NorthSky legal
Privacy notice for the NorthSky webshop
This notice explains what personal data the NorthSky webshop collects about you when you buy a digital product, why it is collected, how long it is kept, and what you can ask us to do about it. It applies to purchases made through the shop and to the emails we send you about an order. It does not cover anything you send us separately, such as a consultancy enquiry. It binds us, as the controller, in how we handle your data, and it is written for you to read rather than for a lawyer.
NorthSky provides operational risk decision support and advisory guidance. Outputs do not constitute regulatory certification, aerodrome licensing, compliance verification, or formal authority determinations.
Version 1.0 — in force from 3 October 2026, the day it is published (OI-212). The notice for online courses and course certificates is part of it (see the section on online courses).
This document is not legal advice.
Who is responsible for your data
The controller is:
RMX DRIFT AS Organisation number 931 140 574 Wergelands vei 2, 3117 Tønsberg, Norway Email: post@northsky.no Telephone: +47 971 74448
NorthSky Aviation Consultancy, organisation number 931 140 701, is a registered business unit of RMX DRIFT AS and is the trading name used in the shop. The legal person responsible for your data, and the party you contract with, is RMX DRIFT AS.
There is no data protection officer. One is not required for the current activity, and none has been appointed. If that changes, this notice will be updated before the appointment takes effect.
What we collect
We collect the following, and nothing beyond it.
| What | When | Why we need it |
|---|---|---|
| Your name | At checkout | To issue the invoice and the licence in the correct name |
| Your email address | At checkout | To send the receipt and invoice, and to let you open the course or download the files again later |
| Your billing address, of which we keep only the country | At checkout, collected by Stripe | To determine the correct merverdiavgift (MVA, value added tax) treatment and whether we are able to sell to you |
| Organisation number or VAT number, and the registered organisation name | At checkout, business and public-sector buyers only | To confirm that the buyer is a business or public body, to name the licence holder, and to support the VAT treatment applied |
| Order record: what was bought, the amount, the date, the invoice number, the payment reference from the payment provider, the order reference (starting NS-), and the VAT treatment applied | At purchase | To fulfil the order and to keep the accounting record required by law |
| Access record: your email address, the product and licence, the billing country, the order reference and the date | At purchase | So that the course can be opened and the files downloaded again when you give your email address and order reference |
We do not collect a date of birth, a postal address beyond what is needed on an invoice, a personal identity number, marketing preferences, or any special category of data. We do not ask you to create an account, and we do not build a customer profile.
We do not hold your card details. See the section on payment below.
Why we use it, and the legal basis for each purpose
| Purpose | Legal basis under the GDPR |
|---|---|
| Taking your order, delivering the product, issuing the licence and the download link, and answering questions about your order | Performance of a contract with you, Article 6(1)(b) |
| Keeping invoices, credit notes and the underlying order records as accounting records | Legal obligation, Article 6(1)(c), under bokføringsloven (the Bookkeeping Act) and the VAT rules |
| Determining and documenting the correct VAT treatment, including retaining your organisation or VAT number and the register lookup that supports a zero-rated sale | Legal obligation, Article 6(1)(c) |
| Detecting and preventing fraudulent orders and misuse of download links | Our legitimate interests, Article 6(1)(f), in not having products taken without payment. We use the minimum data for this: country and timestamps |
| Establishing, exercising or defending a legal claim, including enforcing the licence terms | Our legitimate interests, Article 6(1)(f), in defending the licence and the copyright in the product |
Where we rely on legitimate interests, we have weighed our interest against your rights. The data involved is the data you already gave us to complete the order, we do not combine it with data from other sources, and the processing is limited to what the purpose needs. You may object to processing based on legitimate interests; see your rights below.
We do not use your data for marketing. We will not send you a newsletter or a product announcement on the basis of a purchase unless you separately ask for one, in which case consent, Article 6(1)(a), would be the basis and you could withdraw it at any time.
Payment
Stripe is the only payment provider used by the shop, and payment is by card. Vipps is not offered at present.
Your card number and any equivalent payment credential are entered into Stripe’s own payment interface and go to Stripe, not to us. No card data is held by, passes through, or is stored in NorthSky systems at any point. We receive from Stripe only what we need to reconcile the order: a payment reference, the amount, the currency, the payment method type, the country of the payment method, and whether the payment succeeded.
Stripe processes your payment data as an independent controller for its own purposes, including fraud prevention and its own legal and regulatory obligations. That means Stripe decides how it uses that data and is responsible for it under its own privacy policy, which you should read if you want to know what Stripe does with it. We are not able to answer for Stripe’s processing, and a request about the data Stripe holds has to go to Stripe.
Who else sees your data
Two recipients process your order data, Stripe and Cloudflare:
- Stripe, as described above, for taking payment.
- Stripe, for the receipt and invoice email. Stripe sends the receipt and invoice for your order to the address you gave at checkout, on our behalf. The invoice carries your order reference and the address of the page where you can get your files or course access again. We send no other email about an order, apart from answering you.
- Cloudflare, which is the content delivery network and reverse proxy in front of northsky.no, including the shop paths, and which runs the cookieless page-view measurement described under Cookies and measurement and the anonymous tool counters described in the site-wide privacy notice. Requests to the shop pass through Cloudflare’s edge, so it processes the technical request data any network intermediary sees. Cloudflare also stores, on our instructions, the access record described above and the product files you download. It is not sent your payment details.
Beyond those, your data is disclosed only to our accountant and auditor in the course of keeping and checking the accounts, to a public authority where the law requires disclosure, and to a legal adviser or a court if a claim arises.
We do not sell your data, and we do not share it for anyone else’s marketing.
Cookies and measurement
Measurement. The site uses Cloudflare Web Analytics to count page views. It sets no cookies, stores nothing on your device and does not identify you or follow you between sites. It records the page address, the referring page, the country the request came from and the type of device, and reports these as aggregate counts. Because nothing is stored on or read from your device for this purpose, no consent is required under ekomloven § 3-15 and the site asks for none. The site’s own pages set no analytics or advertising cookies, and there is no advertising pixel, no profiling and no cross-site tracking. Google Analytics 4, Microsoft Clarity and Apollo.io tracking were previously used on the site and have been removed, together with the cookie consent banner. Removing them does not delete data those providers already hold from earlier visits. The booking calendar embedded from Google is the one remaining third-party element that may set cookies; it is not part of the shop, and it is an exception the owner has decided to keep. The full assessment is in the cookie and tracking policy.
Shop cookies. The shop’s own pages under /store/ set no cookies: there is no cart, no account and no sign-in. Payment happens on Stripe’s own checkout page, which sets the cookies Stripe needs to take the payment and prevent fraud, under Stripe’s privacy policy. An online course sets one strictly necessary cookie that proves access, described in the course privacy notice. None of these requires consent, and there is no consent banner on this site.
Transfers outside the EEA
Some of your data will leave the European Economic Area, and we would rather say so plainly than imply otherwise.
- Stripe is a payment provider with operations in the United States and elsewhere. Payment data you enter, and the transaction data associated with it, may be processed outside the EEA under Stripe’s own arrangements as an independent controller. Those arrangements typically rest on the European Commission’s standard contractual clauses and, where applicable, on an adequacy decision covering certified United States recipients.
- Cloudflare operates a global edge network, so a request to the shop may be served from a location outside the EEA. Cloudflare publishes a data processing addendum incorporating the EU standard contractual clauses. Whether it has been accepted on the NorthSky account is an open item recorded in the IP and partner register, section 8.
Where a transfer occurs, we rely on the standard contractual clauses or on an adequacy decision. We cannot promise that data held outside the EEA is beyond the reach of the laws of the country it sits in, and we do not claim that. If this matters to you, contact us before you buy and we will tell you what we know at that point.
How long we keep it
| Data category | Retention period | Why |
|---|---|---|
| Invoices, credit notes and the order records that support them, including your name, the amount, the VAT treatment and the organisation or VAT number | Five years after the end of the financial year to which they relate | Required by bokføringsloven (the Bookkeeping Act) |
| Register lookup result supporting a zero-rated sale | Five years after the end of the financial year to which it relates | Part of the accounting record supporting the VAT treatment |
| Licence record: who holds which licence, and from when | For as long as the licence is in force, and five years after it ends | To identify the licence holder and to defend or enforce the licence |
| Email address used for delivery | Five years after the end of the financial year of the order, as part of the order record | The delivery address is part of the record of what was delivered to whom |
| Access record: email address, product, licence, billing country, order reference and date | For as long as the licence is in force, because it is what lets you open the course or download the files again. Deleted when you ask (after which access can only be restored by writing to us), and five years after the end of the financial year in which the purchase was refunded or the licence ended | The terms promise course access and re-download without an end date |
| Record of a paid order that could not be delivered (for example a buyer outside the countries we sell to): email address, country, reason and date | 12 months, then deleted automatically | To refund and contact the buyer, to show why the order was not delivered, and to review whether the rule works |
| Course certificate record: name, optional organisation, date, score, course, version, language and certificate id | Five years after issue or after the last change of status, whichever is later; deleted earlier if the holder withdraws consent to public verification | To let anyone the holder shows the id to check the certificate, for a reasonable period (WSD-080, WSD-098) |
| Correspondence with you about an order | Three years from the last message, unless it relates to a claim, in which case until the claim is resolved and any limitation period has run | To handle queries and complaints |
When a period ends, the data is deleted or anonymised. Where one record serves two purposes, the longer period applies to that record and the shorter period applies to any copy held elsewhere.
Online courses and course certificates
What is particular to online courses and course certificates is set out in the course privacy notice, which is part of this notice (WSD-098).
Automated decision-making and profiling
We do not carry out automated decision-making that produces a legal effect concerning you or similarly significantly affects you, and we do not profile you. The checkout does apply automated rules, for example refusing an order from a consumer outside Norway and checking whether an organisation number resolves in the register, but these are fixed rules applied to the details you enter, not an assessment of you as a person, and a refused order can always be raised with us by email for a human to look at.
Your rights
Under the GDPR you may ask us to:
- Access the personal data we hold about you, and receive a copy of it.
- Correct data that is wrong or incomplete.
- Delete data, where we no longer need it. This does not extend to accounting records within the five-year retention period, because the law requires us to keep them.
- Restrict processing while a dispute about accuracy or about our legitimate interests is resolved.
- Object to processing we base on legitimate interests, giving your reasons, after which we stop unless we have grounds that override yours.
- Port the data you gave us, in a machine-readable format, where the processing rests on the contract with you or on your consent.
- Withdraw consent, where consent was the basis, without affecting anything done before you withdrew it.
To exercise any of these, email post@northsky.no with enough detail to identify the order. We answer within one month; if a request is complex we will tell you within that month and may take up to two further months. We may ask for information to confirm it is really you, and we will not use that information for anything else. There is no charge, unless a request is manifestly unfounded or excessive.
Complaints
If you think we have handled your data wrongly, tell us first at post@northsky.no, so we have a chance to put it right. You are also entitled to complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority in the EEA country where you live or work. Complaining to us does not affect your right to complain to Datatilsynet.
Security
Data is held in systems protected by access control and encryption in transit. Download links are signed, single-purpose and expire after one hour. Getting a new link needs both the email address and the order reference. Access to order records is restricted to those who need it to run the shop or to keep the accounts. A full description of the technical measures is maintained separately and is not published here.
Changes to this notice
This notice is versioned in the NorthSky repository, and the current version is published on the website alongside the store terms. When we change it, the review date below is updated and the change is recorded in the repository history, which shows what changed and when. A change that affects how we use data you have already given us will be notified to you by email to the address on your order before it takes effect. We will not apply a materially different use retroactively to data collected under an earlier version.
Related documents
- VAT treatment
- Company identification
- Standard single-organisation licence
Sources
- Forbrukertilsynet, information duties in online trade — https://www.forbrukertilsynet.no/vi-jobber-med/netthandel/hvilke-opplysninger-har-forbrukerne-krav-pa-nar-de-handler-ting-pa-internett
- Ehandelsloven, LOV-2003-05-23-35 — https://lovdata.no/dokument/NL/lov/2003-05-23-35
- Enhetsregisteret, RMX DRIFT AS — https://data.brreg.no/enhetsregisteret/api/enheter/931140574
- Stripe, payment method support by country and currency — https://docs.stripe.com/payments/payment-methods/payment-method-support
- Nkom, informasjonskapsler/cookies — https://nkom.no/internett/informasjonskapsler-cookies
- Datatilsynet, consent to cookies and other tracking technologies — https://www.datatilsynet.no/personvern-pa-ulike-omrader/internett-og-apper/bruk-av-informasjonskapsler-og-andre-sporingsteknologier/
- Cloudflare, privacy-first Web Analytics — https://blog.cloudflare.com/privacy-first-web-analytics/
- Cloudflare, GDPR trust hub and the data processing addendum — https://www.cloudflare.com/trust-hub/gdpr/
This notice is not legal or tax advice.