1. Who we are

Nordbo Robotics A/S ("Nordbo Robotics", "we", "us" or "our") is the data controller for the processing of personal data described in this policy.

Nordbo Robotics A/S
Noatunvej 2
DK-5000 Odense C
Denmark
CVR/VAT: DK 34697728
Email: info@nordbo-robotics.com
Telephone: +45 81 81 98 81

Our Data Protection Officer is:

Jimmy Jørgensen, Chief Technology Officer
Email: info@nordbo-robotics.com (please mark the message for the attention of the Data Protection Officer)

You may contact our Data Protection Officer about this policy, our use of your personal data or the exercise of your data-protection rights.

2. Scope of this policy

This policy explains how we process personal data relating to:

• visitors to nordbo-robotics.com, nordbo.io and other Nordbo Robotics webpages covered by this policy;

• people who contact us or submit website forms;

• prospective and existing customers, suppliers, distributors, partners and their representatives;

• recipients of newsletters and direct marketing;

• participants in events, campaigns, demonstrations, surveys, trials and testing forums; and

• job applicants and prospective candidates.

Information about an identifiable business contact, such as a person's name, position, business email address, telephone number or interaction history, is personal data even when it concerns a company relationship.

3. Personal data we collect

Depending on your relationship with us, we may process:

• identity and professional information, including name, employer, position, professional interests and relevant qualifications;

• contact information, including business address, email address and telephone number;

• relationship and CRM information, including inquiries, meeting notes, correspondence, preferences, lead source, opportunity status and follow-up history;

• contract, order, delivery and transaction information, including quotations, purchase information, invoices and payment status;

• marketing information, including subscriptions, consent records, communication preferences, campaign interactions and objections to marketing;

• event and testing information, including registration, attendance, feedback, survey responses and information you provide while participating;

• recruitment information, including CV, application, employment history, education, references, interview notes, assessments, salary expectations and work eligibility; and

• technical and usage information, including IP address, device and browser information, cookie identifiers, page interactions, referring website and approximate location derived from IP address.

Please do not provide special-category personal data, such as health information, unless it is necessary and we have requested it or another lawful basis applies. If recruitment requires information about accommodations or health, we will handle it under the additional rules applying to such data.

4. Where personal data comes from

We normally collect personal data directly from you, including when you use our websites, contact us, subscribe, register for an event, apply for a position or interact with our employees.

We may also receive business contact information from:

• your employer or colleagues;

• distributors, integration partners and other business partners;

• event organizers and campaign partners, where they are permitted to share the information;

• publicly available professional sources, company websites and professional networks such as LinkedIn; and

• advertising, analytics and social-media providers, subject to your choices and applicable consent requirements.

5. Why we process personal data and our legal bases

5.1 Websites and contact requests

We process contact details, inquiry content, technical information and relevant interaction history to operate and secure our websites, answer inquiries, arrange demonstrations, prepare proposals and develop a potential business relationship.

Our legal bases are GDPR Article 6(1)(b), where processing is necessary to take steps at your request before entering into a contract, and Article 6(1)(f), based on our legitimate interests in operating secure websites, responding to inquiries and conducting B2B business development. Analytics or advertising cookies that require consent are used under Article 6(1)(a).

5.2 Sales leads, customers, suppliers and partners

We process identity, contact, CRM, correspondence, contract, order, delivery and transaction information to evaluate opportunities, maintain business relationships, prepare and perform agreements, provide products and services, obtain supplies, administer orders and payments, provide support, keep business records and establish or defend legal claims.

Our legal bases are Article 6(1)(b), where you personally are a party to a contract or request pre-contractual steps; Article 6(1)(f), based on our legitimate interests in managing B2B relationships and operating our business; and Article 6(1)(c), where accounting, tax, sanctions, export-control or other law requires processing.

5.3 Newsletters and direct marketing

We process contact details, professional interests, subscription and consent records, communication preferences and engagement information to send relevant product news, invitations and B2B marketing and to measure campaign effectiveness.

Where consent is required, we rely on Article 6(1)(a). Where applicable law permits relevant B2B marketing without consent, we rely on Article 6(1)(f), based on our legitimate interest in marketing our products and maintaining professional relationships. You can object to direct marketing at any time. Each marketing email will provide an unsubscribe method.

We may retain limited suppression information after an objection or withdrawal so that we can respect your choice and demonstrate compliance.

5.4 Events, campaigns and testing forums

We process registration details, attendance, professional interests, feedback, survey responses, correspondence, images or recordings where notified, and testing information to administer activities, communicate with participants, improve our products and follow up on relevant business interest.

Depending on the activity, our legal bases are Article 6(1)(b), Article 6(1)(f) based on our interests in running professional events and improving our products, or Article 6(1)(a) where we ask for consent, including for optional marketing or particular use of images or recordings.

5.5 Recruitment

Applicants submit applications and related correspondence by email to info@nordbo-robotics.com. We process application materials, professional history, interview and assessment information, references and correspondence to assess candidates, manage recruitment, document decisions and protect legal rights.

Our legal bases are Article 6(1)(b), for steps requested before a possible employment contract, and Article 6(1)(f), based on our legitimate interests in recruiting suitable employees and documenting a fair recruitment process. Legal obligations may apply under Article 6(1)(c). We use consent only where it is genuinely voluntary and appropriate, for example to retain an unsuccessful applicant's details for a defined period for future positions. Any special-category information is processed only where an additional legal condition under Article 9 applies.

6. Cookies, analytics and advertising

We use necessary technologies to operate and secure our websites. These include Odoo session and preference functionality, content delivery services and Cloudflare security or bot-prevention services.

With your consent, we use Google Tag Manager, Google Analytics 4, Google Ads or DoubleClick measurement, the LinkedIn Insight Tag and embedded YouTube content to understand website use, measure campaigns, record events such as page views or video starts, and display or evaluate relevant advertising. These services may process IP address, device and browser information, cookie or advertising identifiers, referring URLs, page interactions, campaign parameters and video interactions.

Non-essential technologies are not activated until the required consent has been obtained. You can reject them or withdraw your consent through COOKIE SETTINGS. Withdrawal does not affect processing already carried out before withdrawal.

Our cookie policy and consent interface provide current details about each technology, provider, purpose and lifetime: POLICY LINK. The cookie policy and this privacy policy should be read together.

7. When we disclose personal data

We disclose personal data only where relevant for the purposes described above. Recipients may include:

• hosting, website, cybersecurity and other IT service providers;

• CRM and business administration providers, including Pipedrive and Odoo, for which Nordbo has selected EU-based primary hosting;

• email, communications, analytics and advertising providers, including relevant Google, LinkedIn and Meta entities; Nordbo has selected EU-based primary hosting for the relevant Google services where this option is available;

• professional advisers, auditors, insurers, banks and payment providers;

• distributors, integration partners, event organizers and campaign partners where necessary and transparent;

• public authorities, courts or law-enforcement bodies where required by law or necessary to protect legal rights; and

• a buyer, investor or adviser in connection with a contemplated or completed corporate transaction, subject to appropriate safeguards.

Some recipients act as processors under our instructions. Others act as independent or joint controllers for their own processing. Where a provider acts as a joint controller, we make the essence of the relevant arrangement available as required.

8. International transfers

Nordbo has selected EU-based primary hosting for Odoo, Pipedrive and the relevant Google services. Nevertheless, some providers, their affiliates, subprocessors or support functions - including providers of advertising, social-media and embedded-media services - may access or process personal data outside the European Economic Area.

Where a transfer outside the European Economic Area occurs, we use a lawful transfer mechanism. This may include an adequacy decision by the European Commission, participation of an eligible US recipient in the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses together with supplementary safeguards where required.

You may contact our Data Protection Officer for further information about relevant transfers and to request information about the safeguards used. Commercial or confidential information may be redacted where legally permitted.

9. How long we keep personal data

We keep personal data only for as long as necessary for the relevant purpose, including to meet legal, accounting and documentation requirements and to establish or defend legal claims. The periods below apply unless a longer or shorter period is justified in a particular case:

• Website inquiries and inactive sales leads: normally up to 3 years after the last meaningful interaction.

• Customer, supplier and partner relationship records: for the relationship and normally up to 5 years afterward, subject to longer claim or documentation periods.

• Accounting documentation: for the period required under applicable Danish accounting and tax law, normally 5 years from the end of the relevant financial year.

• Marketing data: until you unsubscribe, withdraw consent or object, followed by limited suppression and compliance records for 2 years.

• Event, campaign and testing records: normally up to 2 years after the activity, unless they become part of an ongoing business relationship or a different period was stated when collected.

• Unsuccessful job applications: deleted within 2 months after the recruitment process ends unless the applicant consents to retention for up to 12 months for future positions.

• Cookie and advertising data: as stated in the current cookie policy and consent interface.

We may retain information longer when required by law, during a dispute or investigation, or where necessary for legal claims. When information is no longer required, it is deleted or irreversibly anonymized.

10. Security

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Measures are selected with regard to the nature of the processing and associated risks. Access is restricted to personnel and service providers with an appropriate need, subject to confidentiality and security obligations.

11. Your rights

Subject to the conditions and limitations in data-protection law, you may have the right to:

• request access to your personal data and information about our processing;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• object at any time to processing for direct marketing;

• receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller;

• withdraw consent at any time, without affecting processing carried out before withdrawal; and

• lodge a complaint with a supervisory authority.

To exercise a right, contact our Data Protection Officer using the details in section 1. We may request information necessary to verify your identity. We normally respond within one month, although data-protection law permits this period to be extended for complex or numerous requests. We will inform you if an extension is necessary.

You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, DK-2500 Valby, Denmark, telephone +45 33 19 32 00, email dt@datatilsynet.dk.

Further information and complaint form: www.datatilsynet.dk

12. Automated decisions

We do not use the personal data covered by this policy to make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. If this changes, we will provide the information required by data-protection law before such processing begins.

13. Changes to this policy

We may update this policy when our processing, services or legal obligations change. The current version will be published on our website with its effective date. We will provide additional notice where a change materially affects individuals or where applicable law requires it.

Effective date: 19.08.2026