Privacy policy

Last updated: 9 September 2026

At Nordisk Perlite, we process personal data when you visit our website, contact us, or enter into a customer, supplier or business relationship with us. This Privacy Policy explains what personal data we process, why we process it, who may receive it, how long we retain it, and what rights you have.

Information about cookies and similar technologies used on this website, including their purposes, providers and lifetimes, is available in our Cookie Declaration. You can also change or withdraw your consent choices there.

1. Data controller and contact details

The data controller is:

Nordisk Perlite ApS
Danish Company Registration (CVR) no.: 48247717
Hammersholt Erhvervspark 1-5
DK-3400 Hillerød
Denmark

Email: nordisk@perlite.dk
Telephone: +45 48 14 07 22

You are welcome to contact us if you have questions about our processing of personal data or if you wish to exercise any of your data protection rights.

2. What personal data do we process, and where does it come from?

We process the information you provide to us when you contact us, request a quotation, purchase products, or otherwise work with us. This may include your name, email address, telephone number, job title, company name and the content of our correspondence.

In connection with purchases and business relationships, we may also process information relating to agreements, orders, delivery and billing addresses, payments and complaints, to the extent that such information relates to an identified or identifiable individual.

The information primarily comes from you. We may also receive relevant business contact information from your employer or a colleague where this is relevant to our relationship with the organisation you represent.

When you visit our website, technical information and, depending on your consent choices, information about your use of the website may be processed. When Lead Forensics is used, we may also receive company-level information from the service. The individual processing activities are described below.

Please do not send national identification numbers, health information or other sensitive or unnecessary personal data in ordinary enquiries to us.

3. Purposes and legal bases for processing

Website operation, hosting and security

The website is hosted by ezyWeb ApS. In order to deliver the website to your device and maintain stable and secure operation, technical information may be processed when you access the website. This may include your IP address, access time, requested page, browser and device information.

The purpose is to display the website, handle technical requests, investigate errors and protect the website against misuse and unauthorised access. The fact that retained logs are anonymised does not change the fact that, for example, an IP address may be processed as part of the technical connection before anonymisation.

The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest is to operate and protect a secure and functional website. This legal basis does not, by itself, cover website analytics or sales analytics.

Enquiries, advice and quotations

When you contact us, we process your contact details and the information contained in your enquiry in order to respond to you, provide product and technical guidance, prepare quotations and carry out relevant follow-up.

If you personally are to become a party to an agreement with us, the legal basis for processing data necessary to take steps at your request before entering into the agreement is Article 6(1)(b) GDPR.

For other enquiries, including where you represent a company, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to respond to relevant enquiries and maintain professional and commercial dialogue with customers, prospective customers and business partners.

Customers, suppliers and business partners

We process relevant contact, contractual, order and delivery information in order to manage business relationships, fulfil deliveries and handle questions, complaints and other matters relating to the relationship.

Where you personally are a party to the agreement, the legal basis is Article 6(1)(b) GDPR. Where you are a contact person for a company or organisation, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to establish, manage and fulfil the business relationship with the organisation you represent.

Invoicing and accounting

We process the personal data necessary for invoices, payment records and other accounting material in order to comply with our legal accounting obligations. The legal basis is Article 6(1)(c) GDPR in conjunction with applicable Danish accounting legislation.

Further information about Danish bookkeeping requirements is available from the Danish Business Authority.

Website analytics with Google Analytics 4

We use Google Analytics 4 (GA4), provided by Google Ireland Limited, Ireland, to understand how our website is used and to improve its content and functionality.

When you consent to analytics, information may be processed about pages viewed, interactions, visit times, traffic sources, browser, device and approximate geographical location. Technical identifiers may also be processed in order to distinguish browsers or devices and associate activity across visits.

Google states that IP addresses from visitors in the EU are used for geolocation and are then discarded before being logged or stored in Analytics. This does not necessarily mean that all other GA4 user-level or event-level data is anonymous.

The legal basis for our use of GA4 is your consent under Article 6(1)(a) GDPR. GA4 is not loaded and does not send measurement data until you have given the relevant consent. You can change or withdraw your consent in our Cookie Declaration.

Google processes Analytics data on our behalf in accordance with its applicable data processing terms. You can read more in Google’s information about EU-focused data and privacy, Google Ads Data Processing Terms and Google’s information about how it uses information from sites or apps that use its services.

Google Search Console and search engine optimisation

We use Google Search Console to monitor the visibility of our website in Google Search and to identify technical issues. We receive reports concerning, for example, search queries, impressions, clicks and search positions. These reports do not identify the individual person who performed a particular search.

Search Console does not, by itself, require us to place a separate visitor tracking script in your browser. Any GA4 measurement is covered by the separate section above. You can read more in Google’s documentation about Search Console performance reports.

We also use Yoast SEO to optimise the content and technical structure of the website for search engines. We do not use Yoast SEO as a separate website visitor analytics tool. You can read more in Yoast’s information about GDPR and privacy.

Company identification and sales analytics with Lead Forensics

We use Lead Forensics to obtain insight into which companies visit our website and which products or solutions may be of interest to them. The purpose is to understand business interest and help us prioritise our sales and marketing activities.

The service processes IP addresses and technical visit information and compares this information with a business database. The resulting information may include company name, industry, pages viewed, visit times, duration, traffic source and repeat visits.

Company identification does not, by itself, tell us which employee of a company visited the website. However, the processing of IP addresses and other visit information may constitute processing of personal data even if the result is presented to us at company level.

Lead Forensics processes relevant information on our behalf as a data processor. The legal basis for our use of the service for visitor identification and sales analytics is your consent under Article 6(1)(a) GDPR. The service is activated only after you have given the relevant consent through our consent solution.

You can refuse or withdraw your consent through our Cookie Declaration. Consent to this website analysis is not the same as consent to receive direct marketing by email or SMS.

You can read more in Lead Forensics’ data compliance information and Lead Forensics’ data protection FAQ.

Embedded YouTube videos

We use embedded YouTube videos to present our company, products and solutions. YouTube content is only loaded after you have given the relevant consent. Before this, the embedded videos do not establish a connection to YouTube as a result of the embed.

When a video is loaded, Google may receive your IP address, browser and device information and information about the page and video accessed. Depending on whether you are logged into a Google account and on your Google settings, Google may associate the information with your account and use it for its own purposes, including analytics, content personalisation and advertising.

For users in the EU/EEA, the relevant provider is Google Ireland Limited, Ireland. Our legal basis for loading the content and the associated disclosure is your consent under Article 6(1)(a) GDPR.

Google’s own processing is described in Google’s Privacy Policy. You can change your choice in our Cookie Declaration.

Consent choices and consent documentation

We process information about the choices you make in our consent solution, such as accepted and rejected purposes, the time of your choice and a technical identifier. The purpose is to respect your choices and document valid consent where required.

Where processing is necessary to document consent, the legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Processing necessary to remember and respect your privacy choices is based on Article 6(1)(f) GDPR and our legitimate interest in complying with those choices.

Data subject requests and legal claims

We process the information necessary to respond to requests concerning your data protection rights. The legal basis is Article 6(1)(c) GDPR in conjunction with the relevant GDPR provisions governing those rights.

We may also process relevant information where necessary to establish, exercise or defend a legal claim. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to document relevant events and protect our legal interests.

4. Who may receive your personal data?

We use service providers for hosting, website maintenance, IT operations, email, consent management and administrative systems. These may include ezyWeb ApS and the relevant Google and Lead Forensics services described above.

Where a supplier processes personal data on our behalf, the processing is carried out under our instructions and subject to a data processing agreement where required. Access is limited to what is necessary for the supplier to perform its services.

In connection with specific transactions, necessary information may be shared with carriers and other suppliers involved in fulfilment. We may also share relevant information with banks, auditors, legal advisers and public authorities where this is necessary for payment, auditing, advice, legal claims or compliance with a legal obligation.

Some recipients may act as independent data controllers for their own processing. This may include Google where Google processes YouTube data for its own purposes.

5. Transfers of personal data outside the EU/EEA

Some service providers may process personal data outside the European Union and the European Economic Area (EU/EEA). A transfer may also occur where staff or sub-processors located outside the EU/EEA are able to access personal data.

Google

When Google Analytics and YouTube are used, information may be transferred to Google LLC in the United States and processed within Google’s international service provider network.

Google states that covered transfers to Google LLC and participating US affiliates are made under the EU-U.S. Data Privacy Framework. For such transfers, the legal transfer mechanism is the European Commission’s adequacy decision under Article 45 GDPR.

For relevant transfers that are not covered by an adequacy decision, Google states that it uses the European Commission’s Standard Contractual Clauses under Article 46 GDPR and supplementary safeguards where necessary.

You can read more in Google’s information about international data transfer frameworks and Google’s list of sub-processors for relevant business services.

Lead Forensics and other suppliers

Lead Forensics is a UK-based provider. The United Kingdom is outside the EU/EEA but is currently covered by European Commission adequacy decisions for the relevant data protection framework. Transfers covered by an adequacy decision may take place under Article 45 GDPR.

Lead Forensics also states that international transfers may take place through its systems and sub-processors. Further information is available in Lead Forensics’ data protection FAQ.

You may contact us for further information about transfers and, where applicable, to request a copy of the relevant safeguards. You can also consult the European Commission’s overview of adequacy decisions.

6. How long do we retain personal data?

We delete or anonymise personal data when it is no longer necessary for the purposes for which it was processed, unless a legal obligation or another specific lawful purpose requires continued retention.

Enquiries and quotations

Information is retained while we handle your enquiry or quotation process and any agreed follow-up. Once the matter is concluded and there is no open quotation or agreed follow-up, information that is only needed for that matter is deleted. Information that forms part of a subsequent agreement, accounting material or a specific legal claim is retained in accordance with the relevant criteria below.

Customers and business partners

Contact information is retained while it remains relevant to the business relationship. Information used only for ongoing contact is updated or deleted when we become aware that the person is no longer the relevant contact or when the business relationship ends.

Contract, delivery and complaint information may be retained throughout the contractual relationship and afterwards where necessary to document the agreement or handle warranties, complaints or legal claims. The retention period depends on the nature of the agreement and the applicable warranty, complaint and limitation periods. Where there is a specific dispute, relevant information may be retained until the matter has been finally resolved.

Accounting material

Personal data contained in accounting material that is subject to Danish bookkeeping retention requirements is retained for five years from the end of the financial year to which the material relates. This period does not automatically apply to all customer information or all correspondence.

Anonymised operational and security logs

We retain operational and security logs in anonymised form so that the information can no longer be linked to an identified or identifiable person, including through combination with other information using means reasonably likely to be used.

Data that has been genuinely and irreversibly anonymised is no longer personal data and is therefore not subject to a GDPR-specific maximum retention period. This does not apply to personal data processed before anonymisation.

Google Analytics 4

We distinguish between user-level and event-level data that may relate to an identifiable individual and statistical information that has been genuinely and irreversibly anonymised.

Data covered by the GA4 data retention setting is deleted through Google’s deletion process after the configured period expires. The setting does not apply in the same way to aggregated standard reports. Read more about data retention in Google Analytics.

Statistical information that has been genuinely and irreversibly anonymised may be retained without a GDPR-specific maximum retention period. Merely displaying information in aggregate form or without a name does not necessarily make the underlying data anonymous.

Lead Forensics

There is no separate statutory retention period that applies specifically to Lead Forensics. Personal data processed through the service is retained only for as long as it is necessary for the company identification and sales analytics purposes described above, and is then deleted or anonymised.

Exporting data to another system does not, by itself, provide a legal basis for retaining it for a longer period. The lifetime of a cookie is also not necessarily the same as the retention period for personal data collected through the service.

Consent documentation

We retain documentation that is necessary to demonstrate consent while we process personal data on the basis of that consent. When that processing ends, the documentation is deleted unless a separate and specific lawful purpose requires continued retention, for example in connection with a concrete dispute.

The lifetime of individual cookies is stated in our Cookie Declaration. Google’s retention of information that it processes for its own purposes in connection with YouTube is described in Google’s Privacy Policy.

7. Do you have to provide us with your personal data?

It is generally voluntary to contact us and provide personal data. However, we need certain information in order to answer an enquiry, prepare a quotation or fulfil an agreement. If you do not provide the necessary information, we may be unable to assist you or provide the requested product or service.

For relevant transactions, we are required to process information that must be retained under applicable accounting legislation. You can contact us without consenting to Google Analytics or Lead Forensics. If you do not consent to YouTube, embedded YouTube videos will not be loaded.

8. Withdrawal of consent

You may withdraw your consent at any time. Consent to Google Analytics, Lead Forensics and YouTube can be changed or withdrawn through our Cookie Declaration.

Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn. Once consent is withdrawn, processing that relies on that consent will stop and the relevant personal data will be deleted or anonymised unless another independent lawful basis requires or permits continued processing.

Please contact us if you need assistance withdrawing consent or exercising your rights in relation to information that has already been collected. We may need an appropriate technical identifier in order to locate visit-related information that is not stored under your name.

9. Security

We protect personal data using technical and organisational measures appropriate to the nature of the information and the risks associated with the processing. Access is limited to employees and suppliers who have a relevant need to access the information.

We review and adapt our security measures when changes to our systems, processing activities or risks make this necessary.

10. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

This does not exclude the automated website analytics and company identification activities described in section 3.

11. Your rights

You have a number of rights under applicable data protection law. These rights apply subject to the conditions and exceptions set out in the GDPR.

Access and rectification: You may request confirmation of whether we process personal data about you, obtain access to that data and receive a copy. You may also request correction of inaccurate data and completion of incomplete data.

Erasure and restriction: In certain circumstances, you may request deletion of your personal data or restriction of its processing. The right to erasure is not absolute, for example where we are legally required to retain particular information.

Data portability: Where processing is carried out by automated means and is based on your consent or a contract with you, you may in certain circumstances receive personal data that you provided to us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that it be transmitted directly to another controller.

Right to object: You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object at any time to processing of personal data for direct marketing purposes, including related profiling. We must then stop processing your data for that purpose.

Withdrawal of consent: Where processing is based on your consent, you may withdraw that consent as described in section 8.

To exercise your rights, contact us at nordisk@perlite.dk. We will respond without undue delay and generally within one month of receiving your request. Where permitted by law, this period may be extended by up to two additional months due to the complexity or number of requests. If so, we will inform you and explain the reason within the initial one-month period.

If we have reasonable doubts about your identity, we may request additional information necessary to confirm it.

You can read more about data protection rights on the Danish Data Protection Authority’s English-language website.

12. Complaints to the Danish Data Protection Authority

You have the right to lodge a complaint with the Danish Data Protection Authority if you are dissatisfied with our processing of your personal data. You are welcome to contact us first, but you are not required to do so before making a complaint.

Danish Data Protection Authority (Datatilsynet)
Carl Jacobsens Vej 35
DK-2500 Valby
Denmark
Email: dt@datatilsynet.dk
Telephone: +45 33 19 32 00
Website: www.datatilsynet.dk/english

13. Changes to this Privacy Policy

We update this Privacy Policy when changes to our processing of personal data or applicable law make this necessary. The current version is published on this page, and the date of the latest update appears at the top.

If we intend to process your personal data for a new purpose, we will provide the information required by applicable data protection law before the new processing begins and obtain new consent where this is required.