What we do
with your data.

Who is responsible

PayTech Group AS is the data controller for personal data processed through this website. We are registered in Norway under organisation number [organisation number], with a registered address at [registered address], Oslo, Norway.

For any question about this policy or about your personal data, write to hello@paytech.academy and mark your message "Privacy".

This policy covers this website only. It does not cover the programmes themselves — participant records, assessments and credentials are handled under the agreement for that programme — nor the other sites operated by companies in PayTech Group, each of which publishes its own policy.

What this site does not do

This is a static website. It is worth stating plainly what is absent, because it is most of what a privacy policy normally has to describe:

• No cookies are set, and nothing is written to your browser's local or session storage.
• No analytics, tag manager, pixel, session recorder or A/B testing tool runs on any page.
• No advertising or cross-site tracking of any kind, and no profiling or automated decision-making.
• No contact forms, sign-ups, enrolment, logins or learner accounts. There is nothing on this site to submit.

The moving constellation behind the opening section is drawn in your browser from random values generated on the spot. It reads nothing from your device and sends nothing back.

What is processed when you visit

SERVER LOGS

Our hosting provider records the requests it serves, which typically includes your IP address, the time of the request, the page requested, and your browser's user-agent string. These logs exist to keep the site available and secure. We do not use them to build any profile of you.

WEBFONTS

The site loads its typefaces (Manrope and DM Mono) from Google Fonts. That request goes from your browser directly to Google, which means Google receives your IP address and can see that a font was requested. We receive nothing from it. Google's handling of that request is governed by its own privacy policy.

That is the whole picture for an ordinary visit. Nothing else about you reaches us.

If you email us

Every contact route on this site is a plain mailto link. If you write to us — to plan a programme, ask about a pathway or discuss a private academy — we receive whatever you choose to put in the message: your address, your name if you sign it, and anything else you include.

We use that only to answer you and to carry on the conversation you started. We do not add you to a mailing list, and we do not pass your message to anyone outside the group, other than faculty who need to see it to help shape a programme you have asked us about.

Please do not send participant lists, performance records or other personal data about your colleagues at the enquiry stage. When a programme goes ahead, participant data is shared under the agreement for it, with the protections that requires.

Our legal basis

Under the GDPR we rely on legitimate interests (Article 6(1)(f)) for both of the things above: keeping the site available and secure, and replying to people who contact us. Both are narrow, both are what you would expect, and neither involves tracking you.

Because the site sets no cookies and runs no tracking, there is nothing here that requires your consent, which is why you are not asked for any.

Who else sees it

Our hosting provider, as processor, because it serves the site and keeps the logs described above. Our email provider, because it carries our mail. Google, to the extent described under webfonts. Nobody else. We do not sell or share personal data, and there is no advertising relationship of any kind attached to this site.

Transfers outside the EEA

Some of the providers above operate outside the European Economic Area. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision. You can ask us which applies to a given provider.

How long it is kept

SERVER LOGS

Kept for as long as our host retains them for security and operational purposes, then deleted on their schedule. We do not take our own copy.

EMAIL

Kept for as long as the correspondence is live, and afterwards only where we need a record of what was agreed. Ask us to delete a thread and we will, unless we are required to keep it.

Your rights

Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it or delete it, ask us to restrict how we use it, object to our use of it, and ask for it in a portable form where that applies.

Write to hello@paytech.academy. We will respond within one month. In practice, for most visitors the honest answer will be that we hold nothing about you at all.

If you think we have handled your data badly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or to the supervisory authority where you live. We would rather you came to us first so we can put it right.

Security, and who this site is for

The site is served over HTTPS. It is a static build with no database and no user accounts behind it, which removes most of what would otherwise be at risk.

This site is aimed at banks, payment schemes, processors, fintechs and corporate payments teams. It is not directed at children, and we do not knowingly collect anything about them.

Changes to this policy

If we change what the site does, we will change this policy to match and update the date on it. This version is effective 28 September 2026.