Proposal requests & privacy
Group NAO · CVR 40548416 · Snaregade 10B, 3rd floor, 1208 Copenhagen, Denmark. Privacy contact: nao@groupnao.com.
Information and purposes
Both forms require name, organisation and email, plus a request timestamp, the email permission with its wording and time when ticked, and a privacy-notice version. Registering interest requires the email permission; requesting the proposal does not. We do not verify email ownership. A record shows a proposal request, not proof that you read or completed downloading the PDF. No newsletter is added.
Lawful basis
Proposal-request recordkeeping is intended to rely on legitimate interests (GDPR Article 6(1)(f)): administering and understanding interest in the programme. Group NAO must document necessity and a balancing assessment, including whether requiring these fields is justified. The email permission relies on your consent (Article 6(1)(a)) and can be withdrawn at any time by emailing nao@groupnao.com. It is optional when requesting the proposal and required when registering interest, so Group NAO should confirm before publishing that making it a condition of registering interest still counts as freely given under GDPR, or offer an email route for people who would rather not tick it.
Retention and access
Active records expire three calendar months after the request and are removed by daily cleanup, within approximately 24 hours of expiry. Only authorised project operators should access them through Lovable Cloud; visitors cannot read the records. Downloads do not create a visitor account. Hosting backups and technical logs may follow separate retention periods, which Group NAO must verify. Do not re-import expired records from backups or keep exported copies beyond the same period.
Your choices and rights
Email nao@groupnao.com to withdraw follow-up permission or request access, correction, erasure or restriction. You may object to legitimate-interest processing and direct marketing; portability applies where legally applicable. Consent withdrawal does not affect prior lawful processing. We normally respond within one month, with extensions where legally permitted. You can complain to the Danish Data Protection Agency (Datatilsynet).
Hosting, processors and cookies
Lovable Cloud stores proposal records and hosting services deliver this website and its PDF. ClickUp (our task management tool) acts as a processor for people who tick the email permission, so our sales team can follow up. Technical processing may include IP addresses and security logs; this form does not save IP addresses in proposal records or add tracking cookies. Group NAO must verify its processing agreement, current subprocessors, hosting region, international-transfer safeguards and actual site-wide cookies before publishing. Non-essential cookies or tracking must not run before the required consent. Delivering this website and PDF may involve technical hosting data, such as your IP address. This form notice does not cover all website hosting practices.
Notice status
This notice covers this proposal form, not every Group NAO service. The legitimate-interest assessment, processor arrangements, hosting/log/backup retention and the complete cookie inventory still need owner verification. This is not a legal-compliance certification.