Privacy statement

Pensius is operated by Noorlander Technologies.

1. Who we are

Pensius is a platform for reconciling US tax refunds. It is operated by Noorlander Technologies, a sole proprietorship established in the Netherlands.

Contact for privacy questions: Contact address follows.
Establishment address: Establishment address follows.

When Pensius processes data for a client institution, such as a pension fund or its administrator, that institution is the controller and Noorlander Technologies is the processor under a data processing agreement. Where Pensius decides purpose and means itself, as in account administration, it is the controller.

2. What we process, and why

Account and access data: Names, initials, role and hashed passwords of the users your organisation creates, to sign people in and to record who did what. Legal basis: legitimate interest and contract.
Operational tax data: Cases, cheques, allocations, withholding lines, documents and audit events that you enter or upload, to provide the reconciliation service. Legal basis: the contract with the controlling institution.
Security and audit records: Sign-in events, rule changes and a keyed audit trail, to keep the record trustworthy and to detect misuse. Legal basis: legitimate interest and legal obligation.

Pensius does not sell personal data and does not use it for advertising. It runs no analytics and no third-party trackers.

3. How we protect it

Passwords are stored only as Argon2 hashes, and API tokens only as hashes.
A sign-in is a session held on the server. The cookie carries only a random token and is HttpOnly and SameSite. The server keeps no IP address and no browser details with a session.
A session ends after 15 minutes without activity, after 12 hours at most, at sign-out, and after a new password or a deactivation.
An organisation can require two-step verification per role.
Access follows roles, each organisation's rows are isolated from every other organisation, and stored documents are encrypted with a key per organisation.
Every change is recorded in a keyed audit trail that shows when a record was altered or removed.
Transport is HTTPS with HSTS, with a strict content security policy and a limit on sign-in attempts.

The current, factual list of controls is on the page Trust and security.

4. Sub-processors and location

The hosting provider for production has not been chosen yet. This statement will name it, and any other sub-processor, before the product holds real data. The product sends no data to another party by itself.

The demonstration environment holds synthetic data only.

5. Retention

Documents are kept for a period per document type, counted from the day a document was received. The controlling institution sets these periods. As shipped they are:

10 years: Filed return (claim form)
7 years: K-1 federal, K-1 state, Schedule K-3, Payment voucher, Refund cheque copy
5 years: every other document type

Nothing is deleted because its period has passed. Deleting a document takes an administrator who asks and a second person who approves, and a legal hold stops it.

The security log is kept until the institution picks a period of 90, 180 or 365 days. An automatic backup is kept for 30 days. The financial audit trail is never removed.

6. Your rights

Under the GDPR you may ask for access, rectification, erasure, restriction or portability, and you may object to processing. Where Pensius is the processor, we pass such a request to the controlling institution.

You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Last revised 12-10-2026.