NordicRate

Privacy Policy

Last updated: 15 September 2026

1. Who we are

NordicRate ("we", "us") is an independent loan and insurance comparison website operated as a sole proprietorship registered in Turkey by Berkay Barboros (see [Imprint](/imprint)). We are the data controller for personal data processed through nordicrate.com.

Contact for all privacy matters: [email protected]

This policy is provided in English. It applies to all visitors, including users in the European Union, whose data we process in accordance with the EU General Data Protection Regulation (GDPR).

2. What data we collect, and why

We collect only the data described below. We do not require an account for core use of the site.

a) Rate-alert signups

  • Data: email address, selected product/country parameters.
  • Purpose: sending you the rate alerts you requested.
  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Storage: Supabase (EU-hosted PostgreSQL).

b) "Find my best rate" flow

  • Data: loan parameters (amount, term, country; income is optional), and optionally your email address.
  • Purpose: generating comparison results; contacting you with results if you provide an email.
  • Legal basis: consent (Art. 6(1)(a)) for storing your email; legitimate interest (Art. 6(1)(f)) for anonymous processing of loan parameters.

c) AI assistant chat

  • Data: your chat messages and, if you submit the lead form, your email plus a loan profile extracted from the conversation.
  • Purpose: answering your questions and providing informational loan comparisons.
  • Processing detail: chat messages are transmitted to Groq, Inc. (USA) to generate AI responses and extract your loan profile. Do not include sensitive personal data (health, financial account numbers, ID numbers) in chat messages.
  • No automated decision-making with legal effect: AI outputs are informational recommendations only; no decision producing legal or similarly significant effects (Art. 22 GDPR) is made about you.
  • Legal basis: consent (you actively use the chat); contract for the lead form follow-up.

d) Partner / B2B contact form

  • Data: name, business email, company details, message content.
  • Purpose: responding to partnership enquiries (contact: [email protected]).
  • Legal basis: legitimate interest / pre-contractual steps (Art. 6(1)(b) and (f)).

e) Outbound affiliate link clicks (/go redirects)

  • Data: session identifier, product identifier, timestamp. No name or email is logged.
  • Purpose: click attribution for referral commissions and abuse prevention.
  • Legal basis: legitimate interest (Art. 6(1)(f)) in operating and funding a free comparison service.

f) Analytics

  • Data: usage statistics via Google Tag Manager and Google Analytics 4.
  • Consent-gated: analytics runs only after you accept it in our consent banner. We use Google Consent Mode v2 with analytics storage denied by default. No analytics cookies are set before consent.
  • Legal basis: consent (Art. 6(1)(a)); ePrivacy Directive rules on cookies.

g) First-party visit measurement

  • Data: page path, product cards viewed, outbound clicks, the traffic source category (search, social, referral, direct) and a random identifier that lives only in the current browser tab (sessionStorage). No IP address, name or email is stored with these events.
  • Purpose: aggregate statistics on which pages and products are useful, so we can improve the service.
  • Legal basis: legitimate interest (Art. 6(1)(f)). You can object at any time by choosing "Decline" in the cookie banner — this switches the measurement off in that browser.

h) Feedback you send us

  • Data: your answer to "Did you find what you were looking for?", any text you write, and your email only if you add it.
  • Purpose: improving the site and, if you left an email, replying to you.
  • Legal basis: consent (Art. 6(1)(a)). Retained for 24 months.

i) Security and server logs

  • Data: IP address, request metadata, rate-limiting counters.
  • Purpose: security, abuse prevention, service integrity.
  • Legal basis: legitimate interest (Art. 6(1)(f)).

j) Optional account (Supabase Auth)

  • Data: email and authentication credentials, only if you choose to sign up.
  • Legal basis: performance of a contract.

We do not process special categories of data, and the service is not directed at children under 16.

3. Processors and recipients

We use the following processors under data processing agreements: Supabase (database/auth, EU), Google (GTM/GA4, consent-gated analytics, EU/US), Groq, Inc. (AI chat responses, US), Cloudflare (CDN/security, global), Hetzner Online GmbH (server hosting, Germany/EU).

We also use Google Gemini for internal content automation; no user personal data is sent to Gemini.

We do not sell personal data and do not share it with data brokers. When you click an affiliate link, you leave our site and the destination bank or affiliate network (e.g., Awin, Adtraction) processes your data as an independent controller under its own privacy policy.

4. International transfers

Some processors (Google, Groq, Cloudflare) may process data in the United States. Where this occurs, transfers are safeguarded by the EU–US Data Privacy Framework (where the processor is certified) and/or the European Commission's Standard Contractual Clauses (SCCs). Core user data storage (Supabase, Hetzner) remains in the EU.

The operator is established in Türkiye, for which there is no EU adequacy decision. Access to EU-hosted data from Türkiye is limited to administering the service, uses encrypted connections and individual access credentials, and personal data is not copied to or stored outside the EU for that purpose.

5. Retention

  • Rate-alert signups: until you unsubscribe, then deleted within 30 days
  • "Find my best rate" submissions with email: 12 months from last activity
  • AI chat lead data: 12 months; chat history is stored only in your browser (localStorage) unless a lead form is submitted
  • Affiliate click logs: 13 months (attribution windows)
  • B2B contact enquiries: 24 months
  • Security/server logs: 90 days
  • Analytics (GA4): 14 months (Google default)

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting prior processing). Analytics consent can be withdrawn via the cookie banner (see our [Cookie Policy](/cookies)).

To exercise any right, email [email protected]. We respond within one month. We may need to verify your identity.

You also have the right to lodge a complaint with your local EU supervisory authority — for example, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) if you are in Estonia, or the Finnish Data Protection Ombudsman (tietosuoja.fi) if you are in Finland.

7. Changes

We will update this policy when our processing changes and revise the "Last updated" date. Material changes affecting registered users will be notified by email or site notice.

Did you find what you were looking for?NordicRate is new — your answer directly decides what we build next.