Privacy policy

The data controller is NordShifts, run by Girts Liepins, Riga, Latvia ([email protected]). Write to that address for any question or request about your data.

When you send a message we store your name, email address, company (if given), the topic, the message and the language of the page. We use them only to reply to you and to follow up on the request you made. The legal basis is the steps you asked us to take before a possible agreement, and our legitimate interest in answering enquiries (GDPR Article 6(1)(b) and (f)).

To stop spam, a salted one-way hash of your network address is stored with the message, so repeated messages from the same connection can be limited. The address itself is not stored.

Messages are delivered to our inbox by Twilio SendGrid, which processes them on our behalf. Messages are deleted automatically 12 months after they arrive, or earlier if you ask.

The site is served through Cloudflare and hosted on Amazon Web Services in Stockholm, Sweden, with its database in the same region. Like any web server they process your network address and the pages you request, to deliver the site and protect it from attacks. We do not combine this with other data or use it to build profiles.

A functional cookie may remember the language you chose, and your answer to the cookie notice is kept in your browser. Some tools, such as the household planner and the API console, save settings in your own browser; that data never leaves your device. The savings report reads your meter file only to calculate the result and does not store it.

For organisations with an API key we keep the organisation's name, a contact address, a one-way hash of the key and a count of requests per day, to run the service and enforce usage limits. These are kept while the account is active and deleted when it is closed.

Sign-in attempts to the site's administration area are logged with a masked network address (for example 203.0.113.x) to stop password guessing. These entries are deleted after 6 months.

If you choose “Accept” in the cookie notice, we use Google Analytics 4 to count visits and see which pages are used, so we can improve the site. Google then sets cookies (_ga and _ga_…) that expire after 13 months and receives your device and browser details, the pages you view and an approximate location; Google Analytics 4 does not store IP addresses. Google signals and advertising features are switched off. The legal basis is your consent (GDPR Article 6(1)(a)); the statistics are kept for 14 months.

If you choose “Decline”, or make no choice, Google Analytics is not loaded and no statistics cookies are set. You can change your choice at any time with “Cookie settings” at the bottom of every page. Google Ireland Limited processes the data for us under its data processing terms.

For price alerts we keep your email address or Telegram chat number, the bidding zone and settings you chose, and a salted one-way hash of your network address to limit repeated sign-ups. Nothing is sent until you confirm, every message has an unsubscribe link, and the data is deleted 30 days after you unsubscribe (unconfirmed sign-ups after 7 days). The legal basis is your consent.

For a free API key we keep your name or organisation, your email address and what you said you would build; unconfirmed requests are deleted after 7 days. If you were sent a personal data-room link, we log when the room was opened and which documents were downloaded, with a salted hash of the network address and the browser name; the log is kept for 2 years.

SendGrid, Cloudflare, Telegram and Google (Google Analytics, only with your consent) are based or process data outside the European Economic Area. Where data leaves the EEA, it is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

You can ask to see the data held about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Write to [email protected]; we answer within one month.

You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or to the data protection authority in your country.

If this policy changes, the new version is published here with a new date.