Privacy Policy

NetKey ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use NetKey ("the Service") in compliance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

1. Contact Information

For questions about this privacy policy or your personal data, please contact us at:

Email: contact@netkey.no

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

Data Type	Purpose	Legal Basis
Email address	Account identification, communication	Contract performance
Full name	Account personalization	Contract performance
Company name	Organization management	Contract performance
Job title	Role identification	Legitimate interest
Password (hashed)	Authentication	Contract performance

2.2 Technical Data

Data Type	Purpose	Legal Basis
IP addresses	Security, access control	Legitimate interest
MAC addresses	Device authentication	Contract performance
Device identifiers	Endpoint management	Contract performance
Browser/device info	Service optimization	Legitimate interest

2.3 Usage Data

Data Type	Purpose	Legal Basis
Authentication logs	Security monitoring, troubleshooting	Legitimate interest
Audit logs	Compliance, security	Legal obligation
Session data	Service provision	Contract performance

3. How We Use Your Data

We process your personal data for the following purposes:

• Service Provision: To provide, maintain, and improve the NetKey platform
• Authentication: To authenticate users and devices on your network
• Security: To protect against unauthorized access and security threats
• Communication: To send service-related notifications and updates
• Support: To provide customer support and respond to inquiries
• Analytics: To analyze usage patterns and improve our services
• Legal Compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service
• Legitimate Interest (Art. 6(1)(f)): Processing for security, analytics, and service improvement
• Legal Obligation (Art. 6(1)(c)): Processing required by law
• Consent (Art. 6(1)(a)): Where you have given explicit consent

5. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account data: Retained while your account is active and for 30 days after deletion request
• Authentication logs: Retained for 90 days
• Audit logs: Retained for 2 years for compliance purposes
• Backup data: Retained for 30 days in encrypted backups

6. Data Sharing and Transfers

6.1 Third-Party Service Providers

We may share data with trusted service providers who assist in operating the Service:

• Cloud infrastructure providers (data centers within EU/EEA)
• Email service providers for transactional emails
• Security and monitoring tools

All service providers are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance.

6.2 International Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If data is transferred outside the EEA, we ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Other lawful transfer mechanisms under GDPR

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at contact@netkey.no. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Employee security training and confidentiality agreements
• Incident response procedures
• Regular backups with encrypted storage

9. Cookies and Tracking

We use essential cookies for the functioning of the Service:

• Session cookies: To maintain your login session
• Security cookies: To prevent cross-site request forgery

We do not use third-party tracking or advertising cookies.

10. Children's Privacy

NetKey is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data immediately.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours
• Notify affected individuals without undue delay if the breach poses a high risk
• Document the breach and remediation measures taken

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Email notification to your registered email address
• Prominent notice within the Service

Changes take effect 30 days after notification unless otherwise stated.

13. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. In Norway, this is:

Datatilsynet (Norwegian Data Protection Authority)
Postboks 458 Sentrum
0105 Oslo, Norway
Website: www.datatilsynet.no
Email: postkasse@datatilsynet.no

14. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights, please contact us at:

Email: contact@netkey.no