Privacy Notice

Nordstack Limited, CRO number 824512, registered in Ireland, is the controller of personal data used to operate this website, respond to enquiries and manage its own business relationships.

Our registered office is Landscape House, Baldonnell Business Park, Dublin 22, Ireland. Contact us about privacy or your rights at contact@nordstack.ltd.

When we process personal data on a customer's documented instructions as part of an engagement, that customer normally determines the purposes and essential means of processing. We act as a processor, or as a subprocessor where the customer is itself a processor. The relevant customer notice and processing agreement govern that activity. See Customer Data Processing.

• Callback requests: your telephone number and, if you choose to provide it, your name.
• Email contact requests: your email address.
• Message-form enquiries: your name, email address and message, together with a telephone number if you choose to provide one.
• Correspondence and meetings: contact details, organisation and role where supplied, messages, meeting arrangements and information you choose to discuss or provide.
• Business relationship records: contact and project information needed to prepare proposals, deliver an agreed engagement, administer contracts and meet applicable record-keeping duties.
• Technical information: information needed to deliver and secure the website, such as IP address, request information, browser or device information where recorded by the relevant provider, and server or security logs.
• Submission-control information: a generated request identifier, submission time and temporary abuse-prevention and duplicate-suppression information used to handle contact requests reliably.

Required fields are identified in the form. You do not have to provide personal data, but we may be unable to respond through your chosen channel without the necessary contact details.

Please do not send passwords, payment credentials, identity documents, health information or other sensitive personal data through the general contact forms. Protected project datasets require an appropriate agreed scope, legal basis, contractual safeguards and transfer method first.

Website enquiry information is primarily provided directly by you. Technical information is generated when your browser requests the website and when our systems handle a request.

For business relationships, contact information may also come from your organisation, a colleague or introducer, or publicly available professional sources. Where information is obtained indirectly, we provide any further information required by law, subject to applicable exceptions.

Customer datasets processed on instructions are dealt with under the customer arrangement, not assumed to be covered by a website visitor's permission.

An enquiry does not subscribe you to a newsletter. We do not use a generic “I agree to the Privacy Notice” checkbox as the legal basis for replying. Any future electronic marketing needs its own assessment under applicable data-protection and ePrivacy rules.

We share information only where needed for the relevant purpose with authorised personnel, service providers, professional advisers and authorities where lawfully required. We have data-protection agreements with relevant providers. The categories below describe their roles without implying that every enquiry reaches every service.

We always use Celonis and monday.com in service delivery, but this does not mean that every website enquiry is sent to either platform. The contact service sends form submissions to Make; email is handled through Gmail.

A provider may act as processor for content and independently as controller for some account or security activities. The agreement and actual processing determine its role. See Customer Data Processing.

An Irish company address does not mean that all processing takes place in Ireland or the European Economic Area. Providers, support teams and subprocessors may process data in other countries.

We have overseas-transfer safeguards in place with relevant providers for restricted transfers, using applicable legal mechanisms such as adequacy decisions or contractual safeguards, with supplementary measures where required. This does not mean all processing is confined to the EEA or that a particular mechanism applies to every service.

Contact contact@nordstack.ltd for information about relevant safeguards and, where applicable, how to obtain a copy, subject to appropriate redactions for confidentiality and security.

We retain personal data only as long as necessary for the relevant purpose, subject to applicable legal obligations and claims. The 30-day period for enquiry and Make execution logs is distinct from email and business correspondence retention.

The current contact service also uses temporary server-memory records. IP-based abuse-prevention records have a ten-minute validity window; request-ID/fingerprint records have a 24-hour validity window. Expired entries are removed when a later request triggers cleanup or when the server process ends, not necessarily at the exact end of the window.

These are not browser tracking cookies, and these windows do not mean that Make logs, Gmail messages or customer-platform records are deleted after ten minutes or 24 hours. Where legal obligations or claims require retention, use is limited to that need.

We apply technical and organisational measures proportionate to processing risks and limit access to people who need it for authorised purposes. We use appropriate agreements with providers handling personal data.

No internet service can promise absolute security. Use an agreed secure method for project datasets instead of sending unnecessary sensitive information in an open contact form.

Subject to GDPR conditions and exceptions, you may request:

• Access to your personal data and correction of inaccurate information.
• Erasure and restriction of processing.
• Data portability where it applies.
• Objection to legitimate-interest processing for reasons relating to your particular situation, and objection to direct marketing at any time.
• Withdrawal of consent where processing relies on consent, without affecting the lawfulness of earlier processing.

Contact contact@nordstack.ltd to exercise a right. Proportionate information may be requested to verify identity. The normal response period is one month. A permitted extension for complexity or the number of requests must be explained within the initial month.

Where we hold information only on a customer's instructions, we must assist the relevant controller and handle or route the request under that arrangement rather than decide it contrary to those instructions or applicable law.

The website forms themselves do not make decisions producing legal or similarly significant effects about you. Automation used to route a request is not, by itself, such a decision.

An engagement involving profiling, AI or consequential automated decisions requires a separate assessment of roles, lawful basis, transparency, human oversight and, where required, a data-protection impact assessment. This notice does not authorise unrestricted use of customer data for model training.

See the Cookie & Technology Notice for browser technology findings and their limits. Following an external booking or other link takes you to a separate service whose privacy information also applies.

You can raise a concern with us at contact@nordstack.ltd. You also have the right to lodge a complaint with a competent supervisory authority. In Ireland, this is the Data Protection Commission (opens in a new tab), whose website provides current contact and complaint information.

You may also complain to the authority in the EEA country where you live, work or believe an infringement occurred. You do not have to contact Nordstack before approaching an authority.

We update this notice when our practices or relevant requirements change; its effective and updated dates appear on this page. We provide additional notice and seek consent where required before introducing a new consent-based purpose.