01Our Commitment
Nordath is established in France and processes personal data under the EU General Data Protection Regulation (GDPR), which also applies in Norway, Iceland and Liechtenstein through the EEA Agreement. For users and data in the United Kingdom we also follow the UK GDPR, and in Switzerland the revised Federal Act on Data Protection (FADP). We design ALP to use as little personal data as possible.
02Controller or Processor
This section is the one place where the split is defined; the Privacy Policy and the Terms refer to it. - Nordath is controller for its website, customer accounts, billing and support. - Nordath is processor when a customer uses ALP to manage landowner contacts or send letters: the customer is the controller, decides whom to contact and why, and Nordath acts only on its documented instructions under a data processing agreement.
03Legal Bases
We rely on the performance of a contract (providing ALP), our legitimate interests (security, fraud prevention and improving the service), our legal obligations (accounting and tax records) and your consent (analytics). You can withdraw consent at any time without affecting earlier processing.
04Landowners and Public Registers
The parcels, buildings and zoning shown in ALP come from official public registers published for reuse in each covered country. In most of them these datasets do not name the owner, and ALP does not identify owners outside France. In France, only companies and public bodies are identified, from the public SIRENE and BODACC registers; a private owner's name and address are never looked up, and are only in ALP if a customer records them, for example after the owner has replied to that customer's letter. Every landowner can object to this processing and to being contacted, at any time and free of charge, by writing to [email protected]. How a letter is addressed: ALP never looks up a private individual's name or address. The customer types the postal address on the parcel record, from a source they are entitled to use, and the letter is addressed to the owner of the parcel unless the customer has recorded a name. For a company or public body identified in France from SIRENE, the letter is addressed to that company at its registered office. ALP refuses to post a letter without a complete address, and every letter shows the sending customer's name and contact details, not Nordath's.
05Data Minimisation and Security
Analytics run only with your consent, without cookies, with every typed form input masked. Data is encrypted in transit, stored in the EU, access is restricted by role inside each customer organisation, staff tools sit behind Cloudflare Access, and shared links expire. AI features receive only the documents or questions needed for the task.
06Data Processing Agreement and Sub-processors
The data processing agreement (Article 28 GDPR) between a customer and Nordath is incorporated by reference into the Terms (Section 17) and applies as soon as a customer uses ALP to process landowner data. You can download it at nordath.com/legal/nordath-dpa.pdf; to have it signed or reviewed by your legal team, write to [email protected]. Sub-processors Nordath uses today, as of October 2026: - Railway: application hosting and database (EU region). - Cloudflare: network delivery, security, bot protection and staff access control. - Stripe: payments. - Resend: transactional email. - PostHog: analytics (EU hosting), only with consent. - Google: the Gemini models behind the chat assistant and the zoning-document reader, and Google sign-in. - Microsoft: Microsoft sign-in. - Merci Facteur: printing and posting of outreach letters (France). This list is updated here before a new sub-processor is used.
07Transfers Outside Europe
Where a provider processes data outside the EEA, the United Kingdom or Switzerland, we rely on an adequacy decision or on Standard Contractual Clauses with the UK and Swiss addenda. The list of providers is in our Privacy Policy.
08Your Rights
You have the right to: - Access the personal data we hold about you. - Have inaccurate data corrected. - Have your data erased ('right to be forgotten'). - Restrict or object to its processing, including to landowner outreach. - Receive your data in a portable format. - Withdraw your consent at any time. We answer within one month.
09Data Protection Officer and Complaints
To exercise your rights or ask about our compliance, contact our Data Protection Officer at [email protected]. You may also complain to the CNIL (France), to the supervisory authority of the EU or EEA country where you live, to the ICO (United Kingdom) or to the FDPIC (Switzerland).