Last updated: April 2026
Data Controller
The data controller for nornilo.com is:
Nornilo ApS
CVR: 46359437
Badensgade 40, 1
2300 København S
Denmark
Email: [email protected]
What data we collect
Email correspondence and contact form
When you contact us by email, through our booking page, or via the contact form on this site, we collect your name, email address, company name (if provided), and the content of your message. This data is used solely to respond to your enquiry and manage our business relationship with you.
Newsletter subscription
If you tick the "Subscribe to occasional news from Nornilo" checkbox on our contact form, we store your name and email address on a marketing contact list for the purpose of sending you updates, articles, and news about Nornilo. The legal basis for this processing is your consent (GDPR Article 6(1)(a)). You may withdraw consent at any time by clicking the unsubscribe link in any email we send, or by emailing [email protected].
Analytics
We use Umami Analytics to understand how visitors use our website - which pages are visited and where visitors come from. Umami is cookieless: it does not use cookies, does not collect personal data, and does not write to your device. No cookie consent is required for Umami. Umami does not use the language cookie described below.
Why we collect it
We collect personal data only where we have a legitimate purpose:
- To respond to enquiries you initiate (email, booking)
- To send you news and updates, where you have subscribed (consent)
- To understand how our website is used and improve it (analytics)
- To fulfil contractual obligations if you engage our services
We do not sell personal data. We do not use personal data for automated decision-making.
How long we keep it
- Email enquiries (no engagement follows): 12 months from receipt
- Newsletter subscribers: until you unsubscribe, or until we have reason to remove you (e.g. repeated email delivery failure)
- Analytics data: aggregated only - Umami does not retain personal data
- Client engagement data: for the duration of the engagement plus 5 years, as required by Danish bookkeeping law
Cookies
Language preference cookie
We set a strictly necessary session cookie named nornilo-language when you select a language using the language switcher. This cookie stores your language choice (e.g. en, da, sk, cs) so that the correct language version of the site is served on your next visit. It does not track you across sites, does not contain personal data, and expires at the end of your browser session.
No consent is required for this cookie, as it is strictly necessary for the site to function as requested by you (GDPR Recital 25; ePrivacy Directive Article 5(3)).
Analytics
Umami Analytics, our analytics tool, is cookieless and does not write to your device.
Third-party services
We use the following third-party services that may process personal data:
- Umami Analytics - provides website usage statistics. Does not use cookies, collects no personal data, data processed in the EU. See umami.is/privacy.
- Cloudflare Turnstile - our contact form uses Cloudflare Turnstile for spam protection. Cloudflare may process your IP address to verify that you are human. No tracking cookies are set. See Cloudflare's privacy policy.
- Cal.com (EU) - if you use the booking link on this site, you are directed to our scheduling page on cal.eu (the EU-hosted instance of Cal.com). Cal.com's own privacy policy applies from that point. See cal.com/privacy.
- Resend - if you subscribe to our newsletter, your name and email address are stored in Resend's contact list and used to send you emails. Resend is operated by Resend Inc. (USA); data transfers are covered by standard contractual clauses. See resend.com/legal/privacy-policy.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data, where there is no legal basis for us to retain it
- Restrict processing of your data in certain circumstances
- Data portability - receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk
Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects the most recent revision. We will notify you of material changes via email if we have an ongoing relationship with you.