CRA Resources: Privacy, Cookies & Terms
Last updated: 9 November 2026
This notice explains how Nemko Digital handles personal data when you visit our Cyber Resilience Act resource pages, request a free resource or choose to receive related emails. It also explains your privacy choices and the terms for using the resources.
You can request the free resources without agreeing to optional marketing emails, analytics or advertising measurement. Requesting a resource does not, by itself, subscribe you to promotional emails.
1. Which pages and activities this notice covers
This notice applies to the following campaign pages on digital.nemko.com:
It also covers their resource-request forms, associated confirmation and download pages, and the handling of those requests and campaign emails. Some forms and files are provided through HubSpot-hosted domains.
Other Nemko websites, campaigns and services have their own applicable notices and terms. This notice does not replace a separate agreement for professional services.
2. Who is responsible for your data
Nemko Digital B.V., operating as Nemko Digital, is the controller responsible for the campaign processing described in this notice.
Business and contact address: Keizersgracht 572, 1017 EM Amsterdam, The Netherlands.
Dutch Chamber of Commerce registration, KvK: 94208972.
VAT identification number: NL866680937B01.
For questions about a resource, download or request, contact digital@nemko.com.
For privacy questions, withdrawal of consent or requests concerning your personal data, contact personaldata@nemko.com. Please identify the CRA resource and the email address used for your request so we can locate the relevant record.
3. Information we collect
Information you provide
The resource forms collect your first name, last name, email address, company and job title. First name and email address are required; the remaining professional details are optional. We record which resource you requested and the time of your submission.
If you send us an enquiry, we process the information in your message and our correspondence with you. Please avoid including confidential product details or sensitive personal data in a resource-request form unless we have agreed an appropriate way to receive them.
We record your marketing and tracking choices, including the date and relevant notice or consent version. We also keep the minimum records needed to respect an unsubscribe or other privacy choice.
Technical and campaign information
Website and form services receive technical information needed to deliver and protect the service. This can include your IP address, browser and device information, request time, page address, form version, delivery or error information and consent status. HubSpot forms can include technical context and performance information alongside a submission.
When you allow optional tracking, we can also process visits, page interactions, referring pages, campaign information, online identifiers and advertising interactions. A link to a campaign page can contain the advertising source, medium, campaign name and identifier, ad-group and ad identifiers, campaign keyword, keyword-target identifier, match type, device category, advertising network and geographic criterion identifier.
The campaign keyword is not necessarily the exact text you typed into a search engine. Geographic criterion identifiers are advertising-location references, not a request for you to enter a precise physical location. Supported Google advertising click identifiers can be present in a link and are used only with the required permission.
The checklist-bundle form includes additional fields for a submission identifier, first-touch information and a snapshot of permitted campaign attribution. These help associate the request with its campaign source. Where these values are linked to your request or contact record, we treat them as personal data. Available values vary by visit, and not every resource form collects the same attribution fields.
Your choice to provide information
You are not under a statutory obligation to request a resource or provide your details. We need a usable email address to send a resource by email and the information genuinely necessary to manage your request. Without it, we may be unable to fulfill the request or respond.
Declining optional professional fields, marketing emails or tracking does not prevent you from obtaining the free resource. Optional fields help us understand the professional context you choose to provide; they are not a condition of access.
4. How we use information and our legal bases
Providing the resource and answering your enquiry
We use the details you provide to make the requested resource available, manage your request in HubSpot, address delivery problems and answer an enquiry you send us. A necessary resource-delivery or support message is separate from promotional follow-up.
We rely on legitimate interests under Article 6(1)(f) of the General Data Protection Regulation, GDPR. Our interests are providing the professional information you expressly requested, managing that request reliably and responding to your questions. We limit this processing to what is needed for those purposes and take account of your rights and reasonable expectations.
Optional promotional emails
If you separately opt in, we use your email address and the relevant information you provide to send CRA guidance, event invitations and information about Nemko Digital's services. The resource-specific campaign can include follow-up messages approximately one, three and seven days after your request. These can include invitations to discuss your CRA priorities or book a conversation with our team.
We use the resource you requested to select the relevant follow-up sequence. You do not need to consent to this sequence to obtain the resource. Promotional messages are sent only where the relevant subscription and consent requirements are met. Follow-ups stop when you unsubscribe or where a booking or transfer to a sales conversation makes them inappropriate.
Our lawful basis for optional email marketing is consent under Article 6(1)(a) GDPR. You can withdraw consent at any time through an email's unsubscribe link or by contacting us. Withdrawal does not affect processing that was lawful before you withdrew.
We do not use invisible email-open pixels or recipient-specific click-tracking redirects in these campaign emails. The sending service processes delivery and bounce information needed to send messages reliably. If you follow a link to a campaign page, any optional website measurement is governed by the choices you make on that page.
Optional website analytics
With your analytics consent, we use Google Analytics 4 to understand visits and interactions with these resource pages. This helps us assess navigation, form use and resource requests and improve the pages. HubSpot website analytics remains disabled on these campaign routes.
Our lawful basis is consent under Article 6(1)(a) GDPR. We also obtain consent for non-exempt storage or access on your device under applicable cookie and electronic-communications rules.
Optional advertising measurement
With your advertising-measurement consent, we use Google Ads conversion measurement and permitted campaign/click information to assess whether an advertising interaction resulted in a resource request. Campaign-attribution records are used for this measurement purpose under your consent, not as an alternative route around a tracking refusal.
We do not use enhanced conversions or other contact-data matching to send the name, email address or other contact details entered in the resource form to Google for advertising matching. We do not use this campaign's data to create remarketing audiences or personalize advertising. Google Ads can still receive permitted conversion-event, technical and advertising-interaction information when you allow measurement.
Our lawful basis for consent-dependent advertising measurement is Article 6(1)(a) GDPR, together with the applicable consent requirements for device storage/access.
Necessary operation, security and privacy records
We process the technical information needed to serve pages and forms, troubleshoot errors, protect the service against misuse and apply your choices. We retain minimal suppression information so that a later import or request does not accidentally restart promotional messages you declined.
We rely on legitimate interests under Article 6(1)(f) GDPR for necessary service operation and security. Where processing is needed to comply with legal data-protection duties, including maintaining appropriate consent evidence and handling a valid rights request, we rely on Article 6(1)(c). These purposes do not make optional marketing or analytics technologies strictly necessary.
Where retention or disclosure is necessary to establish, exercise or defend a legal claim, we rely on legitimate interests under Article 6(1)(f), subject to applicable limits and safeguards.
We will provide further information before a new purpose where required by law. Updating this notice does not, by itself, provide consent for a new use of your data.
5. Providers and other recipients
HubSpot
We use HubSpot for the campaign forms, request and contact records, campaign emails and preference records. For these customer-data services, HubSpot processes information on our behalf under its data-processing terms. The campaign does not use HubSpot website analytics, Intent data sharing or enrichment products.
HubSpot's service involves HubSpot, Inc. in the United States and relevant HubSpot affiliates and service providers. Its Data Processing Agreement, Privacy Policy and subprocessor list explain its roles, safeguards and service-provider arrangements.
We use Google Analytics 4 and Google Ads for the purposes described above. Google service entities include Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC in the United States, with relevant affiliates and subprocessors.
Google acts as a processor for Analytics customer data under its processing terms. Relevant ordinary Google Ads processing is subject to Google's controller terms, under which the parties have their respective controller responsibilities. The campaign does not enable additional Analytics sharing for Google's own product and service improvement, advertising signals, personalized audiences or contact-data matching.
Google's Privacy Policy and explanation of information received from partner sites and apps provide further information about its processing.
Personnel, support providers and authorities
Authorized Nemko personnel and service providers supporting this campaign can access the information needed for their assigned role, such as fulfillment, responding to enquiries, sending consented emails and technical support. Access is limited to the relevant purpose; a campaign submission is not permission for another group company or an unrelated organization to send its own marketing.
Information can be disclosed to competent authorities where legally required, or to professional advisers where necessary for a relevant legal obligation or claim.
LinkedIn tracking, Microsoft Clarity session recording and other unlisted advertising or session-recording integrations are not used on the campaign routes covered by this notice. Introducing another recipient or purpose requires an appropriate update and any necessary consent before activation.
6. International processing and transfers
Our providers operate internationally. Personal data can be processed or accessed outside the European Economic Area, including in the United States, by HubSpot, Google and their relevant affiliates or service providers. A regional hosting option does not mean that all support, service or subprocessor processing remains in the EEA.
For relevant transfers to certified US recipients, HubSpot and Google describe reliance on the EU–US Data Privacy Framework where applicable. Their terms also provide European Commission Standard Contractual Clauses for relevant restricted transfers, with other applicable adequacy arrangements and safeguards where appropriate. The mechanism depends on the recipient, data and transfer concerned; not every transfer uses the same mechanism.
Further information is available in HubSpot's Data Processing Agreement, HubSpot's subprocessor list and Google's advertising and analytics transfer information. Contact personaldata@nemko.com for information or copies of the applicable safeguards for your data, subject to necessary redaction of confidential material.
7. Retention and deletion
We determine retention separately for each purpose. Downloading a free resource is not a reason to retain a personal marketing profile indefinitely.
Resource requests and support: request information is retained while needed to provide the resource and resolve associated delivery or support issues. When that purpose is complete, we remove information no longer needed unless a separate active enquiry, valid subscription, legal obligation or relevant claim justifies retaining particular records.
Active enquiries: correspondence and relevant professional information are retained while the enquiry is being handled. When it closes, we assess what must remain for an agreed next step, a legal duty or a relevant claim and delete or anonymize information without a continuing justification.
Promotional profiles: we retain information needed for a valid subscription while it is used for the consented communications. Withdrawal stops that marketing use. Information used solely for that marketing is then removed or anonymized unless it is needed for limited consent evidence, an opt-out record or another independently justified purpose. An inactive profile is not retained merely because consent was once given.
Consent and opt-out records: we retain only the information needed to demonstrate the relevant choice and prevent renewed unwanted contact. The criterion is the continuing need to honor the opt-out, meet applicable compliance obligations or address a relevant claim. These limited records are not used to continue marketing.
Google Analytics: the campaign's configurable GA4 event/user-data retention is set to two months, without resetting user-data retention merely because of new activity. This setting applies to the relevant event/user data; it is different from cookie expiry and does not set a universal deletion deadline for standard aggregated reports or every record Google processes under its separate responsibilities.
Campaign attribution and advertising measurement: we retain identifiable attribution and conversion records only while needed to evaluate the resource campaign under the relevant consent. We delete or anonymize information when that purpose is complete and no continuing justification remains. Withdrawal stops consent-dependent measurement use. Particular records retained for an independently justified legal obligation or relevant claim are restricted to that purpose.
Technical logs and backups: identifiable technical information is retained only while needed to investigate a delivery/error/security issue, maintain the required protection or meet a legal obligation or relevant claim. Backup copies are restricted from routine marketing and analytics use and expire under the provider's applicable backup/deletion processes. Where a backup is restored, relevant deletion and opt-out restrictions must be reapplied. This is not a promise that every historic vendor copy disappears immediately after an unsubscribe.
When a legal duty or a relevant claim requires longer retention, the information is restricted to that purpose. We delete or genuinely anonymize personal data when its retention is no longer justified. You can ask us for information about the retention applicable to your particular request.
8. Cookies and similar technologies
Cookies are files stored by your browser. Local storage, pixels and related technologies can also store or access device information or communicate information about an interaction.
Necessary functions and consent records
Necessary technologies support essential form/page operation, security and remembering your privacy choices. They are used without optional consent only where the applicable necessary-function exception is met. A technology does not become necessary simply because it is useful for reporting or marketing.
HubSpot's consent controls can use __hs_opt_out, __hs_do_not_track and __hs_cookie_cat_pref to remember choices and restrictions, with standard lifetimes of six months. __hs_initial_opt_in can be used to manage the initial consent state, with a standard lifetime of seven days. These are first-party consent-related technologies, not permission to run optional analytics.
Security components serving HubSpot pages/forms can use Cloudflare cookies such as __cf_bm, with a standard lifetime of 30 minutes, and __cfruid or __cfuvid, which normally expire at the end of the session. Their function is bot/rate-limit protection. They are limited to the applicable security purpose and domain involved in serving the requested content.
Optional analytics
Google Analytics 4 can use first-party _ga and _ga_-prefixed cookies to distinguish users and maintain session state. Google documents a default expiry of two years, which can refresh on a return visit depending on the configured cookie behavior. These browser-cookie periods are distinct from the two-month GA4 event/user-data retention described above.
Optional advertising measurement
Google Ads measurement can use first-party _gcl_aw and _gcl_au cookies for permitted advertising attribution and conversion measurement. Google's standard reference gives a lifetime of 90 days for these cookies. They are controlled by advertising-measurement consent, not treated as necessary for a PDF request.
HubSpot and Google cookies can be associated with the relevant digital.nemko.com or nemko.com domain; security/form components can involve the HubSpot-hosted form or service domain. The exact applicable scope is available through your browser's cookie information. A saved domain-wide preference can also affect pages outside this campaign; those pages remain subject to their own applicable notices.
The names and lifetimes above describe provider-documented cookie examples and default periods. Which cookies are set depends on the applicable service settings, page or form and your consent choices. Browser restrictions can also change their effective lifetime. Cookie settings identifies the enabled services and applicable configured storage periods; provider defaults are not a substitute for those details. Further information is available in HubSpot's visitor-cookie documentation and Google's measurement-cookie reference.
Before consent and after rejection
The campaign uses basic consent blocking: Google analytics/advertising tags remain blocked until you give the relevant consent. If you reject optional tracking, those optional tags do not send analytics or advertising measurements from these campaign pages. We do not use advanced denied-state cookieless measurements as an alternative to your refusal. HubSpot website analytics remains disabled.
Necessary page/form delivery, security and recording your choices still take place. Rejecting optional tracking does not mean that no information at all is processed, and it does not prevent you from requesting a resource.
Changing your choices
Use Cookie settings, available on the campaign pages, to review or change optional choices. Analytics and advertising measurement are off until selected. Rejecting optional purposes is as straightforward as accepting them.
Withdrawing tracking consent stops future processing that depends on that consent. It does not make earlier lawful processing unlawful or automatically erase information retained for another valid purpose. You can request erasure separately using the privacy contact above.
You can also manage browser cookies and Google account advertising settings. Clearing browser storage can remove a saved choice and cause the banner to appear again. Those controls do not replace the choices we provide on these campaign pages.
9. Your data-protection rights
Where GDPR applies, and subject to the conditions for each right, you can ask for access to your personal data, correction of inaccurate information, erasure or restriction of processing. You can object to processing based on legitimate interests, including related profiling.
You can object at any time to use of your data for direct marketing, including profiling related to that marketing; we will stop that use. You can withdraw consent without affecting the lawfulness of earlier processing. You can also request a portable copy of information you supplied where processing is automated and based on consent or a contract.
Contact personaldata@nemko.com to make a request. We can ask for proportionate information to verify identity where needed to protect your data. We respond without undue delay and ordinarily within one month. If the law permits extra time because of the complexity or number of requests, we explain the extension within the initial month.
You can complain to a competent data-protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. In the Netherlands, information is available from the Autoriteit Persoonsgegevens. Contacting us first is welcome but does not remove your right to complain to an authority.
10. Automation and security
We use automation to manage resource requests, record choices and select the resource-specific follow-up schedule, subject to consent and suppression rules. We use the resource and professional context you provide to keep an eligible follow-up relevant. These processes do not assess or determine whether your products comply with the CRA.
We apply appropriate technical and organizational safeguards, taking account of the purpose and risk. Access is limited to personnel and service providers who need information for an authorized purpose. No internet service can guarantee absolute security. Please use the contact details above for a campaign-related privacy or security concern.
11. Using the resources
General information and limits
The resources provide general information to support planning and discussion about the EU Cyber Resilience Act. They are not legal advice, a product-specific compliance assessment, certification, regulator approval or a guarantee that a product or organization complies with the law.
Completing a checklist or following a roadmap does not, by itself, establish conformity or fulfill every applicable obligation. Assess the legislation, product characteristics, organizational responsibilities and current official guidance relevant to your activities. Obtain product-specific professional or legal advice where needed.
Versions and changes
Resources reflect their stated publication or review date. Legislation, implementation arrangements, standards and guidance can change. Verify current official requirements and applicable dates before relying on a resource for a decision. An Article 14 checklist does not determine whether a particular event triggers a reporting duty or whether a proposed report satisfies it.
An earlier copy can remain outdated after an updated version is issued. Downloading a resource does not create a duty for us to monitor your products, assess incidents or send every future update.
Permitted use and rights
You may download and use each resource for the professional planning and discussion described on its resource page. The roadmap and Article 14 checklist may be used with your team as described on their resource pages. Keep applicable source, copyright notices and material qualifications intact.
The resources and any third-party materials remain subject to the rights of their respective holders. Downloading them does not transfer ownership of those rights. Do not claim authorship or imply that Nemko has endorsed, certified or approved your product or organization. For a use not addressed on the resource page or in the resource itself, contact digital@nemko.com. Permissions available under applicable law remain unaffected.
Professional services
The resources are supplied without a purchase charge. They do not create a consultancy engagement or certification contract. Any professional service requires a separate agreement defining its scope, deliverables and responsibilities.
You remain responsible for decisions based on the materials. Nothing in this notice excludes or restricts liability or rights that cannot lawfully be excluded or restricted. Separate signed terms govern an agreed professional engagement.
For a broken download, suspected error or permission enquiry, contact digital@nemko.com and identify the resource and version concerned.
12. Changes and contact
We will publish changes on this page and update the date above. Where a change requires new consent or a specific communication, we will obtain that consent or provide the communication before the new processing as required. A revision does not override an existing unsubscribe or tracking choice.
For questions about this notice, contact personaldata@nemko.com.