Nordic Governance & Data Sovereignty

Privacy Policy & GDPR Clearance

Effective Date: October 14, 2026 • Version 2.2 • Jurisdiction: Denmark & European Union

1. Data Controller Identification

Nordwright ApS ("Nordwright", "we", "us", or "our") acts as the Data Controller responsible for the processing of personal data collected through nordwright.com, our client collaboration portal, and authenticated communication channels.

Company: Nordwright ApS

Address: Aarhus, Denmark

Official Inquiries & Data Protection: contact@nordwright.com

2. Categories of Personal Data Collected

In accordance with the principle of data minimization (GDPR Article 5(1)(c)), we exclusively process personal data strictly required to deliver bespoke software engineering, enterprise infrastructure, and secure client communication:

Identity & Account Data: Full name, organizational email address, corporate entity affiliation, role-based access level, and bcrypt-hashed cryptographic credentials.
Authentication & Telemetry Data: FIDO2 WebAuthn public key credentials, device authenticators (Touch ID, Face ID, Windows Hello), 2FA session logs, IP addresses, and user-agent strings.
Engineering Inquiries & Transmissions: Project scope briefs, architecture requirements, technical milestone messages, and encrypted inquiry payloads.
Consent Preferences: Categorical cookie and analytics preferences stored in client-side storage and 1st-party consent cookies.

3. Legal Grounds for Processing (GDPR Article 6)

We process your personal information under the following statutory legal bases:

Contractual Necessity

Art. 6(1)(b): Establishing portal channels, executing Statements of Work, and dispatching milestone communications.

Legitimate Interests

Art. 6(1)(f): Enterprise perimeter defense (Arcjet), rate-limiting, and preventing credential stuffing.

Explicit Consent

Art. 6(1)(a): Optional statistical telemetry and marketing insights configured via the Cookie Clearance Banner.

4. Zero-Third-Party AI Training Guarantee

When Nordwright engineers custom artificial intelligence systems, large language model pipelines, or autonomous agent clusters for clients, we execute strict zero-data retention agreements with model infrastructure providers. Client proprietary source code, operational workflows, and private project transmissions are never utilized for model fine-tuning or public model ingestion.

5. Data Retention & Session Invalidation

Personal data is retained only for the duration necessary to satisfy project milestones and compliance retention obligations:

Active Sessions: Database-backed revocable sessions expire after 7 days of inactivity and can be terminated on-demand by the user.
Two-Factor OTP Codes: Temporary 6-digit confirmation codes expire automatically after 15 minutes and are permanently deleted upon verification.
Inquiry Logs: Contact form entries are retained for 12 months for commercial correspondence unless account deletion is requested.

6. Your Rights under GDPR (Articles 15-22)

As a data subject located in the European Economic Area, you hold fundamental rights regarding your information:

Right of Access (Art. 15): You may request a complete export of personal data held about your account.

Right to Erasure / Right to be Forgotten (Art. 17): Clients may execute automated self-service account deletion at any time directly within the Client Portal Settings.

Right to Rectification (Art. 16): You may correct inaccurate organization records or contact details.

Right to Object & Withdraw Consent (Art. 21 & Art. 7): You can adjust cookie preferences at any time via the footer link.

7. Supervisory Authority

If you consider our processing of your personal data to infringe upon European data protection regulations, you have the right to lodge a formal complaint with the Danish Data Protection Agency:

Datatilsynet

Carl Jacobsens Vej 35, DK-2500 Valby, Denmark

Telephone: +45 33 19 32 00 • Web: www.datatilsynet.dk

Nordwright Digital Engineering Platform • Engineered to EndureAarhus, Denmark