily

If you contact us, fill in a form, or subscribe to our newsletter, we may process:

• • Name
  • Company name
  • Job title (if provided)
  • Email address
  • Phone number
  • Other information you choose to share in the message field. We only process this information when you have given explicit consent, or when it’s necessary for us to respond to your inquiry or perform a contract.

3.1 Potential Customers

We may collect and process personal data from individuals who show interest in NanoNord’s products or services. This may include:

• • Name
  • Company name
  • Email address
  • Phone number

We process this information to:

• • Communicate with you regarding possible collaboration or sales opportunities
  • Manage and maintain potential customer relationships

Legal basis:

Processing is based on our legitimate interest in promoting NanoNord’s products and services (Article 6(1)(f) GDPR). We ensure that this interest does not override your fundamental rights and freedoms.

Data retention:

We retain personal data on potential customers for up to two (2) years after the last contact, unless there is ongoing dialogue or cooperation.

3.2 Customers

When you become a customer of NanoNord, we collect and process personal data to deliver our products and services. This may include:

• • Name
  • Company name
  • Job title or role
  • Email address
  • Phone number

We process this information to:

• • Manage and fulfill orders, contracts, and service deliveries
  • Handle communication and support related to our products and services
  • Maintain customer relationships and comply with legal requirements

Legal basis:

Processing is necessary for the performance of a contract (Article 6(1)(b) GDPR) and for compliance with legal obligations (Article 6(1)(c)), including accounting and documentation requirements.

Data retention:

Customer data is stored for as long as necessary to fulfill contractual obligations. In accordance with the Danish Bookkeeping Act, data is typically retained for five (5) years after the end of the financial year in which the business relationship ended.

3.3 Suppliers and Business Partners

We collect and process personal data from suppliers and business partners to manage cooperation and ensure the delivery of products or services.

This may include:

• • Name
  • Company name
  • Position
  • Email address
  • Phone number

We process this information to:

• • Manage purchases, deliveries, and services
  • Communicate and maintain professional relationships

Legal basis:

Processing is necessary for the performance of a contract and to comply with legal obligations under accounting and bookkeeping rules.

Data retention:

Supplier and partner data is kept for the duration of the contractual relationship and stored for five (5) years after the end of the financial year in which the cooperation ended.

3.4 Job Applicants

When you apply for a job at NanoNord A/S, we process your personal data to manage the recruitment process.

This includes information provided in your application and attachments, such as:

• • Name, contact details, and other information you choose to include
  • Education, qualifications, and employment history
  • Recommendations/references
  • Social media data, if applicable
  • Residence and work permit, if applicable

We may share your application internally with relevant employees involved in the recruitment process or, if applicable, with an external recruitment partner.

Legal basis:

Processing is based on our legitimate interest in assessing candidates for employment. If we wish to retain your application for future vacancies, we will ask for your consent.

Data retention:

Applications for specific positions are deleted when the recruitment process concludes. Unsolicited applications are retained for six (6) months, after which they are deleted unless you provide consent for a longer retention period. You may withdraw your consent at any time by contacting us at info@nanonord.com

3.5 Sales and CRM

When someone contacts us through our website or signs up our newsletter, we only add their contact details (company name, name, email, phone number) to our CRM (Salesforce) if they have given consent. We keep a record of when and how consent was given. Leads that do not turn into customers are kept for up to 24 months and then deleted if there is no further contact or consent.

3.6 Accounting

For accounting purposes, we keep personal data such as names, contact details, invoices, and payment records. This information is required by law and is kept for five 5 years after the end of the financial year, in line with the Danish Bookkeeping Act.

4. Purpose and legal basis for processing

We use your personal data for the following purposes and on these legal bases:

• Purpose | Legal Basis (GDPR)
• To operate and improve our website (analytics, performance)
• To respond to inquiries or provide information you request | Legitimate interest or contract
• To send newsletters and marketing communications | Consent
• To comply with legal obligations (e.g. bookkeeping) | Legal obligation

You can withdraw your consent at any time by contacting us or unsubscribing directly from our newsletters.

Has NanoNord implemented appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction? This includes encryption, access controls, secure hosting, and regular backups.

4.2 Data Minimization and Accuracy

We only collect and store the personal data necessary for the stated purposes. We also ensure that data is accurate and up to date. You are encouraged to notify us of any changes to your information so we can keep our records current.

4.3 Data Processors and Third Parties

We use trusted service providers (data processors) who process data on our behalf, including providers of IT systems, hosting, accounting, and marketing tools. Where relevant, we may also share data with banks, auditors, logistics providers, or public authorities if required by law. All our processors are located within the EU/EEA, or in countries that ensure adequate data protection under Standard Contractual Clauses (SCCs).

4.4 Newsletters and Marketing

If you have subscribed to our newsletter, we process your name and email address to send you updates and marketing materials.

We use ActiveCampaign (USA) as our email service provider. Your consent to receive newsletters is voluntary and can be withdrawn at any time by using the unsubscribe link in the email or by contacting us at info@nanonord.com.

5. Sharing of data

We may share your personal data with trusted service providers who process data on our behalf (“data processors”), including:

• ActiveCampaign, LLC (USA) – for newsletters and marketing automation
• Google LLC (USA) – for Analytics and Ads
• LinkedIn Ireland Unlimited Company – for marketing and campaign tracking
• Cookiebot by Usercentrics A/S (Denmark) – for managing cookie consent

All processors act under written agreements that comply with GDPR Article 28 and include appropriate safeguards (e.g. Standard Contractual Clauses for transfers outside the EU/EEA). We do not sell or otherwise share personal data with third parties for unrelated purposes.

6. Transfers outside the EU/EEA

Some of our partners (Google, LinkedIn, ActiveCampaign) are based outside the EU/EEA. When personal data is transferred to these providers, we ensure adequate protection using the European Commission’s Standard Contractual Clauses (SCCs) and additional technical and organizational measures.

7. Your rights

You have several rights under the General Data Protection Regulation (GDPR) regarding the personal data we process about you:

• Right of Access

You have the right to request access to the data we process about you and to receive information about how we use it.

• Right to Rectification

If you believe that any personal data we hold about you is incorrect or incomplete, you have the right to have it corrected.

• Right to Erasure (“Right to Be Forgotten”)

You can request that we delete your personal data if it is no longer necessary for the purposes for which it was collected, or if you withdraw your consent.

• Right to Restriction of Processing

You may request that we restrict processing of your personal data in specific cases—for example, while verifying accuracy or if you object to processing.

• Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

• Right to Object

You can object to our processing of your data, including for direct marketing purposes. If your objection is justified, we will cease the processing activity.

• Right to Withdraw Consent

If processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

• Right to Lodge a Complaint

You have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe our processing of your data violates data protection laws: www.datatilsynet.dk

8. Data security

We take appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. This includes secure hosting, access controls, and encryption where relevant. All employees with access to personal data are subject to confidentiality obligations.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. The latest version will always be available on our website with the date of the most recent update.