Privacy Policy

How we handle personal data — short, clear, and without legalese.

01 Data Controller

NordLeads AB (company registration number 556488-3337) is the data controller for the processing described in this policy.

Postal address: Porfyrvägen 16, 585 63 Linghem, Sverige
Data protection contact: jesper@nordleads.se

02 What we collect

a) From the lead form on nordleads.se

When you fill in our popup we collect:

• Company name
• Contact name
• Phone number
• Free-text answer to the question "Why do you need more leads?"
• Technical metadata: submission timestamp, IP address (for anti-spam)

b) From email campaigns we run for our customers

When a customer uses NordLeads to run outreach we process:

• Recipient email addresses (from lists provided by the customer)
• Company name and role when included in the list
• Engagement signals: opens, clicks, replies, unsubscribes, bounces

Recipient lists are provided by the customer, who acts as data controller. NordLeads then acts as data processor for the send-out and processes the data under a Data Processing Agreement (DPA).

c) Portal account data (app.nordleads.se)

• Email address (login)
• Password — stored bcrypt-hashed, never in clear text
• Session data, last login, IP for security logs

03 Legal basis

Consent — Art. 6(1)(a) GDPR

For data you submit yourself via the lead form on nordleads.se. By clicking "Submit" you consent to us contacting you to discuss a potential business relationship. You may withdraw consent at any time.

Legitimate interest — Art. 6(1)(f) GDPR

For B2B outreach to publicly listed business contacts (e.g. info@- and role-based addresses at Swedish companies). We have performed a balancing test and consider that the interest in offering relevant B2B services does not override the recipient's right to privacy, provided that each email contains clear sender identification and a simple opt-out.

You always have the right to object to processing based on legitimate interest — see section 8.

Contract — Art. 6(1)(b) GDPR

For administration of your customer account in the portal and delivery of the service under contract.

04 Purposes

• Lead form: to respond to your enquiry, book a call, and determine whether we're a fit.
• Email campaigns: to deliver send-outs on behalf of customers, measure engagement, and improve results.
• Portal account: authentication, statistics dashboard, copy approval, security logging.
• Compliance: to fulfil legal obligations (accounting, data protection, suppression lists).

05 Retention

06 Third-party sharing

We never sell personal data. We share with the following data processors to the extent necessary to deliver the service:

Third-country transfers: Transfers to the USA (Mailgun) rely on the EU Commission's Standard Contractual Clauses (SCCs) under Art. 46 GDPR, supplemented by technical safeguards. We continuously evaluate our providers with the aim of keeping as much data as possible within the EU/EEA.

We may also need to disclose data to a public authority on legal request (e.g. court order).

07 Cookies and local storage

nordleads.se uses no third-party analytics cookies (e.g. Google Analytics) and no marketing tracking.

The only things we store in your browser are:

• nl_popup_dismissed_ts — timestamp of when you last dismissed our popup (used so we don't show it again for a while).
• nl_popup_submitted — flag indicating that you have submitted the form (used so we don't show the popup again).

This is technical local storage (localStorage) and does not require consent under the ePrivacy Directive. You can clear it at any time via your browser settings.

08 Your rights

Under GDPR you have the following rights regarding the processing of your personal data:

• Right of access (Art. 15): obtain a copy of the data we process about you.
• Right to rectification (Art. 16): have inaccurate data corrected.
• Right to erasure / "right to be forgotten" (Art. 17): request that we delete your data.
• Right to restriction (Art. 18): request that we temporarily halt processing while a matter is investigated.
• Right to data portability (Art. 20): receive your data in a machine-readable format and transfer it to another provider.
• Right to object (Art. 21): particularly relevant if you are a recipient of cold emails — an objection stops processing based on legitimate interest.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time (this does not affect the lawfulness of prior processing).

09 How to exercise your rights

Send a request to jesper@nordleads.se including:

• Which right you are invoking
• Your email address (the one we may have contacted you at)
• Company or domain if the request concerns B2B outreach

We respond without undue delay and within 30 days at the latest. If you receive a cold email you can also click the unsubscribe link at the bottom of the message — that counts as a valid objection and stops all further contact from us.

For security reasons we may need to verify your identity before processing the request.

10 Changes to this policy

We reserve the right to update this policy. For material changes we publish a clear notice on nordleads.se and update the date below. Minor adjustments (e.g. clarifications) are published without a separate notice.

11 Complaints

If you believe we process your personal data in violation of GDPR you have the right to lodge a complaint with the supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY):

• Web: imy.se
• Email: imy@imy.se
• Post: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden

If you are based in another EU/EEA country you may also complain to your local data protection authority. A list is available at edpb.europa.eu.

We hope, of course, that you'll contact us first so we get a chance to sort it out.

12 Contact

Questions about this policy or how we handle your data?
Write to jesper@nordleads.se — a human will reply.