Privacy Policy

Data controller

NanoSwim AS is the data controller for the personal data described on this page. That means we decide why the data is collected and how it is used, and we are the company you hold responsible for it.

• Company: NanoSwim AS
• Address: Langenesvegen 34, 5258 Blomsterdalen, Bergen, Norway
• Contact: use the form on our contact page, or write to behnood@nanoswim.no

If you want to ask about anything on this page, or exercise any of the rights described below, Contact us and say what you are asking for. You do not need to give a reason.

What we collect

Visit statistics

We run our own analytics on our own server. There is no Google Analytics on this site, no advertising pixel and no third-party tracking script — nobody is building a profile of you across other websites from anything we install.

When you open a page, the server writes one line to a visit log. That line contains:

• the page you opened and the full address of the request;
• the referring address, if you arrived from a link or a search result, and the site or search engine it came from;
• campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_term), when a link carries them;
• your IP address, together with a short one-way hash of it that we use to count repeat visits;
• your browser, operating system and device type (desktop, mobile, tablet or bot), derived from the user-agent string your browser sends, and the user-agent string itself;
• a country, region and city derived from the IP address, plus the name of your internet provider;
• the date and time.

We do not ask for your name here and, in most cases, we cannot work out who you are from this log. It is still personal data, because an IP address can identify a person, which is why it is described here in full.

Location from your IP address

To turn an IP address into a country, region and city, the server asks an external lookup service. This is the only point at which a visitor IP address leaves our own infrastructure. The services we use, tried in that order until one answers, are ip-api.com, ipwho.is, db-ip.com and geojs.io. They receive your IP address and return a location. They are independent companies operating their own infrastructure, which may be outside the EEA, and we have no control over what they log at their end.

Three things reduce how often this happens. Addresses on private or reserved ranges are never sent anywhere. If our hosting or CDN already tells us the country, we use that and make no external call. And a result, once looked up, is cached on our own server so the same address is not sent again.

• The location cache stores the IP address and the location returned against it for 30 days, after which the entry expires and is re-checked or dropped. The cache holds at most 3 000 addresses; the oldest are evicted first.
• The visit log keeps the most recent 5 000 visits. Once it passes that, the oldest lines are deleted automatically as new ones arrive.
• The lookup never happens while you wait. It runs after the page has already been sent to your browser.

Forms you fill in

Three forms on this site send data to us: the contact form, the "book a demo" form, and the product enquiry form on the product pages. What each one collects is exactly what you can see on it:

• Contact form: name, email address, phone number if you give one, the subject you pick, your message, and the language version you were reading.
• Book a demo: first name, last name, work email address, company, job title, and an optional message. This form asks for an organisational email address and will not accept common free webmail domains.
• Product enquiry: name, work email address, company if you give one, the product you were looking at, and your message.
• With every submission we also store the IP address it came from, the user-agent string, and the time — so that we can deal with spam and abusive submissions.

Submissions are saved on our server and a copy is emailed to our own staff so somebody actually reads it. They stay in the inbox until an administrator deletes them, and the store holds at most the 5 000 most recent submissions. If you want your enquiry deleted after we have answered it, ask us and we will remove it.

Requests your browser makes to other companies

The site loads its typefaces from Google Fonts. That means your browser fetches files from fonts.googleapis.com and fonts.gstatic.com, and Google receives your IP address and user-agent as part of that request. Google Fonts does not set a cookie, and we receive nothing back from it, but we mention it because it is a request to a third party that happens on every page.

Legal basis

Every kind of data processing described above needs a legal basis under Article 6 of the GDPR. Ours are:

• Legitimate interest (Art. 6(1)(f)) for the visit statistics and the location lookup. Our interest is understanding which pages are read and where our readers are, so we can run and improve a small company website. The data is not used to target advertising, and it is deleted on a short cycle.
• Legitimate interest (Art. 6(1)(f)) for security: storing the IP address and user-agent with form submissions, blocking automated spam, and protecting the site against abuse.
• Contract or steps before a contract (Art. 6(1)(b)) when you send an enquiry, book a demo or ask about a product. We need your details to answer you and to prepare a quotation.
• Consent (Art. 6(1)(a)) where consent is what applies — for anything you actively opt into, and for cookies that are not strictly necessary. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) where Norwegian accounting or contract law requires us to keep documents relating to a delivery.

Where we rely on legitimate interest, you have the right to object. See "Your rights" below.

Cookies

This site uses very few cookies, and none of them is an advertising or cross-site tracking cookie.

• NSSESS — the session cookie. It holds nothing but a random session identifier, and it is what makes the security token on our forms work. Set to expire after seven days, marked HttpOnly and SameSite=Lax, and sent only over HTTPS. Strictly necessary.
• ns_lang — remembers whether you are reading the English or the Norwegian version, so we do not send you to the wrong language on your next visit. Expires after one year. Strictly necessary for the site to work the way you asked it to.
• ns_cookie_ok — set only when you click "Accept" on the cookie notice, so the notice is not shown again. Expires after one year. It is a record of your choice.

Storage in your browser

Two values are also written to your browser's local storage. They stay on your device and are never sent to our server:

• ns_cookie_ok — the same record of the cookie notice being acknowledged.
• ns_pwa_dismissed — set if you dismiss the prompt offering to install this site as an app, so you are not asked again.

You can delete cookies and local storage at any time in your browser settings, and block them entirely. If you block the session cookie, the forms on this site will stop working, because the security token they depend on cannot be issued.

Who else sees the data

We do not sell personal data, we do not trade it, and we do not hand it to anyone for advertising purposes. The data described here is seen by:

• our own staff, who read enquiries and the visit statistics;
• our hosting provider, which operates the servers the site and its files run on. The site is hosted on servers in Norway and within the EEA;
• our email provider, which carries the notification message when a form is submitted;
• the IP geolocation services named above, which receive an IP address and nothing else.

If a supplier ever needs access beyond that — for example during technical support — it happens under a data processing agreement and only for as long as the work takes.

Your rights

Under the GDPR you have the following rights over data we hold about you. All of them are free to use, and we will answer without undue delay and in any case within one month.

• Access — ask what we hold about you and get a copy of it.
• Rectification — have anything wrong corrected.
• Erasure — have data deleted, where we have no continuing reason to keep it.
• Restriction — have us stop using data while a question about it is being sorted out.
• Portability — receive data you gave us in a machine-readable format, or have it sent to someone else.
• Objection — object to processing we base on legitimate interest, including the visit statistics.
• Withdraw consent — at any time, where consent is the basis. Withdrawing it does not undo processing that was lawful before you withdrew.

One honest limitation: the visit log holds no name or account, so if you want a specific visit erased we will need something to find it by — typically the IP address you were using and roughly when you visited. Without that we cannot single out your entries, and after 30 days the location cache will have expired them anyway.

Contact and complaints

Questions about privacy at NanoSwim AS, or a request to use one of the rights above, go to the same place: Contact us, or write to behnood@nanoswim.no. Say what you want and we will come back to you.

If you are not satisfied with how we have handled it, you can complain to the Norwegian Data Protection Authority, Datatilsynet. You can complain to them directly without contacting us first, though it is usually faster to ask us.

The terms governing use of this website are on a separate page: Terms of Use.

Last updated: on publication