Privacy policy for n17 me (me.nordic17.com)
1. Who is responsible
Nordic17, is the data controller for the personal data described here. For private customers we decide ourselves why and how the data is processed, unlike our business service, where the customer company is the controller.
Contact for anything about your data: hello@nordic17.com. We have not appointed a data protection officer.
2. The short version
- We need your email address to give you an account, and your full name and country to send removal requests on your behalf.
- We send data brokers what a removal request needs: your name, your confirmed email addresses and your signed Letter of Authorisation.
- Payments run through Mollie. We never see your card or bank details, and we send Mollie no name, email or address.
- Your email addresses and your name are encrypted before they are stored, with keys kept in a separate key service.
- When you delete your account, we delete your data everywhere at once. Only the signed Letter of Authorisation (kept 180 days as evidence) and anonymous receipts (bookkeeping) remain.
- We use no tracking or advertising cookies, and no analytics.
3. What we process, why, and on what legal basis
| Data | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Login email | You | Your account, sign-in links, emails about your subscription, and the address your removal requests are about | Contract, Art. 6(1)(b) |
| Up to 2 extra email addresses, each with the time it was confirmed | You | Included in your removal requests once you confirm each one through a link | Contract, Art. 6(1)(b) |
| Billing email (optional) | You | Where we send receipts and payment emails instead of your login email | Contract, Art. 6(1)(b) |
| Full name and country | You | Written on your Letter of Authorisation and used in removal requests; the country decides your currency | Contract, Art. 6(1)(b) |
| Signed Letter of Authorisation: the letter text, your consent, your choice on services outside the EU/EEA, when you confirmed your email, the time of signing, your IP address and browser details (user agent) | You, your browser | To act as your agent, and to prove that you authorised us | Contract, Art. 6(1)(b); keeping it as evidence after the contract ends: legitimate interest in defending legal claims, Art. 6(1)(f) |
| Removal requests and broker replies: which brokers were contacted for which address, status, dates, the replies | Us, data brokers | To carry out and follow up your removals, and show you the progress | Contract, Art. 6(1)(b) |
| Subscription data: plan, status, amounts and currency, Mollie's customer, payment and subscription ids, the terms version you accepted and when, when you asked us to start within the withdrawal period, refunds and chargebacks | You, Mollie | To run the subscription, handle withdrawals, refunds and failed payments, and prove your consent to an early start | Contract, Art. 6(1)(b); legal obligation for consumer law evidence, Art. 6(1)(c) |
| Receipts: number, date, plan, amount, VAT, our seller details. No name, email or address | Us | Bookkeeping | Legal obligation, Art. 6(1)(c) (Danish Bookkeeping Act, bogføringsloven) |
| Discount and referral data: codes used, who referred whom, reward status | You, us | To apply discounts and rewards | Contract, Art. 6(1)(b) |
| Referral checks: whether the referred customer paid with the same card or bank account as the referrer, compared in memory from Mollie's payment details and never stored | Mollie | To prevent self-referral | Legitimate interest in preventing abuse, Art. 6(1)(f) |
| Do-it-yourself progress: which guides you marked done, and in the privacy check which platforms you say you use (never your usernames or profiles) | You | To show your progress and the steps that apply to you | Contract, Art. 6(1)(b) |
| Email preferences: monthly summary (on by default) and product news (off unless you turn it on) | You | To send only the emails you want | Monthly summary: contract, Art. 6(1)(b). Product news: consent, Art. 6(1)(a), and the Danish Marketing Practices Act § 10 |
| Language | Your choice, your browser, or your country as our network provider reports it | To show the app in your language | Legitimate interest, Art. 6(1)(f) |
| Sign-in and security data: session cookie, hashed one-time link tokens, when you were last active, IP address for rate limits (in memory only) | Your browser | To keep your account secure, stop abuse, and delete inactive accounts | Contract, Art. 6(1)(b); legitimate interest in security and data minimisation, Art. 6(1)(f) |
| Emails you send us | You | To answer you | Contract or legitimate interest, Art. 6(1)(b) or (f) |
What we never ask for: identity documents, national ID numbers (CPR, personnummer, fødselsnummer, kennitala), passwords for other services, or special categories of data (health, religion and similar). Sites that demand an ID are left to you, with a guide.
Automated decisions: none. Nothing about you is decided by automated means with legal or similarly significant effect.
If you do not give us the data: without an email address there is no account; without your name, country and a signed LOA we cannot send removal requests.
4. Where your data is kept
All our systems run on our own servers, rented from Hetzner in the EU. Your name and email addresses are encrypted before they are stored, with the keys kept separately; backups are encrypted too. Payment details are held only by Mollie, in the EU (see below).
5. Who receives your data
Data brokers. To do what you asked, we send each data broker your name, the email addresses you have confirmed with us, and your signed LOA, by email or through the broker's web form (web forms get no LOA). The broker receives them as an independent controller, and every request states that the data may be used only to find and delete your record. Data brokers are worldwide; many are in the USA.
Service providers who process data only on our instructions, under a data processing agreement:
- our hosting provider in the EU (servers, databases, backups, email);
- a network and security provider that protects the website and carries its traffic;
- an AI service in the EU that helps us read brokers' replies, after names and identifiers have been removed; it keeps nothing and does not train on the data;
- an email provider for our hello@ mailbox, in a country with an EU adequacy decision.
On request we tell you who they are.
Mollie B.V., the Netherlands, handles your payment as an independent controller, under its own privacy statement and legal duties (anti-money-laundering, fraud prevention). We send Mollie no name, email or address.
Authorities only where the law requires it.
We do not sell your data, and we do not share it for advertising.
6. Transfers outside the EU/EEA
- We store nothing outside the EU/EEA, apart from emails you send us, which our email provider keeps in a country with an EU adequacy decision.
- Our network and security provider may process the website's traffic outside the EU; basis: the EU–US Data Privacy Framework and Standard Contractual Clauses.
- Removal requests to brokers abroad are transfers. Brokers in a country with an adequacy decision, or certified under the Data Privacy Framework, or covered by Standard Contractual Clauses, are contacted as part of the service. Brokers covered by none of these get a request only if you tick the optional box on your LOA. Without it, we do not contact them.
7. How long we keep your data
| Data | How long |
|---|---|
| Account, email addresses, preferences, subscription and code data | Until you delete your account; then deleted at once. An account without login for 12 months and without a running subscription is deleted too; we email you 30 days before |
| Name, email addresses, removal cases and broker replies | Until you delete your account; then deleted at once. While your account exists: closed removal cases 12 months after they close. Broker replies that cannot be matched to a customer, including replies that arrive after your account was deleted: 90 days |
| Signed LOA (the PDF with your name and the signing details, including the IP address and browser you signed from) | For as long as you are a customer, also after you revoked or replaced it, and 180 days after your account is deleted, as evidence in case of a dispute; then deleted automatically |
| Receipts (no personal data) | 5 years from the end of the financial year (bogføringsloven). After account deletion the link to your account is removed |
| Mollie's payment records | Kept by Mollie under its own legal duties |
| Sign-in links | 15 minutes; confirmation links for extra emails and children's addresses 24 hours; family invitations 7 days |
| Session (login) | 6 hours, or until you log out |
| Emails you send us | 12 months after the last message |
| Application logs | 30 days |
| Encrypted backups | 30 days, rolling. After any restore, every deletion made since the backup is repeated before the system is used |
8. Your rights
You have the right to:
- access your data and get a copy;
- have wrong data corrected;
- have your data erased (deleting your account does this in one step);
- restrict processing;
- data portability for data you gave us, where processing is based on contract or consent;
- object to processing based on legitimate interest;
- withdraw consent at any time (for example to product news, in Account Settings), without affecting processing before the withdrawal;
- revoke your Letter of Authorisation at any time in Account Settings.
Write to hello@nordic17.com. We answer within one month, and may ask you to confirm the request from your account's email address. You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, or to the authority in your own country (IMY in Sweden, Datatilsynet in Norway, Persónuvernd in Iceland).
9. Cookies
We set only the cookies the app needs. See the cookie notice.
10. Changes
We update this policy when our processing changes, and tell you by email about important changes.