Cartesian AS ("Cartesian", "we", "us") takes your privacy seriously. This policy explains what personal data we collect, how we use it, and what your rights are under the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.
1. Who is the controller?
Cartesian AS, registered in Norway, with its principal office in Trondheim, is the data controller for the personal data processed through this website. You can reach our data protection contact at info@cartesian.no.
2. What data we collect
- Information you give us — for example via our contact and partner forms: name, email, phone, company, country and the message you send us.
- Technical data — IP address, browser type, device type and approximate location, collected via cookies and server logs (see our cookie policy).
- Usage data — pages visited, time on page, referrer, click events. Where it requires consent, we only collect this if you have agreed to analytics or marketing cookies.
- HubSpot CRM data — when you submit a form, we send your details to HubSpot to handle your enquiry and our customer relationship.
3. Why we process your data (legal basis)
- Performance of a contract / pre-contract — to respond to your enquiries and handle a partner application (Art. 6(1)(b) GDPR).
- Legitimate interests — to operate, secure and improve our website (Art. 6(1)(f) GDPR).
- Consent — for analytics, marketing and personalisation cookies, and for marketing emails (Art. 6(1)(a) GDPR). You can withdraw consent at any time.
- Legal obligations — to keep records required by Norwegian and EU law (Art. 6(1)(c) GDPR).
4. Who we share your data with
We only share personal data with vetted processors that operate under data-processing agreements compatible with the GDPR. The main processors we currently use are:
- Vercel — website hosting (EU + global edge)
- Supabase — application database (EU region)
- HubSpot — CRM and marketing automation
- Google — Tag Manager and Analytics (only when you give consent)
- Sanity — content management for marketing pages
Some of these providers may transfer data outside the EU/EEA. Where they do, we rely on European Commission Standard Contractual Clauses and supplementary measures to ensure an adequate level of protection.
5. How long we keep your data
- Form submissions: up to 24 months after the last contact, unless we are in an active commercial relationship.
- CRM records: for as long as we maintain a customer or partner relationship, plus statutory retention periods.
- Server / cookie logs: maximum 14 months.
6. Your rights
Under the GDPR you have the right to access, rectify, delete, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. To exercise any of these rights, email us at info@cartesian.no. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
7. Cookies and tracking
We use cookies and similar technologies as described in our cookie policy. We respect your consent choices and use Google Consent Mode v2 so that no marketing or analytics tags fire until you have given permission.
8. Security
All site traffic is encrypted in transit using TLS. Access to personal data is restricted to authorised personnel and processors, and protected by least-privilege access controls and audit logging.
9. Changes to this policy
We will publish any updates on this page and, where the change is material, notify you via email or banner. The date at the top of this page reflects the latest revision.