What personal data do you keep about Trust Center users?

Only your work email address. It is used for two things: sending your access link and watermarking the documents you download.

What is not kept

• No password: sign-in works through a magic link sent to your email.
• No name.
• No company.

How long it is kept

Client and partner accounts are deleted automatically after two years. Prospect and auditor invitations last 7 days. When an account ends, the email address goes with it, and access can be reopened on request.

Why so little

The Trust Center exists to share compliance evidence, not to collect information about the people who read it. Keeping only what the portal needs follows the data minimization principle of EU Regulation 2016/679, under which NORBr processes personal data. Watermarking needs an identifier, and the email address is enough.

What it means for your team

Your security staff and auditors can use the portal without creating another account with a password to manage, and without sharing personal details beyond their work email. A Privacy Notice is available in the Trust Center for anyone who needs the full details.

The same approach to data protection applies across the NORBr infrastructure, with data encrypted in transit and at rest.