What happens
to your data.

Who is responsible

PayTech Consulting AS is the data controller for personal data processed through this website. We are registered in Norway under organisation number [organisation number], with a registered address at [registered address], Norway.

For any question about this policy or about your personal data, write to hello@paytechconsulting.com and mark your message "Privacy".

This policy covers this website only. It does not cover our consulting engagements, where the contract governing that work sets out how client data is handled, nor the other sites operated by companies in PayTech Group, each of which publishes its own policy.

What this site collects

Nothing you type, because there is nothing here to type into. This site has no forms, no search, no login and no account. It is a set of static pages.

It ships one small script, which fades each section in as you scroll to it. That script runs entirely in your browser, records nothing and sends nothing anywhere.

SERVER LOGS

Our hosting provider records the usual technical details of a request: IP address, timestamp, the page requested, referring page, and browser and operating system strings. These are generated by the infrastructure, not by us, and we do not use them to build a profile of you.

MESSAGES YOU SEND

Whatever you put in the message — your name, your organisation, and whatever you tell us about the problem you want to discuss.

Cookies and tracking

There are none. This site sets no cookies of any kind, so there is no consent banner to dismiss.

It also runs no analytics, no tag manager, no advertising or conversion pixels, no session recording and no A/B testing. We do not know how many of you there are, which pages you read, or where you came from, beyond whatever appears in our host's logs.

Google Fonts

One disclosure matters more than the rest, so it gets its own clause: this page is not entirely self-contained.

The site is set in DM Sans and Manrope, and both are fetched from Google Fonts when the page loads. Making that request tells Google your IP address, the page you are loading it for, and the usual browser details. It is the only third-party request this site makes, and it happens before you interact with anything.

Google sets no cookie on the font endpoints, but it does receive and log that request. What Google does with it is governed by Google's privacy policy rather than by this one. If you would rather not make that request, a content blocker will stop it; the site stays readable, though the headings fall back to your system faces.

Everything else the page needs — every logo, the portrait, the stylesheet, the script — is served from our own domain.

The WhatsApp and email links

The calls to action on this site either open WhatsApp with a message already drafted or open your own email program addressed to us. Nothing is sent until you send it, and nothing about the click reaches us beforehand.

If you email us, we receive whatever you choose to put in the message: your address, your name if you sign it, and anything else you include. We keep that correspondence for the same reason as below.

Once you do send it, you are on WhatsApp's infrastructure and their terms apply to the transport of the message — see the WhatsApp privacy policy. We see the phone number you contact us from and the content of your message, and we keep that correspondence so that whoever picks up the thread has the context.

Please do not send confidential commercial material, personal data about your customers or employees, or anything else sensitive through an opening WhatsApp message. Tell us it exists and we will agree a proper channel for it.

Why we are allowed to do this

LEGITIMATE INTERESTS

Keeping the site available and secure, and replying to business correspondence. We think a reader who messages a consulting firm expects that firm to keep the thread, and it is balanced against your rights.

STEPS BEFORE A CONTRACT

Where you approach us about an engagement, handling your enquiry is part of deciding whether to work together.

LEGAL OBLIGATION

Where accounting, tax or anti-money-laundering law requires us to keep a record.

How long we keep it

• Server logs: retained by our host on their standard schedule, typically a short rolling window measured in weeks.
• Business correspondence: for as long as the relationship is live, and then for as long as we may need it for a legal or accounting record.
• Enquiries that go nowhere: a reasonable period, after which we delete them. Ask us to do it sooner and we will.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing.

• Our hosting and email providers, which process data on our instructions under a written agreement.
• Google, to the extent described in the Google Fonts clause above.
• Other companies in PayTech Group, where your enquiry is better answered by a colleague in another part of the group.
• Professional advisers, or an authority, where the law requires it.

Transfers outside the EEA

Some of the providers above operate outside the European Economic Area, Google among them. Where personal data reaches them, we rely on an adequacy decision or on the European Commission's standard contractual clauses, together with whatever additional safeguards the transfer needs. Ask us and we will tell you which applies to a given provider.

Your rights

Under the GDPR you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, object to processing we base on legitimate interests, and ask for your data in a portable form.

Write to hello@paytechconsulting.com. We will respond within one month. There is no charge unless a request is clearly unfounded or excessive.

If you are not satisfied with our answer you can complain to Datatilsynet (the Norwegian Data Protection Authority), or to the authority in the EEA country where you live or work.

Security

The site is served over HTTPS. Because it is a static build with no database, no accounts and no user input, there is very little attack surface here: there is nothing stored on this site to breach.

Correspondence and engagement records live in our own systems, which are access-controlled and restricted to the people who need them. No transmission over the internet is ever completely secure — bear that in mind before sending us anything highly sensitive.

Changes to this policy

If this policy changes we will update the page and move the date at the top. This version is effective from 26 September 2026.