Privacy
Privacy policy
Last updated 18 October 2026
This policy explains what personal data Vardex collects, why, and what rights you have. It covers this website (vardex.io) and Vardex Cloud, our platform for plant sensor data.
Who is responsible
Vardex is a brand of EFL Solutions AS, Norway, which is the controller for the personal data described here. Questions and requests: hello@vardex.io.
This website
The website has no analytics, no tracking and no cookies. It is hosted on GitHub Pages, and its fonts are loaded from Google Fonts. Like any web server, they receive your IP address and browser details when you open the page. They use this to deliver the page and to protect their services.
If you email us, we use your name, address and what you write to answer you and, if we work together, to run the project. The legal basis is our legitimate interest in replying to enquiries, or a contract with you or your employer.
Vardex Cloud
Account and sign-in
Access to Vardex Cloud is by invitation only. You sign in with your Microsoft or Google account. We do not store passwords. We receive and keep:
- your name, email address and, from Google, your profile picture
- which organizations and plants you have access to, and in which role
- sign-in sessions, with IP address and browser, to keep you signed in and to detect misuse
- an audit log of changes you make, such as invitations, access changes and settings
The legal basis is the contract between Vardex and your employer or organization, and our legitimate interest in keeping the service secure.
Cookies
Vardex Cloud sets only the cookies needed to sign you in and keep you signed in. They are strictly necessary, so we do not ask for consent. There are no analytics or advertising cookies.
Plant and sensor data
Data from your plant (measurements, events, equipment information) belongs to our customer. We process it on the customer's behalf and on its instructions, under our agreement with the customer. If you have questions about that data, contact the company that operates the plant.
Who processes data for us
We use these providers. Each has a data processing agreement with us and may only use the data to provide its service.
| Provider | What for | Where data is stored |
|---|---|---|
| Microsoft Azure | Hosting Vardex Cloud, backups, monitoring | Germany (EU) |
| Tiger Data (Timescale) | Vardex Cloud database | Germany (EU), on Microsoft Azure |
| Microsoft, Google | Sign-in, if you choose their account | Per your account with them |
| Google Workspace | EU and other Google regions | |
| GitHub | Hosting this website | United States |
Some of these companies are based in the United States. Where data may leave the EU/EEA, the transfer is covered by the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
- Sign-in sessions expire after 7 days of inactivity and are then deleted.
- Your account is kept while you have access. When your organization removes you or ends its agreement, we delete or anonymise your account, except entries in the audit log that we need for security and accountability.
- Database backups are kept for up to 8 weeks.
- Email is kept as long as needed for the enquiry or project. Accounting records are kept as Norwegian law requires.
Security
All connections are encrypted. Each customer's data is kept apart in the database, and Vardex staff have no access to customer data unless the customer grants time-limited support access. Changes are recorded in an audit log.
Your rights
Under the GDPR you can ask us for access to your personal data, and to correct, delete, restrict or export it. You can also object to processing based on our legitimate interest. Email hello@vardex.io and we will answer within one month. For plant data, we will forward your request to the customer it belongs to.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet.
Changes
We update this policy when what we do changes. The date at the top shows the latest version.