Privacy Policy

Last updated: 27 July 2026

1. Who we are

NordicRate ("we", "us") is an independent loan and insurance comparison website operated as a sole proprietorship registered in Turkey by Berkay Barboros [PLACEHOLDER: registered trade name and address as shown in the Turkish trade registry]. We are the data controller for personal data processed through nordicrate.com.

Contact for all privacy matters: [email protected]

This policy is provided in English. It applies to all visitors, including users in the European Union, whose data we process in accordance with the EU General Data Protection Regulation (GDPR).

2. What data we collect, and why

We collect only the data described below. We do not require an account for core use of the site.

a) Rate-alert signups

Data: email address, selected product/country parameters.
Purpose: sending you the rate alerts you requested.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Storage: Supabase (EU-hosted PostgreSQL).

b) "Find my best rate" flow

Data: loan parameters (amount, term, country; income is optional), and optionally your email address.
Purpose: generating comparison results; contacting you with results if you provide an email.
Legal basis: consent (Art. 6(1)(a)) for storing your email; legitimate interest (Art. 6(1)(f)) for anonymous processing of loan parameters.

c) AI assistant chat

Data: your chat messages and, if you submit the lead form, your email plus a loan profile extracted from the conversation.
Purpose: answering your questions and providing informational loan comparisons.
Processing detail: chat messages are transmitted to Groq, Inc. (USA) to generate AI responses and extract your loan profile. Do not include sensitive personal data (health, financial account numbers, ID numbers) in chat messages.
No automated decision-making with legal effect: AI outputs are informational recommendations only; no decision producing legal or similarly significant effects (Art. 22 GDPR) is made about you.
Legal basis: consent (you actively use the chat); contract for the lead form follow-up.

d) Partner / B2B contact form

Data: name, business email, company details, message content.
Purpose: responding to partnership enquiries (contact: [email protected]).
Legal basis: legitimate interest / pre-contractual steps (Art. 6(1)(b) and (f)).

e) Outbound affiliate link clicks (/go redirects)

Data: session identifier, product identifier, timestamp. No name or email is logged.
Purpose: click attribution for referral commissions and abuse prevention.
Legal basis: legitimate interest (Art. 6(1)(f)) in operating and funding a free comparison service.

f) Analytics

Data: usage statistics via Google Tag Manager and Google Analytics 4.
Consent-gated: analytics runs only after you accept it in our consent banner. We use Google Consent Mode v2 with analytics storage denied by default. No analytics cookies are set before consent.
Legal basis: consent (Art. 6(1)(a)); ePrivacy Directive rules on cookies.

g) Security and server logs

Data: IP address, request metadata, rate-limiting counters.
Purpose: security, abuse prevention, service integrity.
Legal basis: legitimate interest (Art. 6(1)(f)).

h) Optional account (Supabase Auth)

Data: email and authentication credentials, only if you choose to sign up.
Legal basis: performance of a contract.

We do not process special categories of data, and the service is not directed at children under 16.

3. Processors and recipients

We use the following processors under data processing agreements: Supabase (database/auth, EU), Google (GTM/GA4, consent-gated analytics, EU/US), Groq, Inc. (AI chat responses, US), Cloudflare (CDN/security, global), Hetzner Online GmbH (server hosting, Germany/EU).

We also use Google Gemini for internal content automation; no user personal data is sent to Gemini.

We do not sell personal data and do not share it with data brokers. When you click an affiliate link, you leave our site and the destination bank or affiliate network (e.g., Awin, Adtraction) processes your data as an independent controller under its own privacy policy.

4. International transfers

Some processors (Google, Groq, Cloudflare) may process data in the United States. Where this occurs, transfers are safeguarded by the EU–US Data Privacy Framework (where the processor is certified) and/or the European Commission's Standard Contractual Clauses (SCCs). Core user data storage (Supabase, Hetzner) remains in the EU.

[REVIEW: operator is established in Turkey; there is no EU adequacy decision for Turkey — administrative access to EU user data by the controller should be covered by SCCs or equivalent safeguards.]

5. Retention

Rate-alert signups: until you unsubscribe, then deleted within 30 days [ADJUST]
"Find my best rate" submissions with email: 12 months from last activity [ADJUST]
AI chat lead data: 12 months [ADJUST]; chat history is stored only in your browser (localStorage) unless a lead form is submitted
Affiliate click logs: 13 months (attribution windows) [ADJUST]
B2B contact enquiries: 24 months [ADJUST]
Security/server logs: 90 days [ADJUST]
Analytics (GA4): 14 months (Google default) [ADJUST]

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting prior processing). Analytics consent can be withdrawn via the cookie banner (see our [Cookie Policy](/cookies)).

To exercise any right, email [email protected]. We respond within one month. We may need to verify your identity.

You also have the right to lodge a complaint with your local EU supervisory authority — for example, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) if you are in Estonia, or the Finnish Data Protection Ombudsman (tietosuoja.fi) if you are in Finland.

7. Changes

We will update this policy when our processing changes and revise the "Last updated" date. Material changes affecting registered users will be notified by email or site notice.