Privacy Policy

01Personal Data We Collect

Depending on how you interact with Northbased, our website, Client Portal, or Services, we may collect and process the following categories of personal data:

• Name and contact details (e.g., phone number, email address)
• Contact and communication preferences
• Authentication data, login credentials, and security-related information
• Billing address and payment details (e.g., debit/credit card information where required for invoicing)

We do not collect or process special categories of personal data (sensitive data such as health information, racial or ethnic origin, political opinions, religious beliefs, etc.). You are responsible for ensuring that any personal data you provide to us is accurate, complete, and kept up to date.

02Purposes and Legal Basis for Processing

We process personal data only for specified, explicit, and legitimate purposes, based on the following legal grounds under the GDPR:

• Performance of a contract or steps taken prior to entering into a contract (e.g., delivering agreed Services, project management, invoicing, and support);
• Compliance with legal obligations (e.g., accounting, tax reporting, or responding to lawful requests from authorities);
• Legitimate interests pursued by Northbased or a third party (e.g., fraud prevention, network and information security, service enhancement, direct marketing of similar services where permitted under law — you can object at any time);
• Your explicit consent where required (e.g., for non-essential marketing communications). Consent can be withdrawn at any time without affecting the lawfulness of prior processing.

03Cookies and Similar Technologies

Our website and Client Portal use cookies and similar tracking technologies to enable core functionality, remember your preferences, and analyse usage patterns for service improvement. For full details and your cookie management options, please refer to our separate Cookie Policy.

04Your Rights under Data Protection Law

Under the GDPR (and, where applicable, other laws such as the California Consumer Privacy Act for relevant individuals), you have the following rights regarding your personal data:

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing (including for direct marketing)
• Right to data portability
• For California residents (if applicable): additional rights to know, delete, opt out of sale/sharing, and non-discrimination

These rights are subject to legal exceptions and conditions (e.g., we may need to retain data for legal compliance).

05How to Exercise Your Rights

To exercise any of your rights, please contact us at legal@northbased.net. We will respond to verifiable requests without undue delay and normally within one month (extendable by up to two additional months in complex cases). If submitting via an authorised agent, please provide written proof of authorisation.

06Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Policy, or as required by applicable law (e.g., Danish accounting and tax retention periods, typically 5 years for financial records). Once no longer needed, data is securely deleted, destroyed, or irreversibly anonymised.

07International Data Transfers

If personal data is transferred outside the European Economic Area (EEA), we implement appropriate safeguards in line with GDPR requirements, such as EU Standard Contractual Clauses (SCCs), adequacy decisions, or other approved mechanisms.

08Third-Party Websites and Links

Our website or Client Portal may include links to external third-party websites. We are not responsible for the privacy practices, content, or security of those sites. We recommend reviewing their privacy policies directly.

09Children’s Privacy

Our Services and website are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it immediately.

10Contact Us and Lodging a Complaint

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, please email us at legal@northbased.net.

You also have the right to lodge a complaint with the supervisory authority in your country or with the Danish Data Protection Authority (Datatilsynet) at www.datatilsynet.dk/english.

11Client Portal and Our Services

Use of the Client Portal and our Services requires processing of your personal data as described in this Policy. Such processing is necessary for the performance of our contract with you and the delivery of the agreed Services.