Privacy Policy

This privacy policy explains how NordicContacts processes personal data relating to people who work in companies or organizations when we provide B2B contact data services.

Purpose of the register

The purpose of processing personal data is to provide companies using the data with information needed for marketing or sales activities, opinion or market research, and customer register updates. Data is disclosed for these purposes.

In this context, decision-makers means persons who, by virtue of their position, make decisions as part of their work on behalf of and in the name of their employer.

Data Controller

Vine Oy, which operates the NordicContacts service, is the data controller for the B2B contact data and related privacy request records described on this page.

Vine Oy (NordicContacts)

Linnoitustie 3, 02600 Espoo

Privacy matters: info@nordiccontacts.eu

What personal data we process

We process:

• name and work contact details, such as work email address and phone number
• job title, department, responsibility area, decision-maker role, and other professional role information
• employer company details, such as company name, address, industry, website, and other business identifiers
• source and update metadata, such as where the information was collected and when it was last seen
• privacy request, objection, suppression, customer service, and transaction records when needed to protect rights and meet legal obligations

Purpose of processing

We process personal data to:

• provide, maintain, and improve NordicContacts B2B contact data services
• sell and otherwise disclose B2B contact data to company and organization customers for sales, marketing, market research, and customer register updates
• handle data subject requests, objections, corrections, and other customer service interactions
• prevent misuse, document requests, and comply with legal obligations such as accounting

Legal bases

The primary legal basis for processing business contact data is legitimate interest under GDPR Article 6(1)(f). We also process personal data when necessary to comply with legal obligations, handle contracts and requests, and establish, exercise, or defend legal claims.

You have the right to object to processing based on legitimate interest. You can always object to the use of your personal data for direct marketing.

Sources of data

We collect data from sources such as:

• official business and authority registries
• companies' own websites and other publicly available online sources
• publicly available company and professional information
• information provided by you, your employer, or our customers in connection with updates, corrections, or requests

Disclosures and sales of data

NordicContacts sells and otherwise discloses B2B contact data to company and organization customers as part of the service.

• Recipient categories may include customers using the data for sales, marketing, market research, customer register updates, and other business information purposes.
• We may also disclose personal data to contracted service providers that process data on our behalf.

Where data is processed

NordicContacts processes personal data within the EU/EEA in its own operations. We disclose contact data to business customers in EU countries, Norway, Liechtenstein and Switzerland. Transfers to Switzerland rely on the applicable European Commission adequacy decision. Customers are responsible for their own use of the data and the applicable data protection obligations.

If you connect an AI assistant or another MCP client such as Claude to your account, the contact and company data you request is delivered to that tool and processed by its provider under the provider's own terms. That downstream processing happens outside NordicContacts systems and may take place outside the EU/EEA.

Customer accounts, OAuth and MCP usage

When you use NordicContacts as a customer, we store the records needed to provide the service: your account and subscription details, manually created API tokens, OAuth-registered MCP clients (such as Claude) with their redirect addresses, access tokens issued through the sign-in flow, and usage records for metered calls.

An MCP usage record contains the tool name, the number of billed units, the timestamp, and — where the tool used one — the identifier you searched with, such as an email address, domain or company name.

Your rights

Depending on the situation and the legal basis, you may have the right to:

• receive confirmation of whether we process your personal data and obtain access to that data
• request the correction of inaccurate or incomplete personal data
• request the deletion of personal data when the legal requirements for erasure are met
• object to processing or request restriction of processing in accordance with applicable law
• lodge a complaint with the competent data protection authority

Privacy matters: info@nordiccontacts.eu

Retention

We keep contact records only as long as they remain relevant for the service and delete stale contact data when it has not been seen in our sources for 4 months. We may keep request, suppression, contract, billing, and accounting records longer when required by law or needed to protect rights.