Privacy notice

01 / DETAIL

Controller and contact

Norrelium is the data controller for processing described in this notice.

• Registered business: Norrelium
• Organisation number: 720903-4235
• VAT number: SE720903423501
• Address: Ögonmåttsgatan 9
• Postal code and city: 421 72 Göteborg
• Country: Sweden
• Privacy enquiries: info@norrelium.com

02 / DETAIL

Information collected

When you use the enquiry form, Norrelium receives your name, work email, company, optional role, selected area of interest, project challenge, desired outcome and timeline. Norrelium also processes information you provide by email or during business discussions. Please do not submit passwords, confidential records, special-category personal data or other sensitive material through the initial form.

03 / DETAIL

Purposes and legal bases

Enquiry and business-contact information is used to assess fit, respond, take requested pre-contractual steps and manage a potential or existing engagement. The legal bases are steps taken at your request before a contract, performance of a contract, legitimate interests in operating and developing the consultancy, and compliance with legal obligations where applicable. Consent is not used as the legal basis for responding to an enquiry.

04 / DETAIL

Website operation and measurement

Vercel hosts and delivers the website. Cloudflare Turnstile helps prevent automated abuse on the contact form. Plausible provides cookie-free aggregate traffic and conversion measurement without receiving form contents. Sentry receives privacy-scrubbed error and performance diagnostics; Session Replay and default PII collection are disabled. Sanity supplies public website content. These services may process limited technical data such as timestamps, URLs, browser or device details and network information needed to provide, secure or diagnose their services.

05 / DETAIL

Enquiry delivery and booking

Resend transmits enquiry emails to Norrelium's restricted Gmail mailbox. The complete form content is used for delivery but is not sent to Plausible or Sentry. Selecting a Cal.com booking link takes you to Cal.com's website, where Cal.com handles booking information under its own privacy information. Norrelium receives the details required to administer a booking.

06 / DETAIL

Recipients and international transfers

Personal information is shared only with service providers needed for hosting, security, content, communications, monitoring, analytics or booking, and with professional advisers or authorities when legally required. Some providers may process data outside Sweden or the EEA. Where GDPR transfer rules apply, Norrelium relies on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, as made available by the relevant provider.

07 / DETAIL

Retention

Unsuccessful or inactive enquiries are normally deleted within 12 months after the last meaningful contact. Information connected to an engagement is retained for the relationship and afterwards when needed for contractual, dispute or legal obligations; accounting material is retained for the period required by Swedish law. Security, hosting, analytics and monitoring records follow configured provider retention periods and are kept only while operationally necessary. Norrelium may retain limited information longer where required to establish, exercise or defend legal claims.

08 / DETAIL

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or objection to processing based on legitimate interests. You may also complain to Integritetsskyddsmyndigheten (IMY), Sweden's data-protection authority. Contact info@norrelium.com to exercise a right; identity verification may be required before a request is completed.

09 / DETAIL

Security and changes

Norrelium uses access restrictions, encrypted transport, validation, abuse protection and data minimisation appropriate to this website. No internet service can be guaranteed completely secure. This notice may be updated when processing or providers change; the effective date above identifies the current version.