Privacy notice

Who is responsible for your data

The data controller for this website is:

Both registrations can be verified in the Norwegian Central Coordinating Register for Legal Entities at brreg.no. NorthSky has not appointed a data protection officer. That is not required for an organisation of this size and processing profile.

What this notice covers

This notice applies to the whole of www.northsky.no: the main site, the screening tools under /tools/, the articles under /insights/ and /innsikt/, the contact and booking pages, and the product pages when they open. It also covers the email correspondence that follows from any of them.

It does not cover a consultancy engagement itself. Once NorthSky is engaged, the handling of your material is governed by the agreement made in that case, which normally includes confidentiality terms that go further than this notice.

The short version

NorthSky is a one-person consultancy. It does not run advertising, does not profile visitors and does not sell data. Page views are counted with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device, and the site’s own pages set no analytics or advertising cookies; that is why this site has no cookie banner and does not need one, and it is described in full under Cookies below. The screening tools run entirely in your browser and send nothing unless you press the button that says they will. Most visitors to this site leave no personal data behind at all.

What is collected, and why

Simply reading the site

Nothing is asked of you, and no analytics or advertising cookie is set by the site’s own pages. Page views are counted by Cloudflare Web Analytics as described under Cookies below; that measurement stores nothing on your device and cannot identify you. The hosting platform and the content delivery network record technical log data as part of normal operation: your IP address, the time of the request, the page requested and your browser identification. This is used for security, abuse prevention and fault diagnosis under the legitimate interest basis, GDPR article 6(1)(f). It is not used for analysis, profiling or marketing, and it is retained under the providers’ own standard log periods rather than by NorthSky.

The Cloudflare Worker that serves parts of this site counts four things: when a tool page is opened, when a tool is started, when it is completed, and when a document (a PDF, Excel, Word or ZIP file) is downloaded from those parts of the site, including documents attached to articles. What is recorded is the name of the event and the name of the tool, or for a download the name of the file, and nothing else. No identifier, no IP address, no answers. It cannot be traced back to a person, including by NorthSky. Cloudflare keeps these counts for three months.

Using a screening tool

Every screening tool is scored in your browser. While you answer the questions, nothing is transmitted and nothing is written to your device. Your answers exist in the open page and are gone when you close or reload it. No cookie and no browser storage is used. You can complete a tool, read your result and print it without sending anything to anyone.

If you choose to send a result for expert review, that submission is the only point at which data reaches NorthSky.

Collected

Your name, email address, organisation, the operating context you describe, your role and what you would like from a review, together with your answers, the resulting score, the advisory band, any attention flags, the section scores, the version of the scoring model and the time you completed it.

Why

So that the reply addresses what your answers actually raised instead of being generic, and so NorthSky can tell you what a full assessment would involve. Submissions are also reviewed in aggregate to improve the questions and the weighting.

Lawful basis

Your consent, article 6(1)(a), given by ticking the box before you send. You may withdraw it at any time by emailing us and the submission will be deleted. Withdrawal does not undo a reply already sent. Where a submission leads to a discussion about an engagement, the correspondence that follows rests on article 6(1)(b), steps taken at your request before a contract.

Stored

In the website database on NorthSky’s Hostinger hosting, in a log visible only to signed-in administrators, with a notification to the NorthSky mailbox so it is not missed.

Retention

Up to 24 months, or less on request. Anything kept beyond that to improve the scoring model has your name, email address and organisation removed first, so it can no longer be linked to you.

Automated decision-making

None. The score is arithmetic applied to the answers you gave, it is shown to you in full, and it produces no decision with legal or similar effect. A person reads every submission before replying.

Contacting NorthSky or booking a discussion

The contact form is Fluent Forms, running on NorthSky’s own hosting. The booking page uses Google Calendar appointment scheduling.

Collected

Your name, email address, organisation, the context you give, what you would like to discuss, and your preferred meeting language.

Why

To answer you, and to schedule, prepare for and follow up the meeting you asked for.

Lawful basis

Steps taken at your request before a contract, article 6(1)(b), together with NorthSky’s legitimate interest in answering enquiries, article 6(1)(f).

Retention

Booking and enquiry records for up to 24 months, or less on request. Meetings are not recorded unless agreed in advance.

Each booking creates a Google Meet link. If you join the meeting, Google processes connection data under its own terms as part of delivering that service.

Email

If you email NorthSky, your message and address are processed to handle your enquiry, on the basis of pre-contractual steps or legitimate interest, articles 6(1)(b) and 6(1)(f). Mailboxes are hosted with Hostinger and Google Workspace. Correspondence is kept for as long as the enquiry or engagement needs it, and where it forms part of accounting documentation, for the five years required by the Norwegian Bookkeeping Act, bokføringsloven.

Buying a product

The webshop is open. Orders, invoices, delivery and payment are covered by the separate webshop privacy notice, and online courses and course certificates by the course privacy notice. Payment is handled by Stripe, which acts as an independent controller for the payment itself. NorthSky does not receive or store your card number.

Cookies

Analytics. This site uses Cloudflare Web Analytics to count page views. It sets no cookies, stores nothing on your device and does not identify you or follow you between sites. It records the page address, the referring page, the country the request came from and the type of device, and it reports these as aggregate counts. Because nothing is stored on or read from your device for this purpose, no consent is required under ekomloven § 3-15 and this site asks for none.

Advertising and former tools. The site’s own pages set no analytics or advertising cookies and run no advertising pixel, profiling or cross-site tracking. NorthSky previously used Google Analytics 4, Microsoft Clarity and Apollo.io tracking on this site. All three have been removed, and the consent banner that sat with them has been removed too, because nothing that needs consent runs on the site’s own pages any more. Removing a script from this site does not delete data those providers already hold from earlier visits.

Why there is no cookie banner. Ekomloven § 3-15 governs storing information in, and obtaining access to information in, your device, and it applies whether or not that information is personal data (Nkom; Datatilsynet). A measurement that neither writes to nor reads from your device does not engage the provision, so there is no consent to ask for. NorthSky would rather run a measurement that needs no banner than run a banner. Cloudflare states that Web Analytics uses no client-side state such as cookies or local storage and does not fingerprint visitors (Cloudflare).

Other cookies. Beyond the page-view measurement described above, the site’s own pages do not set analytics, advertising, profiling or cross-site tracking cookies.

The site platform may set strictly technical cookies needed for security and page caching, and a session cookie for signed-in administrators. Under ekomloven § 3-15 these do not require consent, because they are necessary to deliver the service you asked for. That provision replaced § 2-7b of the 2003 Act, which is the reference most Norwegian cookie texts still quote, when the new Electronic Communications Act took effect on 1 January 2025, and the consent standard it applies is now the GDPR one: refusing must be as easy as accepting (Datatilsynet).

The booking calendar embedded from Google is the one remaining third-party element that may set cookies, and the exception to what is said above. When that element loads, Google may set cookies in your browser and process data under the Google Privacy Policy, which NorthSky does not control. If you would rather not load it, email NorthSky and a meeting can be arranged by hand.

When the webshop opens, WooCommerce will add cart, session and login cookies. Those are strictly necessary for a shop you have chosen to use, and this notice will be updated to name them.

Who processes data on NorthSky’s behalf

NorthSky does not sell personal data and does not share it with third parties for their own purposes.

Your rights

You may ask for access to the personal data NorthSky holds about you, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, and ask for your data in a portable format. Where processing rests on consent you may withdraw it at any time, which does not affect processing already carried out.

Send requests to post@northsky.no. NorthSky will answer within one month. If you are not satisfied with the answer you may complain to the Norwegian Data Protection Authority, Datatilsynet.

Children

This site is aimed at professional and organisational users. It is not directed at children and NorthSky does not knowingly collect personal data from anyone under 16.

Changes to this notice

Version 2.2, 14 October 2026. The paragraph on the anonymous tool counters now names all four events the Cloudflare Worker counts (a tool page opened, a tool started, a tool completed, a document downloaded) and states that Cloudflare keeps the counts for three months. What is collected has not changed; the earlier text described two of the four events.

Version 2.1, 3 October 2026. Google Analytics 4, Microsoft Clarity, the Apollo.io tracker and the cookie consent banner are stated as removed. The site’s own pages are stated to set no analytics or advertising cookies. The earlier statement that a consent mechanism was being introduced is withdrawn. Cloudflare Web Analytics, which has run on the northsky.no zone since 19 August 2026, is stated as the only measurement, the reason no consent banner is used is set out, and the Google Calendar booking embed is named as the one remaining third-party element that may set cookies. The page-view counter paragraph, the Cloudflare row in the processor table and the matching statements in the short version and under “Simply reading the site” are restored in this version, because the owner confirmed on 3 October 2026 that Cloudflare Web Analytics is in use.

Version 2.0, 14 September 2026. Extended from the tools pages to the whole of www.northsky.no. Added Cloudflare to the processor table, added the contact form, named the anonymous tool counters, added the cookie basis in ekomloven, added a section on children, and noted the webshop as a future change. The privacy enquiry address is now post@northsky.no.

Version 1.1, 25 August 2026. Added the airfield risk assessment tool and the website database.

This notice is versioned. When NorthSky adds a service that processes personal data in a new way, this page is updated and the version and date above change with it.