NorthSky legal
NorthSky privacy notice for online courses and course certificates
Version 1.0 — in force from 27 September 2026 (WSD-098). This notice is part of the NorthSky privacy notice for the webshop and adds what is particular to online courses and course certificates. The controller is RMX DRIFT AS, organisation number 931 140 574, acting through NorthSky Aviation Consultancy. Contact: post@northsky.no.
This document is not legal advice.
What we process
When you buy a course, we process the same order data as for any other purchase (see the webshop privacy notice). When you take the course, we set one cookie that proves your access (__Host-ns_academy, 14 days); it holds a random reference, not your name or email address. Your progress and your reflection notes are stored only in your own browser, and leave it only if you download them. When you take the final assessment, we count your attempts per day; we do not store your answers. The academy service itself records no IP address (Cloudflare, which carries all traffic to northsky.no, is described in the webshop privacy notice).
Course certificates
If you pass and ask for a course certificate, we store your name, the organisation you choose to give (optional), the date, your score, the course, its version and language, and a random certificate id. Anyone who has the id can check on our verification page whether the certificate is valid, and see your name, the organisation, the date, the course, its version and language. We show this only because you consented to it when the certificate was issued.
Legal basis
The course and the order: performance of the contract (Article 6(1)(b)). The public verification of your certificate: your consent (Article 6(1)(a)).
How long
We keep certificate records for five years after issue or after their last change of status, whichever is later, and then delete or anonymise them. Online verification is available during that period. After it, your own copy still documents that you completed the course, but we no longer confirm it.
Withdrawing consent
Write to post@northsky.no. We delete your certificate record, and the verification page then answers as for an id that does not exist. Withdrawal does not affect anything done before it. You keep access to the course.
Who else sees it
The course and the certificate records are hosted by Cloudflare, which already runs northsky.no and the shop (see “Who else sees your data” in the webshop privacy notice), now also on the academy paths. No one else receives course or certificate data.
Refunds
If a purchase is refunded, access ends and certificates issued under it are marked revoked. A revoked certificate still shows its name on the verification page until the record is deleted at the end of the retention period, or earlier if you withdraw consent.
Your other rights
You have the same rights as for any other data we hold about you: access, correction, erasure, restriction, objection and data portability where they apply, and the right to complain to Datatilsynet. Write to post@northsky.no.