Privacy policy

Læs på dansk

At NORDISK INNOVATION ApS”, (“Nordisk Innovation”, “we”, “us” or “our”) we give high priority to confidentiality and data security. This privacy policy applies to our processing of personal data, and sets out guidelines for Nordisk Innovation’s way of processing your personal data and provides you with the information that you are entitled to receive under applicable data protection legislation. You should read the privacy policy before you provide your personal data to Nordisk Innovation.

1. Data Controller and Contact Information

The data controller of your personal data is:

NORDISK INNOVATION ApS

Address: Øster Kringelvej 22, 8250 Egå

CVR no.: 29393044

2. If you visit the website https://nordiskinnovation.com/

2.1 Cookies

Types of personal data

Nordisk Innovation uses cookies on the website https://nordiskinnovation.com/ and processes your personal data in this connection. Nordisk Innovation may collect the following personal data about you when you visit our website:

  • IP address
  • Browsing history
  • Information about your use of our website, including click behaviour

We use cookies to collect the above personal data. You can read more about the use of cookies in our cookie policy, which you can find via the following link: https://nordiskinnovation.com/en-uk/cookie-policy/

Purposes of the processing

Your personal data may be processed for the following purposes:

  • Marketing in general
  • Product and service development
  • Statistics and analysis

Basis for processing

Nordisk Innovation processes your personal data on the following basis:

  • Legitimate interests: We base the processing of your personal data on our legitimate interests in, for example, conducting statistics, analyses, providing support as well as improving and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation).

When you visit our website, we ask for your informed consent to place cookies that are not functional cookies according to the cookie rules. You have the right to withdraw your consent at any time. You can read more about how to change your cookie settings in our Cookie Policy, which is available here: https://nordiskinnovation.com/en-uk/cookie-policy/

Retention period

Cookies are deleted in accordance with our Cookie Policy, which is available here: https://nordiskinnovation.com/en-uk/cookie-policy/

However, the information may be stored longer in anonymised form.

2.2 If you use the contact form or chat function on the Website, contact customer service or otherwise communicate with us

Types of personal data

When you use the contact form or chat function on https://nordiskinnovation.com/ website, contact customer service or otherwise communicate with Nordisk Innovation, Nordisk Innovation collects and processes your personal data. Nordisk Innovation collects, processes and stores the following types of personal data about you:

  • Name, email address, phone number
  • What your inquiry concerns
  • Date of your enquiry
  • Other information you provide in connection with your inquiry.
  • We encourage you not to provide us with sensitive personal data unless it is strictly necessary for the processing of your inquiry. In this connection, the information should only be sent in a highly encrypted form if you send the information via email address.

Purposes of the processing

Your personal data will be processed for the following purposes:

  • Handling your inquiry

Basis for processing

Nordisk Innovation processes your personal data on the basis below. The basis depends on the nature of your inquiry.

  • Legitimate interests: We may process your personal data on the basis of our legitimate interests in handling your inquiry, communicating with you and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation).
  • Contractual obligations: If your enquiry concerns a (potential) conclusion of a contract, we process your data in order to be able to carry out measures prior to entering into the contract (Article 6(1)(b) of the General Data Protection Regulation).

Disclosure

We may disclose your personal data to external suppliers who, in agreement with us, ensure that they provide the service that you order. The disclosure is based on our legitimate interest in being able to provide the service you request (Article 6(1)(f) of the General Data Protection Regulation).

Retention period

Your personal data will be retained for as long as necessary to fulfil the purposes for which it was collected. However, the information can be stored for a longer period of time in anonymized form.

If you are a customer or employee of one of our customers, suppliers or other business partners, please refer to the section below. However, the information may be stored longer in anonymised form.

If you are a customer or are employed by one of our customers, suppliers, business customers and other external partners, etc., we refer to the section below.

3. If you are a customer

This section contains the policy for Nordisk Innovation’s processing of personal data about Nordisk Innovation’s customers and users of our NI Serviceapp app.

Nordisk Innovation acts as a data processor for the personal data that you register in the NI Service App about your customers. However, we act as the data controller for the information you provide to create a user profile in the NI Service App.

Collection of personal data

Nordisk Innovation may collect, process and store your personal data in the following cases:

  • When you, your company or the company you work for enter into an agreement with Nordisk Innovation to use our services.
  • When you create a user profile in the NI Service App.

Types of personal data

Nordisk Innovation may collect, process and store the following types of personal data about you:

  • Name, email address, telephone number and corresponding contact information.
  • Financial information such as payment terms, bank details.

We may receive such information directly from you (primarily through emails and other correspondence with you) or from a third party such as your employer.

Purposes of the processing

Your personal data may be processed for the following purposes:

  • General planning, fulfillment, and management of customer relationships, including contracts.
  • Administration such as processing payments, rating evaluations, accounting, auditing and providing support.

Basis for processing

Nordisk Innovation processes your personal data on the basis below. The basis depends on the nature of your inquiry.

  • Contractual obligations: If your enquiry concerns a (potential) conclusion of a contract, we process your data in order to be able to carry out measures prior to entering into the contract (Article 6(1)(b) of the General Data Protection Regulation).
  • Legitimate interests: We may process your personal data on the basis of our legitimate interests in handling your inquiry, communicating with you and developing our products and services (Article 6(1)(f) of the General Data Protection Regulation).
  • Legal obligation: The processing of your personal data will in some cases be necessary for compliance with legal obligations, such as our obligation to prevent illegal activities (Article 6(1)(c) of the General Data Protection Regulation).

Retention period

Your personal data will be retained for as long as necessary to fulfil the purposes for which it was collected.

Personal data is therefore stored until 5 years after a contract has been terminated in accordance with tax and bookkeeping legislation or 3 years after a customer relationship has ended, if the 5 years have expired.

However, the information may be stored for a longer period of time in anonymized form.

4. If you use the NI Service app

This section describes what data the NI Service app processes, why it is processed and who receives it. It supplements section 3.

4.1 What data the app processes

Your user account

  • Name and email address. You sign in with a one-time code that we send to your email. The code is stored only in hashed form and expires after five minutes.
  • Phone number, if one is registered on your profile.
  • Your role (such as owner or technician), the organization you belong to, the time of your last sign-in and your settings, such as language and whether you want service emails.
  • Information about your sign-ins: a session key that the app stores securely on the device, and the IP address and browser or app details stored with the session.

Your organization

  • When you request to create an organization: company name, CVR number, address, contact person, email address and phone number, and your choice about support and newsletter emails.

Customers and wells

  • Data that you and your colleagues enter about the organization's customers: name, address, phone number, email addresses, CVR number, customer number, notes and customer groups.
  • Data about wells: name, material, type, depth, QR code, service interval, installation date, installer, notes and photos.
  • The well's position when you select it on the map. The position is the point you set on the map yourself.
  • Planned service visits and the technician they are assigned to.
  • Documents uploaded for a customer, such as service agreements (PDF).

Service reports and photos

  • The content of service reports: the checklist answers (such as rat activity and damage), notes, date, who performed the service and the email addresses you send the report to.
  • Photos you take with the camera or choose on the device. The app removes the metadata of the original file, such as GPS position and camera details, before uploading, and reports show only processed copies without such metadata. Photos uploaded from a web browser are also kept privately in their original form, which can include such metadata.
  • Photos that are removed or replaced are not deleted automatically but are kept as part of the history.

Camera and location

  • The app uses the camera only when you take a photo or scan a QR code. QR codes are read on the device.
  • The app does not use the device's location.

What the app does not do

  • The app shows no ads and does not track you across other apps and websites.

4.2 Purposes of the processing

  • To provide the app's features: sign-in, customers, wells, planning and service reports.
  • To send emails: sign-in codes, invitations to new employees, service reports to the recipients you choose, and notices about new reports to colleagues in the organization who have turned on service emails.
  • To protect accounts and the service against misuse (sign-in security).
  • To handle requests to create an organization.
  • To keep the organization's service history, also after an account is deleted or a photo is removed.
  • To find and fix errors and keep the app stable (see 4.4).

Basis for processing

  • Your user account, sign-in and the emails you need to use the app (sign-in codes and invitations): the agreement with you or your organization (Article 6(1)(b) of the General Data Protection Regulation). Where the agreement is with your employer, the basis is our and your employer's legitimate interest in giving the organization's users access to the service (Article 6(1)(f)).
  • Sign-in security (sessions, IP address and device details): our legitimate interest in protecting accounts and the service against misuse (Article 6(1)(f)).
  • Error and performance reporting: our legitimate interest in finding and fixing errors and keeping the app stable (Article 6(1)(f)).
  • Requests to create an organization: steps taken at your request before entering into an agreement (Article 6(1)(b)).
  • Support and newsletter emails: your consent (Article 6(1)(a)), see section 5.
  • Keeping a deleted profile and removed photos with the service history: our and the organization's legitimate interest in documenting the services performed (Article 6(1)(f)).
  • Data your organization registers about its customers, wells and service reports, including report recipients: we process it on behalf of your organization, which is the data controller and decides the legal basis (see section 3).

4.3 Who receives the data

  • Colleagues in your organization and Nordisk Innovation's administrators can see the data registered in the organization.
  • Service reports are shared as a link to a PDF. Anyone who has the link can open the report.
  • If you subscribe to your calendar in another calendar app, anyone with the calendar link can see your appointments with customer name, address, position and time. Your calendar app and its provider receive this data. The link stops working when your access ends.
  • Microsoft Azure (data centre in West Europe): hosting of the server, database and files, including photos.
  • Twilio SendGrid: sending emails. SendGrid receives the recipient's email address and the content of the email, and records when an email is opened and which links in it are clicked. Links in our emails therefore pass through SendGrid.
  • Sentry: error and performance reporting (see 4.4). The data is stored in Sentry's EU data region.
  • Google: maps (Google Maps) and address search (Google Places), see 4.5.

Microsoft Azure, Twilio SendGrid and Sentry process data on our behalf under data processing agreements. The database, files and Sentry's error reports are stored in the EU. Twilio SendGrid sends emails from the USA, and Microsoft and Sentry may access data from outside the EU/EEA, for example for support. These transfers are based on the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses, as described in section 8.

Google provides Google Maps and Google Places as an independent data controller under Google's Controller-Controller Data Protection Terms. Google processes the data, including in the USA, under its own privacy policy.

4.4 Error and performance reporting (Sentry)

When an error occurs in the app or on the server, an error report is sent to Sentry. The report contains technical information about the error and the events leading up to it, such as network requests, and the device model, operating system and app version. Response times are also measured for a sample of use (10% in the released app).

Reports are linked to your user ID so that we can find the affected account. We do not add your name or email address as user details. An error report may, however, contain data from the action that failed, such as text you entered.

4.5 Google Maps and Google Places

Maps in the app are shown with Google Maps. When you open a map, it is loaded directly from Google, and Google receives technical information, such as the device's IP address, device details (operating system and model), a pseudonymous identifier for the map component, crash data from the map component, and how you pan and zoom the map. Google processes this information under its own privacy policy: https://policies.google.com/privacy

When you search for an address, our server sends the text you type to Google Places, which suggests addresses and finds their position. Positions that Google finds for an address are stored temporarily, expire after 29 days and are then deleted automatically.

4.6 Retention period

  • Your user account is stored for as long as you have an account. If your organization's agreement ends, we disable the organization. You can then no longer see its data in the app, and your calendar link stops working. Your account is not deleted automatically; you can delete it at any time as described in 4.7, or ask us to delete it.
  • Customers, wells, service reports, photos and documents belong to the organization and are stored for as long as the organization uses NI Service. When the agreement ends, they are kept, but the organization's users can no longer see them in the app. Links to service reports that have already been sent keep working. When the organization asks us to, we delete its data or hand over a copy.
  • Error reports and performance measurements in Sentry: kept for 30 days. Sentry then deletes them.
  • Emails at Twilio SendGrid: the content of an email is kept only briefly while it is sent. Delivery information, such as the recipient's address and whether the email was delivered, is kept for up to 37 days, and pseudonymized delivery events for up to a year for security and fraud prevention. SendGrid may keep random samples of email content for up to 7 days for security and troubleshooting.
  • Database backups: kept for 35 days and then deleted automatically. Backups are also copied to a second Azure data centre in the EU.
  • Server logs: kept for 30 days.

4.7 How to delete your account

You can delete your account under "Delete account" in the app's menu or, if you do not have access yet, on the status screen after you sign in. You can also delete it on the web at https://app.ni-service.com/delete-account. Your sign-in and all your sessions are then deleted immediately, and a request you sent to create an organization that has not yet been approved is rejected. Your user profile is marked as deleted and kept, with your name, email address and phone number if one is registered, in the organization's service history, so reports you performed still show who performed them. A deleted profile is kept for as long as the organization's service history is kept (see 4.6).

Data about the organization's customers, wells and service reports belongs to the organization and is not deleted with your account. You can also write to info@nordiskinnovation.com if you want your data deleted.

5. If you sign up for our newsletter(s)

Types of personal data

Nordisk Innovation collects, processes and stores your personal data for marketing purposes when you sign up for newsletter(s). Nordisk Innovation may collect, process and store the following types of personal data about you:

  • Name and email address

Purposes of the processing

Your personal data may be processed for the following purposes:

  • Marketing
  • Analysis and statistics

Basis for processing

Nordisk Innovation processes your personal data on one or more of the following grounds:

  • Consent: Nordisk Innovation will only use your personal data for direct marketing, including sending out newsletters, if you have given your prior and explicit consent to this (Article 6(1)(a) of the General Data Protection Regulation).
  • Legitimate interests: The processing of your personal data in connection with analysis and statistics is based on our legitimate interests in being able to improve and develop our services (Article 6(1)(f) of the General Data Protection Regulation).

Retention period

Your personal data will be stored for as long as your consent to receive marketing is active.

If you no longer wish to receive our newsletters, you can unsubscribe via the link at the bottom of each email or by contacting us as described below. However, the withdrawal of your consent does not affect the lawfulness of the processing that preceded the withdrawal.

We store documentation of your consent for two years from the time you have withdrawn your consent to receive direct marketing material. The storage period is determined on the basis of our legitimate interest in being able to document that we have sent out direct marketing in accordance with applicable legislation Article 6(1)(f) of the General Data Protection Regulation.

However, the information may be stored for a longer period of time in anonymized form.

6. If you apply for a job at Nordisk Innovation

When you apply for a job at Nordisk Innovation, we process your personal data in connection with the recruitment process. We recommend that your application does not contain a civil registration number or sensitive personal data, such as personal data revealing racial or ethnic background, religion, trade union membership, sexuality or health information.

Types of personal data

Nordisk Innovation may collect, process and store the following types of personal data about you:

  • Contact information such as name, email address and phone number
  • Information that appears in the application, CV and any appendices
  • Relevant information that is publicly available on the internet and social media, including in particular information about previous employment, activities, skills, performance and general appearance
  • Results of personality tests, if you complete them
  • References from previous and/or current employers that you have provided in your application or that you have consented to us contacting

Purpose of processing

Your personal data will be used to assess whether we want to offer you a position at Nordisk Innovation.

Basis for processing

Nordisk Innovation processes your personal data on one or more of the following grounds:

  • Legitimate interests: We may process your personal data on the basis of our legitimate interest in assessing whether we wish to offer you employment, including on the basis of the information you provide in your CV, application and any supporting documents, on the basis of relevant information publicly available on the internet and social media, results of personality tests, references from referees you have provided in your application, and other information you provide to us in connection with the recruitment process. The processing may also be necessary for our legitimate interest in defending or asserting legal claims (Article 6(1)(f) of the General Data Protection Regulation).

Retention period

If you are offered a position at Nordisk Innovation, your application and additional relevant personal data collected in connection with the recruitment procedure will be stored in your personnel file with us.

If you are not offered a position, we will retain your application and any additional personal data collected in the course of the recruitment procedure for a period of 6 months after our rejection, unless you have consented to a longer retention of such personal data.

You can withdraw any consents you may have given as part of our recruitment procedure at any time. Withdrawal of your consent will have an effect on the future processing of your personal data, but does not affect the lawfulness of the processing based on the consent prior to the withdrawal. If you wish to withdraw your consent, you can contact us as indicated below.

7. If you are a supplier, business customer, or other external business partner, etc.

This section contains the policy for Nordisk Innovation’s processing of personal data about owners of sole proprietorships or contact persons at suppliers, business customers and other external partners, etc., who collaborate with Nordisk Innovation.

Collection of personal data

Nordisk Innovation may collect, process and store your personal data in the following cases:

  • When your company or the company you work for enters into an agreement with Nordisk Innovation
  • When you collaborate and communicate with Nordisk Innovation

Types of personal data

Nordisk Innovation may collect, process and store the following types of personal data about you:

  • Name, email address, telephone number and corresponding contact information
  • Financial information, such as payment terms, bank details, and credit scores (in the case of a sole proprietorship)

We may receive such information directly from you (primarily through emails and other correspondence with you) or from a third party such as your employer.

Purposes of the processing

Your personal data may be processed for the following purposes:

  • General planning, fulfillment and administration of collaborations, including contracts
  • Administration such as processing payments, evaluating credit ratings, accounting, auditing, as well as providing support
  • Completing your enquiries

Basis for processing

Nordisk Innovation primarily processes your personal data on one or more of the following grounds:

  • Contractual obligations: In certain cases, the processing of your personal data is necessary for the performance of a contract (Article 6(1)(b) of the General Data Protection Regulation).
  • Legitimate interests: We may process your personal data on the basis of our legitimate interests in, for example, managing day-to-day operations in accordance with lawful and fair business practices, including planning, executing and administering the cooperation, or our legitimate interest in, for example, performing credit assessments and providing support. The processing may also be necessary for our legitimate interest in preventing fraud or establishing, defending or asserting legal claims (Article 6(1)(f) of the General Data Protection Regulation).
  • Legal obligation: The processing of your personal data will in some cases be necessary for compliance with legal obligations, such as our obligation to prevent illegal activities (Article 6(1)(c) of the General Data Protection Regulation).

Retention period

Your personal data will be retained for as long as necessary to fulfil the purposes for which it was collected.

Personal data is therefore stored until 5 years after a contract has been terminated in accordance with tax and bookkeeping legislation or 3 years after a customer relationship has ended, if the 5 years have expired. However, the information may be stored for a longer period of time in anonymized form.

However, the information may be stored longer in anonymised form.

8. Disclosure to other data controllers and disclosure to data processors

In order to fulfil the above purposes, we may give third parties access to your personal data who, on the basis of a contractual relationship with Nordisk Innovation, provide relevant services, such as IT suppliers or other suppliers who process personal data for us. Such suppliers will only process personal data in accordance with our instructions in accordance with data processing agreements entered into.

In connection with Nordisk Innovation’s development, the company structure may change, e.g. in the event of a full or partial sale of the company. In the event of a partial transfer of assets containing personal data, the legal basis for the related transfer of personal data is, as a general rule, Article 6(1)(f) of the General Data Protection Regulation, as Nordisk Innovation has an interest in transferring parts of its assets and in making commercial/structural changes.

Your personal data is, in addition to what is described above, generally not disclosed to a third party without your permission. However, under certain circumstances and in accordance with the law, it may be necessary to disclose your personal data to, for example:

If your personal data is transferred to data processors or data controllers established in countries outside the EU/EEA that do not have an adequate level of protection, such transfer will only take place when a transfer basis has been secured. Furthermore, the transfer will be based on the EU Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework. If you have any questions about the basis for transfers to countries outside the EU/EEA, please contact us at info@nordiskinnovation.com. You can also request a copy of our transfer basis by contacting info@nordiskinnovation.com.

9. Your rights

  • You have the right to access the personal data we process about you
  • You have the right to object to our collection and further processing of your personal data
  • You have the right to rectification and deletion of your personal data, however, with certain statutory exceptions, including the Bookkeeping Act
  • You have the right to request from us the restriction of the processing of your personal data
  • Under certain circumstances, you can also request to receive a copy of your personal data as well as for the transmission of the personal data you have provided to us to another data controller (data portability)
  • You can revoke any consents you may have given at any time. We will then delete your personal data, unless we can continue the processing on other grounds. Our newsletter can be unsubscribed by clicking on the link at the bottom of the newsletter

10. Questions and complaints

If you have any questions about this Privacy Policy or if you wish to complain about the way we process your personal data, please feel free to contact us:

NORDISK INNOVATION ApS

Address: Øster Kringelvej 22, 8250 Egå

If your complaint is not resolved by us and you want to proceed with the case, you can complain to the Danish Data Protection Agency:

The Danish Data Protection Agency

Carl Jacobsens Vej 35

2500 Valby

Phone: 33 19 32 00

E-mail: dt@datatilsynet.dk