Who we are. This form is operated by Vinterstrom OÜ, operating as NERMO (registry code 17505744, registered address Tornimäe tn 5, 10145, Tallinn linn, Harju maakond, Estonia) — the controller of the personal data you submit here. Privacy contact: privacy@nermo.io.

What we collect. Your company’s details and legal identifiers (legal name, legal entity type, country, registered address, registration and VAT/tax numbers, website, year established); your primary contact’s name, role, work email and phone; your declared port coverage, categories and capabilities; your certification declarations; the names and roles of your company’s beneficial owners and directors (date of birth and nationality are optional — providing them makes screening more accurate and reduces false matches); and your acceptance of the supplier terms (with the version accepted). You will not upload documents or enter banking details on this form — those are provided later, inside the Vendor Portal, during vetting.

Why we collect it. (1) To assess your application to join the NERMO vendor network — steps taken at your request prior to a contract (Art. 6(1)(b) GDPR). (2) To vet your company: this includes sanctions and KYC screening. We check your company and the named individuals — beneficial owners, directors and your contact person — against applicable sanctions and watchlists (including OFAC, EU and UK consolidated lists) and politically-exposed-person databases. Screening is automated-first, but any potential match is reviewed by a NERMO compliance person before any decision is made — no application is declined without human involvement (Art. 6(1)(c) legal obligation and/or Art. 6(1)(f) legitimate interest in sanctions compliance). (3) To operate anti-abuse controls on this public form (rate limits and a CAPTCHA challenge) — legitimate interest.

How long we keep it. If your application is declined or expires, the identifying personal data in it — including the beneficial-owner and director records and the application snapshot — is purged 90 days after the decision. A minimal record of the decision and the screening event log are retained as compliance records. If you are accepted into vetting and activated, the data becomes part of your vendor account and is kept for the life of the relationship plus statutory record-keeping periods (see the full policy, §9).

Tracking your application. On submission you receive a reference (NER-V-…). You can check your application’s status using that reference; the status check returns only a coarse status and never screening detail.

Your rights. You have the rights of access, rectification, erasure, restriction, portability and objection described in our privacy policy, and the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or your local EU supervisory authority. We may be legally required to retain screening and decision records even if you ask us to delete your data.

Full details: NERMO Privacy Policy · Cookie preferences