How we handle your data.

This website sets no cookies, runs no analytics and asks for nothing. This policy explains the little that is processed when you visit, and what happens when you email us.

Last updated 18 September 2026

Who is responsible

PayTech Group AS is the data controller for personal data processed through this website. We are registered in Norway under organisation number [organisation number], with a registered address at [registered address], Oslo, Norway.

For any question about this policy or about your personal data, write to hello@paytechgroup.com and mark your message "Privacy".

This policy covers this website only. It does not cover our client engagements, where the contract governing that work sets out how data is handled, nor the separate websites operated by companies in the group, each of which publishes its own policy.

What this site does not do

This is a static website. It is worth stating plainly what is absent, because it is most of what a privacy policy normally has to describe:

No cookies are set, and nothing is written to your browser's local or session storage.
No analytics, tag manager, pixel, session recorder or A/B testing tool runs on any page.
No advertising or cross-site tracking of any kind, and no profiling or automated decision-making.
No contact forms, sign-ups, logins or accounts — there is nothing on this site to submit.

Because no cookies or similar technologies are used, no consent banner is required and none is shown.

What is processed when you visit

Two things happen on a normal visit, both unavoidable in serving a page over the internet.

Server logs: Our hosting provider records standard technical data for each request: IP address, date and time, the page requested, HTTP status, referrer and browser user-agent string. These logs exist to deliver the site, keep it available and defend it against abuse. They are not used to build a profile of you and are not combined with any other source.
Web fonts: Typefaces are loaded from Google Fonts. Your browser therefore requests those files directly from Google, which discloses your IP address and user-agent to Google as part of that request. Google states that Google Fonts requests are not used for advertising and do not set cookies. If you would rather avoid this entirely, a content blocker that blocks fonts.googleapis.com and fonts.gstatic.com will stop the request; the site remains fully readable in fallback typefaces.

If you email us

The contact links on this site open your own email client. If you write to us, we receive whatever you choose to include — typically your name, email address, employer and the substance of your enquiry — and we keep the correspondence so we can answer it and, where it leads to work together, manage the relationship.

Please do not send confidential, special-category or payment-card data by unsolicited email. If an enquiry needs that kind of material, tell us and we will arrange a secure channel.

Legal basis for processing

We process the data above under Article 6(1)(f) GDPR, our legitimate interest in operating a secure website and in responding to people who contact us. That interest is narrow: the data is minimal, is not used for marketing or profiling, and no one would reasonably be surprised by it.

Where an exchange moves towards an engagement, processing is also necessary to take steps at your request prior to entering a contract under Article 6(1)(b) GDPR.

Who else is involved

We do not sell personal data and we do not share it for anyone else's marketing. Data reaches third parties only through the service providers that make the site and our email work:

Hosting: Hostinger International Ltd (Lithuania, EU) serves this website and holds the server logs described above, as our processor.
Source control and build: GitHub, Inc. hosts the source code and runs the build that publishes the site. It handles no visitor data — only the published files.
Web fonts: Google LLC / Google Ireland Limited receives the font request described above. This is a direct request from your browser to Google, not a transfer we make.
Email: Our corporate email provider processes messages you send to us, as our processor.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

International transfers

We are a group with offices across Europe, the Middle East, Africa and Asia, so correspondence may be read by colleagues outside the EEA. Where personal data leaves the EEA, we rely on an adequacy decision where one covers the destination, and otherwise on the European Commission's Standard Contractual Clauses together with any additional safeguards the transfer calls for.

You can ask us for details of the safeguards applying to a particular transfer by writing to hello@paytechgroup.com.

How long data is kept

Server logs: retained for a short period for security and diagnostics, in line with our hosting provider's standard retention, then deleted or aggregated.
Email correspondence: kept for as long as needed to deal with the enquiry and any relationship that follows, then deleted once it no longer serves a purpose.
Anything we must keep to meet accounting, tax or other statutory obligations is retained for the period that law requires.

Your rights

Under the GDPR and the Norwegian Personal Data Act you have the right to:

Ask what personal data we hold about you and receive a copy of it.
Have inaccurate data corrected and incomplete data completed.
Have data erased where there is no continuing basis for us to hold it.
Ask us to restrict processing, or object to processing carried out on the basis of legitimate interest.
Receive data you provided in a portable format, where that right applies.

To exercise any of these, write to hello@paytechgroup.com. We answer within one month and will not charge you for it. We may ask for enough information to confirm who you are before acting on a request.

If you are unhappy with how we have handled your data, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the supervisory authority where you live or work. We would appreciate the chance to put it right first.

Security and children

The site is served over HTTPS and published as static files, which keeps its attack surface small. No method of transmission over the internet is entirely secure, and email in particular should not be treated as a confidential channel.

This site is aimed at business audiences and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes to this policy

We update this policy when the site or our practices change — for example if we ever add a form or a measurement tool. The date at the top of the page is the version in force, and material changes will be reflected there. This version took effect on 18 September 2026.

Also on this site