Contents
NORBr BV, a Dutch company, whose head office is located at WG Plein 167 1054SC Amsterdam, NL (hereinafter referred to as 'NORBr', 'we', 'us' or 'our') is the data controller. If you have any questions or concerns about the way we process your personal data, please contact us at dpo@norbr.com.
Personal data is information relating to an identified or identifiable individual. This includes for example your name, email address, phone number, postal address, date of birth, IP address, credit card details. This privacy policy describes the personal data NORBr processes when you visit our website and use our services.
When you browse our website, we collect:
IP address
Date, time and pages visited
Browser type and operating system
When you register and use our platform, we collect:
Name and first name
Professional email address
Company name and phone number
When you become a customer, we collect:
Legal entity identification (company name, address, VAT registration number)
Name, first name, email and phone number
Bank information (IBAN)
Copy of official identity document(s) as part of KYC process
NORBr processes your personal data for the following purposes:
Providing and improving our platform and services
Sending communications about our services
Sending commercial communications (with your consent)
Billing and financial management
Compliance with legal obligations (KYC / AML)
Developing new features and products
The table below summarises how we process personal data by category of data subject:
Category | Data | Purpose | Legal Basis |
|---|---|---|---|
Users | Name, contact details, company | Platform access, support, communications | Contract / Legitimate interest |
End customers | Name, address, bank details, ID documents | Payment processing, KYC compliance | Contract / Legal obligation |
Visitors | IP address, browsing data, cookies | Website analytics, performance | Consent / Legitimate interest |
We may transfer your personal data to countries outside the EU/EEA. When we do so, we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, or other approved transfer mechanisms under GDPR Article 46.
We retain your personal data only as long as necessary for the purposes described above, and in accordance with applicable law:
Client and commercial data: 3 years after the end of the commercial relationship
Identity documents: 1 year if candidacy is rejected; 3 years if accepted
Bank card data: 13 months (15 months for deferred debit cards)
Cookies: 13 months
NORBr implements technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction or alteration. Our infrastructure is hosted on Google Cloud Platform (GCP), which provides robust security and compliance standards including encryption at rest and in transit.
Your personal data is hosted in Europe, on Google Cloud Platform (GCP) infrastructure. GCP maintains the following applicable certifications: ISO 27001, SOC 2 Type II, and PCI DSS.
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at dpo@norbr.com.
You have the right to obtain a copy of your personal data and information about how it is processed.
You have the right to have inaccurate personal data corrected or incomplete data completed.
You have the right to request deletion of your personal data, subject to certain conditions and legal obligations.
You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
You have the right to request that we limit the processing of your personal data in certain circumstances.
Under French law, you may define instructions regarding the processing of your personal data after your death.
NORBr reserves the right to modify this Privacy Policy at any time. We will notify you of any significant changes by email or by posting a notice on our website. The date of the last update appears at the top of this policy.
Discretion isn’t a feature we sell. It’s how the product is built.