Privacy Policy
Last updated: 24 September 2026
1. Who we are
Nordkey AB, Swedish company registration number 559418-0498, VAT number SE559418049801 ("Nordkey", "we", "us"), operates the online store at https://nordkey.io (the "Website"), the customer account connected to it and the customer support you reach from it.
Nordkey is the controller of the personal data described in this policy. You can reach us at:
- Data protection matters: privacy@nordkey.io
- Customer support: support@nordkey.io
- Postal address: Nordkey AB, Kivra: 559418-0498, 106 31 Stockholm, Sweden
We operate online stores in several countries and languages. This policy applies to all of them. If the law where you live gives you additional rights, section 13 explains them.
2. What this policy covers
This policy explains how we process personal data about:
- visitors to the Website;
- customers who buy from us, whether as consumers or on behalf of a business;
- holders of a customer account;
- people who contact our support or activation help;
- contact persons at our suppliers and business partners.
It does not cover websites we link to, or the software publishers whose products you buy from us. When you install or activate software, you interact directly with the publisher's own services under the publisher's own privacy policy.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact details | Name, email address, telephone number, billing address, country. For business customers: company name, VAT number and contact person. | You |
| Account details | Login email, hashed password, security settings, language and other preferences, login history. | You, and generated when you use the account |
| Order and licence details | Order number, products bought, licence keys delivered to you, order status, invoices, credit notes and refunds. | You, and generated by us when we process the order |
| Payment details | Payment method type, card brand, last four digits and expiry, payment status, amount and currency, payment reference, and the result of fraud screening. Full card numbers never reach us. They are processed by our payment provider, Stripe. | You via Stripe, and Stripe |
| Activation and technical support data | Installation IDs, confirmation IDs, error messages, screenshots and descriptions you send us, the software version and device details you describe. | You |
| Remote Assistance data | Booked time, the name and operating system of the computer, session start and end time, the chat with the technician, and what is shown on your screen while the technician works. Sessions are not recorded. | You, and generated during the session |
| Support and communication | Messages you send by chat, email or contact form, the replies you receive, when the conversation took place, and any rating you give. | You, and generated during the conversation |
| Technical data | IP address, approximate location derived from the IP address, device type, browser, operating system, referring page, pages visited, time stamps, and your consent choices for cookies. | Collected automatically when you use the Website |
| Marketing data | Whether you have subscribed to or opted out of marketing, and how you interact with marketing emails we send. | You, and generated when you interact with our emails |
| Tax and compliance data | Evidence of your location for VAT purposes, such as billing country, IP country and payment country. | You, Stripe, and collected automatically |
You are not obliged to give us personal data, but without the details marked as required at checkout we cannot complete your order or deliver a licence.
4. Why we use your personal data and on what legal basis
The legal bases below are those that apply under the EU General Data Protection Regulation (GDPR) and equivalent laws. Where your local law uses a different framework, we process your data for the same purposes and, where required, with your consent.
| Purpose | Data used | Legal basis |
|---|---|---|
| Process your order and deliver licence keys | Identity and contact, order and licence, payment | Performance of a contract |
| Create and run your customer account | Identity and contact, account, order and licence | Performance of a contract |
| Take payment, issue refunds and handle chargebacks | Identity and contact, order and licence, payment | Performance of a contract; legal obligation |
| Prevent fraud, abuse and security incidents | Identity and contact, payment, technical | Legitimate interest in protecting our business and customers; legal obligation |
| Provide customer support and activation help | Identity and contact, order and licence, activation and support data | Performance of a contract; legitimate interest in resolving your request |
| Perform the Remote Assistance service, including booking and the remote session | Identity and contact, order and licence, Remote Assistance data | Performance of a contract |
| Use AI tools to assist our support staff (see section 5) | Support and communication, order and licence, identity and contact | Legitimate interest in giving faster and more accurate support |
| Keep accounts, report tax and comply with VAT rules | Identity and contact, order and licence, payment, tax and compliance | Legal obligation (the Swedish Bookkeeping Act, the Swedish VAT Act and EU VAT rules) |
| Send service messages such as order confirmations, delivery emails, invoices and security notices | Identity and contact, order and licence | Performance of a contract; legal obligation |
| Send marketing about our products and offers | Identity and contact, marketing | Consent, or legitimate interest in marketing to existing customers where the law allows it. You can opt out at any time. |
| Measure how the Website is used and improve it | Technical | Legitimate interest in understanding and improving our service. Where cookies or similar technologies that require consent are used, consent. |
| Establish, exercise or defend legal claims, and respond to lawful requests from authorities | Any category, as relevant | Legitimate interest; legal obligation |
| Carry out a merger, acquisition or sale of assets | Any category, as relevant | Legitimate interest |
Where we rely on legitimate interest, we have assessed that our interest is not overridden by your interests or rights. You can ask for a summary of that assessment through privacy@nordkey.io.
5. Automated processing and artificial intelligence
We use AI services provided by Anthropic (Claude) to help our staff work more efficiently. The AI may be used to summarise support conversations, suggest draft replies, classify cases, translate text and check order and licence information relevant to a case. To do this, we may send your support messages, order details, licence details, name and email address to Anthropic's service.
Under our agreement with Anthropic, your data is used only to provide the service to us. It is not used to train AI models, and it is not kept longer than needed to deliver the service.
AI output is used to support our staff. Replies to you that are prepared with AI assistance are reviewed by a member of our team before they are sent. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
Our payment provider, Stripe, uses automated fraud screening when you pay. If a payment is declined, you can contact support@nordkey.io and a member of our team will review the case.
If you do not want your support requests to be processed with AI assistance, tell us at privacy@nordkey.io and we will handle your requests manually.
6. Cookies and similar technologies
We use cookies and similar technologies on the Website. Our Cookie Policy explains which ones, why, and how long they last.
- We ask for your consent through a consent banner before setting cookies that are not strictly necessary. You can change or withdraw your consent at any time through the cookie settings link on the Website.
- Our main web analytics tool, Fathom Analytics, works without cookies and does not build profiles of individual visitors.
- We use Google Tag Manager, delivered through a server-side tagging service (Stape), to load measurement and marketing tags in line with your consent choices. If you accept marketing and statistics cookies, these tags send information about your visit and purchases to Google Analytics 4, Google Ads, Meta (Facebook and Instagram) and Microsoft Advertising, so that we can measure our advertising and show you relevant ads on those platforms. If you decline, the tags are not loaded.
- We honour the Global Privacy Control (GPC) signal from your browser where the law requires it.
7. Who we share your personal data with
We do not sell your personal data. We share it only with the recipients below and only to the extent necessary.
7.1 Service providers acting on our behalf
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe Inc, USA) | Payment processing, refunds and fraud screening. Stripe is an independent controller for parts of its processing, such as fraud prevention and regulatory compliance, as described in Stripe's privacy policy. | EU and USA |
| Intercom (Intercom R&D Unlimited Company, Ireland, and Intercom Inc, USA) | Support chat, help centre, support inbox and customer messaging | EU and USA |
| Postmark (ActiveCampaign LLC, USA) | Delivery of transactional emails such as order confirmations and licence deliveries | USA |
| Anthropic PBC (USA) | AI assistance for our support staff, as described in section 5 | USA |
| Zoho Assist (Zoho Corporation B.V., Netherlands, and Zoho Corporation Pvt. Ltd., India) | Encrypted remote sessions and booking for the Remote Assistance service. Session data is hosted in the EU. | EU |
| Slack (Slack Technologies Ltd, Ireland, part of Salesforce) | Internal notifications to our team about new orders and support cases | EU and USA |
| Fathom Analytics (Conva Ventures Inc, Canada) | Cookieless web analytics, hosted in the EU | EU |
| Stape (Stape Inc) | Hosting of our server-side Google Tag Manager container | EU |
| Google (Google Ireland Ltd) | Google Tag Manager and Google Fonts. When fonts are loaded from Google's servers, your IP address is transmitted to Google. | EU and USA |
| Cookiebot (Usercentrics A/S, Denmark) | Consent banner and storage of your consent choices | EU |
| DigitalOcean LLC (USA) | Cloud storage of documents such as invoices, in a data centre in Amsterdam | EU |
| Laravel Forge (Laravel LLC, USA) | Management of the servers that run our services | EU (servers), USA (management tooling) |
| Flare (Spatie BV, Belgium) | Error monitoring. Error reports can contain your IP address, the page requested and your account identifier. | EU |
| Our hosting provider | Running the Website, the customer portal and our databases | EU |
These providers process personal data under contracts that require them to protect it and to use it only on our instructions, except where they act as independent controllers as noted above.
7.2 Advertising and measurement partners
If you consent to statistics and marketing cookies, we share information about your visit with the partners below. This can include a pseudonymous identifier, IP address, pages visited, products viewed and bought, order value, and a hashed version of your email address for matching purchases to ad clicks. Each partner also uses this data for its own purposes under its own privacy policy, and you can manage your ad settings directly with each of them.
| Partner | What it is used for | Role |
|---|---|---|
| Google Analytics 4 and Google Ads (Google Ireland Ltd, Ireland, and Google LLC, USA) | Website statistics, measurement of ad campaigns, and remarketing | Google acts as our processor for Analytics and as an independent controller for Ads |
| Meta Pixel and Conversions API (Meta Platforms Ireland Ltd, Ireland, and Meta Platforms Inc, USA) | Measurement of ads on Facebook and Instagram, and remarketing | Meta and Nordkey are joint controllers for the collection and transmission of event data. Meta is the sole controller for its subsequent processing. The joint controller arrangement is available from Meta |
| Microsoft Advertising (Microsoft Ireland Operations Ltd, Ireland, and Microsoft Corporation, USA) | Measurement of ads on Bing and the Microsoft network, and remarketing | Independent controller |
You can withdraw your consent at any time through the cookie settings on the Website. This stops further sharing but does not delete data already held by the partners. To exercise your rights against those partners, contact them directly.
7.3 Other recipients
- Software publishers and licence suppliers. Where a licence needs to be verified or replaced, we may share the licence key and order reference with the publisher or the supplier from whom we bought it. We do not share your name or contact details unless it is necessary to resolve your case.
- Banks, card networks and payment institutions, to complete payments, refunds and disputes.
- Professional advisers, such as accountants, auditors, lawyers and insurers, under duties of confidentiality.
- Public authorities, such as tax authorities, courts, police and data protection authorities, where we are legally required to or where necessary to protect our rights.
- A buyer or successor, if we sell or restructure our business. We will tell you before your data becomes subject to a different privacy policy.
8. International transfers
We are based in Sweden and store your data primarily in the European Union. Some of our service providers process data outside the European Economic Area (EEA), in particular in the United States.
When we transfer personal data outside the EEA, the United Kingdom or Switzerland, we rely on one of the following:
- a decision by the European Commission, the UK Government or the Swiss Federal Council that the destination country provides adequate protection;
- the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, where the recipient is certified;
- the European Commission's Standard Contractual Clauses, supplemented where needed by the UK International Data Transfer Addendum or adjustments recognised by the Swiss Federal Data Protection and Information Commissioner, together with additional safeguards where our assessment shows they are needed.
You can request a copy of the relevant safeguards at privacy@nordkey.io.
9. How long we keep your personal data
We keep personal data for as long as we need it for the purposes in section 4, and afterwards for as long as the law requires or allows us to keep it in order to meet legal obligations and to establish, exercise or defend legal claims. The general limitation period for claims under Swedish law is 10 years, and several of the periods below follow from it.
| Data | Retention period |
|---|---|
| Orders, invoices, credit notes, payment records and VAT location evidence | 10 years after the end of the year in which the order was placed. This covers the 7 years required by the Swedish Bookkeeping Act, the 10 years required by EU VAT rules for the One Stop Shop, and the 10-year limitation period for claims |
| Licence keys and licence records | For as long as the licence may need to be verified, re-delivered or supported, and in any case 10 years after the end of the year of purchase. Many licences we sell are perpetual, and customers may need to retrieve them again years after purchase |
| Customer account | For as long as your account exists. If you ask us to delete it, we delete or anonymise the data we are not required to keep for the periods above. Accounts that have not been used for 10 years are deleted or anonymised |
| Support conversations, activation support data (including installation IDs) and Remote Assistance session data | 10 years after the conversation or session is closed, so that we can handle later questions about the same licence and defend against claims within the limitation period |
| Security and access logs | 24 months |
| Error reports | 12 months |
| Consent records | For as long as the processing based on the consent continues, and 10 years after the consent is withdrawn or expires, so that we can demonstrate that consent was given |
| Marketing data | Until you unsubscribe or your account is deleted. We then keep your email address on a suppression list for as long as needed to make sure we do not contact you again |
| Data needed for legal claims, disputes or investigations | For the duration of the matter and the applicable limitation period, normally 10 years under Swedish law, or longer where proceedings are ongoing or the law requires it |
Where a longer period is required by the law of the country you bought from, we keep the data for that longer period. When a retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.
10. How we protect your personal data
We use technical and organisational measures appropriate to the risk, including:
- encryption of data in transit (TLS) and encryption of licence keys and other sensitive fields at rest;
- passwords stored as salted hashes, and mandatory two-factor authentication for our staff;
- access controls so that staff only see the data they need for their work;
- logging of access to customer accounts. Our support staff can view your account as you see it in order to help you. Each such access is logged;
- regular updates, monitoring and backups of our systems.
If a personal data breach is likely to result in a high risk to you, we will inform you and the competent authority as the law requires.
11. Your rights
Depending on where you live, you have some or all of the following rights:
- Access. Receive a copy of the personal data we hold about you and information about how we use it.
- Rectification. Have inaccurate or incomplete data corrected.
- Erasure. Have your data deleted, unless we must keep it, for example for accounting purposes.
- Restriction. Ask us to limit how we use your data in certain situations.
- Portability. Receive the data you have given us in a structured, machine-readable format, and have it transferred to another provider where technically feasible.
- Objection. Object to processing based on legitimate interest, and object at any time to direct marketing.
- Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing that took place before you withdrew it.
- Automated decisions. Not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.
- Complain. Lodge a complaint with a data protection authority (see section 13).
You can exercise your rights by emailing privacy@nordkey.io. You can update your contact details and preferences in your customer account, and unsubscribe from marketing through the link in every marketing email.
We may need to verify your identity before acting on a request, for example by asking you to confirm from the email address linked to your account. We respond within one month. If your request is complex, we may extend this by up to two months and will tell you why. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
You may use an authorised agent to make a request on your behalf. We will ask for proof that the agent is authorised.
12. Marketing
We send marketing emails only if you have consented, or if you are an existing customer and the law allows us to send you offers for similar products without prior consent. Every marketing email contains an unsubscribe link. You can also opt out at any time by emailing privacy@nordkey.io.
Service messages, such as order confirmations, licence deliveries, invoices and important notices about your account, are not marketing and are sent regardless of your marketing preferences.
13. Information for specific regions
13.1 European Economic Area
Nordkey AB is established in Sweden. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se. You can also complain to the data protection authority in the EU or EEA country where you live or work.
13.2 United Kingdom
We process personal data of UK residents under the UK GDPR and the Data Protection Act 2018. You have the rights described in section 11 and may complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk. Transfers from the UK are made under the UK Extension to the EU-U.S. Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
13.3 Switzerland
We process personal data of people in Switzerland under the Swiss Federal Act on Data Protection (FADP). You have the rights described in section 11 and may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.
13.4 United States
This section applies to residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia.
Categories of personal information we collect. In the 12 months before the date of this policy we collected the following categories, as described in section 3: identifiers (such as name, email address, IP address and account identifiers); customer records (such as billing address and payment card details held by Stripe); commercial information (such as purchase history and licence keys); internet or network activity (such as pages visited and device information); approximate geolocation derived from IP address; and the contents of your communications with us. The only sensitive personal information we collect is your account login credentials, which we use solely to operate your account.
Sources, purposes and disclosures. We collect this information from you, from your device and from our payment provider, for the purposes in section 4. We disclose it to the service providers and other recipients in section 7 for business purposes.
Sale and sharing. We do not sell personal information for money. If you accept marketing cookies, we disclose identifiers, internet activity and commercial information to Google, Meta and Microsoft for cross-context behavioural advertising, which state laws treat as "sharing" or "targeted advertising". You can opt out through the "Do Not Sell or Share My Personal Information" link in the Website footer, through the cookie settings, or by enabling the Global Privacy Control signal in your browser. We do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes other than those permitted by law, and we do not offer financial incentives in exchange for personal information.
Your rights. You have the right to know what personal information we collect, use and disclose; to access it in a portable format; to correct it; to delete it; to opt out of sale, sharing, targeted advertising and profiling in furtherance of significant decisions; to limit the use of sensitive personal information; and not to be discriminated against for exercising your rights. To exercise them, email privacy@nordkey.io or use the links on the Website. We will verify your request by matching the information you provide with the information we hold and, where you have an account, by asking you to confirm through that account. We respond within 45 days and may extend by a further 45 days where reasonably necessary. If we deny your request, you may appeal by replying to our decision or emailing privacy@nordkey.io with "Appeal" in the subject line. If your appeal is denied, you may contact your state attorney general.
Authorised agents. You may designate an authorised agent to make a request on your behalf. We will ask for written authorisation signed by you and may verify your identity directly with you.
Shine the Light. California residents may request, once per year, information about personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing.
Retention. We keep each category of personal information for the periods in section 9.
13.5 Canada
We process personal data of people in Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector. We rely on your consent, which may be implied where the purpose is obvious, such as processing your order. You may withdraw consent, subject to legal and contractual restrictions, and you may access and correct your personal information by contacting privacy@nordkey.io. Your data is processed outside Canada, in the EU and the United States, and may be accessible to authorities there under local law. The person in charge of the protection of personal information at Nordkey can be reached at privacy@nordkey.io. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
13.6 Australia
We process personal information of people in Australia in accordance with the Privacy Act 1988 and the Australian Privacy Principles. We disclose personal information to recipients in the EU and the United States as set out in section 7. You may access and correct your personal information and complain about our handling of it by contacting privacy@nordkey.io. We will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au. We do not use your personal information for direct marketing without giving you a simple way to opt out.
13.7 Brazil
We process personal data of people in Brazil under the Lei Geral de Proteção de Dados (LGPD). In addition to the rights in section 11, you may request confirmation that we process your data, anonymisation or blocking of unnecessary or excessive data, information about the public and private entities with which we have shared your data, and information about the consequences of refusing consent. Our data protection officer (encarregado) can be reached at privacy@nordkey.io. International transfers are made on the basis of standard contractual clauses recognised by the Autoridade Nacional de Proteção de Dados (ANPD) or your consent. You may complain to the ANPD.
13.8 Other countries
If you live in a country not listed above, including Japan, South Korea, Singapore, India, South Africa or New Zealand, we apply the standards in this policy to your data. Where local law requires your consent for cross-border transfer or other processing, we obtain it when you place your order or create an account. You can exercise the rights available to you under local law by contacting privacy@nordkey.io.
14. Children
The Website is not directed at children. We do not knowingly collect personal data from anyone under 16, or under the age at which a person can consent to online services in their country. If you believe a child has given us personal data, contact privacy@nordkey.io and we will delete it.
15. Links and third-party services
The Website contains links to other websites, and the software you buy is activated through the publisher's own services. We are not responsible for how those sites and services handle your data. Read their privacy policies before you use them.
16. Changes to this policy
We update this policy when our processing or the law changes. The date at the top shows when it was last updated. If a change materially affects you, we will tell you by email or by a notice on the Website before it takes effect.
17. Contact us
- Data protection questions and requests: privacy@nordkey.io
- Customer support: support@nordkey.io
- Post: Nordkey AB, Kivra: 559418-0498, 106 31 Stockholm, Sweden