Privacy Policy
How Norma collects, processes, and protects your data.
Effective 5 September 2025
1. Who we are
Norma is operated by Techuplift, Lda., a company registered in Portugal. We provide a compliance management platform that helps organisations run integrated management systems covering standards such as ISO 27001, ISO 9001, GDPR, SOC 2, and NIS2.
2. Data we collect
We collect only the data necessary to deliver and improve the service. The categories below describe what we gather, why, and when.
3. Why we process your data
Every processing activity maps to one of four legal bases under the GDPR. We do not process data without a clear, documented purpose.
| Purpose | Legal basis |
|---|---|
| Deliver the platform and its features | Contract performance |
| Process payments and manage billing | Contract performance |
| Send service notifications and updates | Contract performance |
| Improve performance and fix issues | Legitimate interest |
| Ensure security and prevent fraud | Legitimate interest |
| Send marketing communications | Consent |
| Meet legal and regulatory obligations | Legal obligation |
4. Sharing and disclosure
We share data with a limited set of processors, each bound by a Data Processing Agreement and subject to annual review.
5. International transfers
Your data is primarily hosted in the EU (AWS Ireland). Where a sub-processor operates outside the EEA, we rely on EU Standard Contractual Clauses or an adequacy decision to ensure an equivalent level of protection.
6. Security measures
We apply industry-standard technical and organisational controls to protect your data throughout its lifecycle.
7. Your rights
Under the GDPR and applicable Portuguese law you can exercise the following rights at any time by contacting privacy@norma-compliance.com. We respond within 30 days.
8. Data retention
We retain data only as long as necessary for the purpose it was collected. When data is no longer needed it is deleted or anonymised within the timeframes below.
| Data type | Retention |
|---|---|
| Account data | Active account + 90 days after closure |
| Compliance documents | Per workspace settings or 7-year minimum |
| Audit trails | 7 years |
| Security logs | 2 years |
| Analytics (anonymised) | 26 months |
9. Cookies and analytics
We use a small number of cookies strictly necessary for the service to function, plus optional analytics cookies that are only set with your consent. Full details are in our Cookie Policy.
10. Changes to this policy
We review this policy annually. If we make material changes we will notify account holders by email at least 30 days before the changes take effect. The date at the top of this page always reflects the latest version.
11. Governing law
This policy is governed by the laws of Portugal. Any dispute that cannot be resolved informally will be submitted to the competent courts of Setubal, Portugal, without prejudice to your right to lodge a complaint with the Portuguese supervisory authority (CNPD) or any other EU data-protection authority.