Privacy policy

Last updated 30 July 2026 · Applies to the nortender.no website

1. Who is the data controller

CMO Partners AS, company number 935 854 148, Norway, is the data controller.

Privacy questions go to nortender@cmopartners.co.

2. What the website collects

Nortender.no is a set of information pages plus one form: the pilot application. It has no login and no tracking. Specifically:

• Pilot application (/en/pilot). If you submit the form we receive your name, work email and company website, and — where you fill them in — your role, company size, what you deliver and a free-text note. The notification we get also carries the IP address the request comes from and the page you came from; you do not send those, every request on the internet carries them, and we include them to tell real applications from automated abuse. Legal basis is consent, GDPR art. 6(1)(a) — you tick the box yourself — plus legitimate interest for the abuse filtering.
• Local storage in your own browser. If a submission fails, what you typed is kept locally under nortender.pilot.undelivered so it is not lost. It stays on your machine and is not sent to us.
• No cookies. We set none. That is also why there is no consent banner — there is nothing to consent to.
• No analytics. No Google Analytics, no pixels, no ad networks.
• No third parties. The typeface is self-hosted, so reading these pages sends no requests to Google Fonts or any other external service.
• Server logs. Vercel, which hosts the site, logs technical request data — including IP address and timestamp — for operations and security. That is the only thing recorded when you visit.

The legal basis for the server logs is legitimate interest, GDPR art. 6(1)(f): keeping the site up and secure.

3. Processors

We use Vercel Inc. to host the site. They receive technical request data, including IP address.

If you apply for a pilot place, the contents of the application are sent to our own chat on Telegram, which is our notification channel. Where Resend is configured, a copy is also emailed to our mailbox as a written record.

These providers process data outside the EEA. Transfers rely on the European Commission's Standard Contractual Clauses where the provider offers them. Note that Telegram is a third party outside the EEA — if you would rather not go through it, email nortender@cmopartners.co instead and we will handle the application without Telegram.

If you email us, the message is handled in our Microsoft 365 mailbox and kept for as long as needed to follow it up.

4. The NorTender service itself

This policy covers the website nortender.no. If you create an account at app.nortender.no, more data is processed — including your name, work email, password and the company profile derived from your website. That is covered by the privacy notice in the app, which you see before creating an account.

5. How long we keep it

• Server logs are deleted per the provider's standard retention period.
• Pilot applications and email you send us stay in our mailbox for as long as needed to follow them up, and are deleted no later than 24 months after the last contact — or sooner on request.

6. Your rights

Under the GDPR you have the right to:

• access the data we hold about you,
• have inaccurate data corrected,
• have your data erased,
• restrict or object to the processing,
• receive your data in a machine-readable format (portability),
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Email nortender@cmopartners.co and we will respond within 30 days.

If you believe we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority in your own country.

7. Changes

If we change this policy we update the date at the top. For material changes we notify affected people by email.