Privacy notice

Who is responsible for your data

The data controller for this website is:

Both registrations can be verified in the Norwegian Central Coordinating Register for Legal Entities at brreg.no. NorthSky has not appointed a data protection officer. That is not required for an organisation of this size and processing profile.

What this notice covers

This notice applies to the whole of www.northsky.no: the main site, the screening tools under /tools/, the articles under /insights/ and /innsikt/, the contact and booking pages, and the product pages when they open. It also covers the email correspondence that follows from any of them.

It does not cover a consultancy engagement itself. Once NorthSky is engaged, the handling of your material is governed by the agreement made in that case, which normally includes confidentiality terms that go further than this notice.

The short version

NorthSky is a one-person consultancy. It does not run advertising, does not profile visitors and does not sell data. It does use Google Analytics to count visits, which sets cookies and is described in full under Cookies below. The screening tools run entirely in your browser and send nothing unless you press the button that says they will. Apart from the analytics measurement, most visitors to this site leave no personal data behind at all.

What is collected, and why

Simply reading the site

Nothing is asked of you, and no analytics cookie is set. The hosting platform and the content delivery network record technical log data as part of normal operation: your IP address, the time of the request, the page requested and your browser identification. This is used for security, abuse prevention and fault diagnosis under the legitimate interest basis, GDPR article 6(1)(f). It is not used for analysis, profiling or marketing, and it is retained under the providers’ own standard log periods rather than by NorthSky.

The Cloudflare Worker that serves parts of this site counts how often a tool is started and completed. What is recorded is the name of the event and the name of the tool, and nothing else. No identifier, no IP address, no answers. It cannot be traced back to a person, including by NorthSky.

Using a screening tool

Every screening tool is scored in your browser. While you answer the questions, nothing is transmitted and nothing is written to your device. Your answers exist in the open page and are gone when you close or reload it. No cookie and no browser storage is used. You can complete a tool, read your result and print it without sending anything to anyone.

If you choose to send a result for expert review, that submission is the only point at which data reaches NorthSky.

Collected

Your name, email address, organisation, the operating context you describe, your role and what you would like from a review, together with your answers, the resulting score, the advisory band, any attention flags, the section scores, the version of the scoring model and the time you completed it.

Why

So that the reply addresses what your answers actually raised instead of being generic, and so NorthSky can tell you what a full assessment would involve. Submissions are also reviewed in aggregate to improve the questions and the weighting.

Lawful basis

Your consent, article 6(1)(a), given by ticking the box before you send. You may withdraw it at any time by emailing us and the submission will be deleted. Withdrawal does not undo a reply already sent. Where a submission leads to a discussion about an engagement, the correspondence that follows rests on article 6(1)(b), steps taken at your request before a contract.

Stored

In the website database on NorthSky’s Hostinger hosting, in a log visible only to signed-in administrators, with a notification to the NorthSky mailbox so it is not missed.

Retention

Up to 24 months, or less on request. Anything kept beyond that to improve the scoring model has your name, email address and organisation removed first, so it can no longer be linked to you.

Automated decision-making

None. The score is arithmetic applied to the answers you gave, it is shown to you in full, and it produces no decision with legal or similar effect. A person reads every submission before replying.

Contacting NorthSky or booking a discussion

The contact form is Fluent Forms, running on NorthSky’s own hosting. The booking page uses Google Calendar appointment scheduling.

Collected

Your name, email address, organisation, the context you give, what you would like to discuss, and your preferred meeting language.

Why

To answer you, and to schedule, prepare for and follow up the meeting you asked for.

Lawful basis

Steps taken at your request before a contract, article 6(1)(b), together with NorthSky’s legitimate interest in answering enquiries, article 6(1)(f).

Retention

Booking and enquiry records for up to 24 months, or less on request. Meetings are not recorded unless agreed in advance.

Each booking creates a Google Meet link. If you join the meeting, Google processes connection data under its own terms as part of delivering that service.

Email

If you email NorthSky, your message and address are processed to handle your enquiry, on the basis of pre-contractual steps or legitimate interest, articles 6(1)(b) and 6(1)(f). Mailboxes are hosted with Hostinger and Google Workspace. Correspondence is kept for as long as the enquiry or engagement needs it, and where it forms part of accounting documentation, for the five years required by the Norwegian Bookkeeping Act, bokføringsloven.

Buying a product

The webshop is not open. When it opens, this notice will be updated before the first sale, and the detailed handling of orders, invoices, downloads and payment is set out separately in the store privacy notice. Payments will be handled by Stripe, which acts as an independent controller for the payment itself. NorthSky will not receive or store your card number.

Cookies

Analytics. This site loads Google Analytics 4, property G-9YRG3E1VYB, on both the main site and the tool, article and product pages. This was verified by inspecting the live pages on 14 September 2026. Google Analytics sets _ga and _ga_* cookies in your browser to recognise a returning browser and to count visits, and it processes data as described in the Google Privacy Policy.

Analytics cookies are not strictly necessary, so under ekomloven § 3-15 they require your consent, and refusing must be as easy as accepting (Datatilsynet). NorthSky does not yet ask for that consent, and is correcting it: the measurement is being brought behind a consent mechanism, and this notice will be updated with the date that takes effect and the exact cookie names and lifetimes. Until then you can prevent it with your browser’s cookie settings, a tracking blocker, or Google’s opt-out add-on.

There is no advertising pixel and no cross-site advertising or profiling. A Microsoft Clarity script reference also appears on the front page of the main site, carried by the site platform rather than added by NorthSky, and it is being examined as part of the same review.

Other cookies. Beyond analytics, the site does not set advertising, profiling or cross-site tracking cookies.

The site platform may set strictly technical cookies needed for security and page caching, and a session cookie for signed-in administrators. Under ekomloven § 3-15 these do not require consent, because they are necessary to deliver the service you asked for. That provision replaced § 2-7b of the 2003 Act, which is the reference most Norwegian cookie texts still quote, when the new Electronic Communications Act took effect on 1 January 2025, and the consent standard it applies is now the GDPR one: refusing must be as easy as accepting (Datatilsynet).

The booking calendar embedded from Google is the exception. When that element loads, Google may set cookies in your browser and process data under the Google Privacy Policy, which NorthSky does not control. If you would rather not load it, email NorthSky and a meeting can be arranged by hand.

When the webshop opens, WooCommerce will add cart, session and login cookies. Those are strictly necessary for a shop you have chosen to use, and this notice will be updated to name them.

Who processes data on NorthSky’s behalf

NorthSky does not sell personal data and does not share it with third parties for their own purposes.

Your rights

You may ask for access to the personal data NorthSky holds about you, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, and ask for your data in a portable format. Where processing rests on consent you may withdraw it at any time, which does not affect processing already carried out.

Send requests to post@northsky.no. NorthSky will answer within one month. If you are not satisfied with the answer you may complain to the Norwegian Data Protection Authority, Datatilsynet.

Children

This site is aimed at professional and organisational users. It is not directed at children and NorthSky does not knowingly collect personal data from anyone under 16.

Changes to this notice

Version 2.0, 14 September 2026. Extended from the tools pages to the whole of www.northsky.no. Added Cloudflare to the processor table, added the contact form, named the anonymous tool counters, added the cookie basis in ekomloven, added a section on children, and noted the webshop as a future change. The privacy enquiry address is now post@northsky.no.

Version 1.1, 25 August 2026. Added the airfield risk assessment tool and the website database.

This notice is versioned. When NorthSky adds a service that processes personal data in a new way, this page is updated and the version and date above change with it.