Privacy Policy

Nexus Connect AS is the controller for personal data processed via the Portal in connection with account administration and communication. Where Nexus processes personal data (e.g. shareholder registers) on behalf of the Company, Nexus acts as a processor and the Company is the controller. Such processing is governed by a separate data processing agreement (DPA).

• Performance of a contract (Art. 6(1)(b)): processing necessary to deliver the Portal under our Terms of Use
• Legitimate interest (Art. 6(1)(f)): security monitoring and fraud prevention
• Legal obligation (Art. 6(1)(c)): processing required by Norwegian or EU law (e.g. bookkeeping and anti-money laundering rules)
• Consent (Art. 6(1)(a)): marketing communications, and product analytics including session recordings — you may withdraw consent at any time

We do not sell your personal data. We share data only in the following cases:

We aim to process personal data within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g. to US sub-processors), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) adopted by the European Commission or based on an adequacy decision.

We retain personal data only as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Contact details and identity data: for as long as you are an active Portal user plus 3 years after deactivation
• Portfolio data: controlled by the Company as controller
• Log and usage data, including product analytics and session recordings: at most 12 months rolling
• Consent records: until consent is withdrawn plus 2 years

Nexus implements appropriate technical and organisational measures to protect personal data, including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access control and the principle of least privilege
• Multi-factor authentication for internal systems
• Regular penetration tests and security reviews
• Incident response and notification to the supervisory authority within 72 hours of a breach (GDPR Art. 33)

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data where there is no overriding legal basis
• Right to restriction (Art. 18): request that we restrict processing in certain cases
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest, including direct marketing
• Right to withdraw consent: withdraw consent at any time where processing is consent-based

To exercise any of these rights, contact us at hei@nexuscap.no. We will respond within 30 days. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

The Portal is not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a person under 18 has provided us with personal data, we will take steps to delete it promptly.

We may update this privacy policy from time to time. We will notify you of material changes by email or by displaying a prominent notice in the Portal at least 14 days before the changes take effect. The date at the top of this policy indicates when it was last revised.

For privacy-related questions, requests, or to obtain a copy of our DPA, contact us: