Privacy Policy

1. Data Controller

Nordic Tech Labs AS is the data controller for the personal data processed in connection with the Hei Emma service. We are registered in the Norwegian business register and can be contacted at privacy@heiemma.no.

2. What information do we collect?

We process the following categories of personal data:

• Contact details: name, email address and phone number of customers and business contacts.
• Call data: transcripts and audio recordings from phone calls and chat inquiries handled by Emma.
• Business details: company name, organisation number and invoicing information for subscribers.
• Technical data: IP addresses, browser type and log data for operations and security.
• Marketing data: when you visit our website, we collect data about your use of the site via Meta (Facebook) Pixel and Meta's Conversions API — such as pages visited, events (e.g. sign-up or purchase), Meta cookies (_fbp and _fbc), IP address and browser/user-agent information.

3. Purpose and legal basis (GDPR)

We process personal data in accordance with the EU General Data Protection Regulation (GDPR). The purposes and legal bases are:

• Service delivery – necessary for the performance of a contract (GDPR art. 6(1)(b)).
• Billing and accounting – legal obligation (GDPR art. 6(1)(c)).
• Improvement and analytics – legitimate interests (GDPR art. 6(1)(f)), provided your interests do not override our interest in improving the service.
• Marketing – based on consent (GDPR art. 6(1)(a)), which may be withdrawn at any time.

4. Data storage and transfer

All data is stored on servers located in the EU (Frankfurt, Germany) with providers certified under ISO 27001 that meet the requirements of GDPR chapter V on third-country transfers.

We do not use any sub-processors that transfer data to countries outside the EEA without adequate safeguards in place (e.g. EU Standard Contractual Clauses).

Marketing data collected via Meta Pixel and the Conversions API is shared with Meta Platforms Ireland Ltd. and may be transferred outside the EEA under adequate safeguards, including Meta's EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

5. Retention period

Call data and messages are automatically deleted after 90 days, unless you as a subscriber have chosen a longer retention period. Invoice and accounting information is kept for 5 years in accordance with the Bookkeeping Act. Other data is deleted no later than 30 days after a subscription ends.

6. Your rights

Under GDPR you have the right to:

• Access – be informed of what data we hold about you.
• Rectification – correct inaccurate information.
• Erasure – request that data be deleted ("the right to be forgotten").
• Data portability – receive your data in a machine-readable format.
• Objection – object to processing based on legitimate interests.
• Withdrawal of consent – without affecting the lawfulness of prior processing.

Requests should be sent to privacy@heiemma.no. We respond within 30 days. You may also lodge a complaint with the Norwegian Data Protection Authority.

7. Cookies

We use necessary cookies for the service to function, as well as marketing and analytics cookies to understand how the website is used. This includes Meta (Facebook) cookies (_fbp and _fbc), which are used to measure the effectiveness of our marketing and to build audiences for our ads on Meta's platforms. You may withdraw consent at any time via your browser settings, or opt out of Meta tracking via Meta's ad preferences.

8. Changes to this policy

We may update this policy. For material changes, you will be notified by email or a clear notice within the service. The current version is always available on this page.

9. Contact

Nordic Tech Labs AS
Email: privacy@heiemma.no