Effective: 24 September 2026
1.1 Nord Node AB, reg. no. 559493-4936, Göteborg, Sweden ("Nord Node", "we"), is the controller for the processing of personal data described in this Privacy Policy.
1.2 Contact: gdpr@nordnode.se, or by post to Nord Node AB, Smyckegatan 37, 426 50 Västra Frölunda, Sweden.
1.3 This notice explains how we process personal data about our customers' contact persons and users, prospective customers, suppliers and partners, visitors to our website, and job applicants.
1.4 When we provide IT services to our customers, we also process personal data on behalf of our customers, for example in their e-mail systems, devices, tickets and backups. In that case, the customer is the controller and decides how the data is processed. Please contact the organisation you work for, or whose services you use, to find out how it processes your personal data. Our processing on behalf of customers is governed by our Data Processing Agreement (PDF, opens in a new tab), and the providers we use for it are listed in our Sub-processor List (PDF, opens in a new tab).
| Purpose | Personal data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Entering into and administering agreements with customers, suppliers and partners | Name, title, employer, business e-mail and phone, signature, communications | Legitimate interest in managing our business relationships (Art. 6(1)(f)); where the customer is a sole trader, performance of the contract (Art. 6(1)(b)) | For the duration of the relationship and 10 years afterwards, the general Swedish limitation period for claims |
| Providing support and managed services: managing support requests, authorised contacts, customer portal accounts and service communications | Name, business contact details, username, role, portal account data, support-request history, communications, verification information | Legitimate interest in providing and documenting our services (Art. 6(1)(f)) | 24 months after the support request is closed; account data until the account is closed |
| Invoicing and accounting | Name, contact details, invoice and payment information | Legal obligation under chapter 7, section 2 of the Swedish Bookkeeping Act (bokföringslagen (1999:1078)) (Art. 6(1)(c)) | Until the end of the seventh year after the end of the calendar year in which the financial year ended |
| Security of our own systems and services, including logging of access to our systems and management tools | Username, IP address, device information, time and type of activity | Legitimate interest in protecting our systems and our customers (Art. 6(1)(f)) | 12 months, or longer where necessary to investigate a specific incident |
| Marketing to business contacts, for example newsletters and invitations | Name, business e-mail, employer, title, interests, engagement with our e-mails | Legitimate interest in marketing our services to business customers (Art. 6(1)(f)); you can opt out at any time | Until you opt out, or 24 months after our last interaction with you |
| Answering enquiries sent through the contact form on our website | Name, business e-mail, and optionally company and phone; the subject area you select; the content of your message; the page language. Your IP address is held in our web server's memory for up to 10 minutes to limit automated submissions, and is not written to disk or to any log | Legitimate interest in responding to enquiries about our services (Art. 6(1)(f)); where your enquiry concerns a possible agreement, steps taken at your request before entering into a contract (Art. 6(1)(b)) | The message is kept in our mailbox for 24 months after our last contact with you, unless a customer relationship follows, in which case the first row applies |
| Website operation and analytics | See Cookies and Similar Technology | Consent (Art. 6(1)(a)) for non-essential items; legitimate interest for strictly necessary functions | As stated there |
| Recruitment | CV, application, contact details, interview notes, references | Legitimate interest in assessing applicants (Art. 6(1)(f)); consent for keeping your application for future positions (Art. 6(1)(a)) | 24 months after the recruitment has ended, unless you consent to a longer period |
| Establishing, exercising or defending legal claims | Relevant data from the above categories | Legitimate interest (Art. 6(1)(f)) | For as long as necessary for the claim |
2.1 Where we rely on legitimate interest, we have balanced our interest against your interests and rights. You can request more information about that assessment.
2.2 We do not use your personal data for automated decision-making that produces legal or similarly significant effects for you.
3.1 We collect personal data directly from you, or from your employer or organisation when it names you as a contact person or user. We may also obtain business contact details from public sources, such as company registers and business websites.
4.1 We share personal data only where necessary with:
4.2 We do not sell personal data.
5.1 We primarily process personal data within the EU/EEA. Some of our service providers may process data outside the EU/EEA, for example in connection with global support. In those cases we ensure that the transfer is lawful, for example because the recipient country or organisation is covered by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework), or on the basis of the European Commission's Standard Contractual Clauses. You can contact us for more information or a copy of the safeguards used.
6.1 Under the GDPR, you have the right to:
6.2 To exercise your rights, contact gdpr@nordnode.se. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you why.
6.3 You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or with the supervisory authority where you live or work.
7.1 We protect personal data with technical and organisational measures, including access control, multi-factor authentication, encryption and logging.
8.1 We may update this notice. The current version is always available on our website, with the date of the latest update.