Privacy Policy

When you are in contact with us, it may be necessary for us to process personal data about you. We care about your privacy and take this seriously, and here you can read more about how we handle your information and what rights you have. 1. Who is responsible for the processing? Norwegian Group is responsible for your personal data when you are in contact with us. Each individual company in the group is also responsible for information processed when you are in contact with that specific company. Our contact information is: Org. no.: 825 829 202 Address: Hamnegata 21B, 6100 Volda Email: [email protected] Phone: +47 70 07 60 07 Norwegian Group consists of several business areas. For some of these there may be separate websites and services that require additional explanations beyond what is stated in this privacy statement. In such cases, separate privacy statements will be issued in addition to this one. You will be informed if this applies. 2. How we process personal data What personal data we collect, why we do it, and the legal basis for processing it will vary depending on the relationship we have with you and how you interact with us. Here is an overview of how we process personal data in different situations. We do not use any form of profiling or fully automated processing of your data. 2.1 If you contact us When you contact us, either via media, through the contact form on our website, or in other ways, we may process personal data about you. This may typically be information such as name, email address, and other relevant information you provide to us in order for us to be able to respond to your inquiry. We process your information because we are interested in being able to respond to your inquiry in the best possible way. 2.2 Our business activities It may be necessary for us to process personal data about you if you are employed by one of our partners, suppliers, customers, or if we contact you regarding investments or financing. Typically, this will be contact information such as name, email and telephone number, as well as information about where you work and what position you hold. We also process other information that you provide to us or that becomes relevant during our contact, to the extent necessary. The basis for this processing is our legitimate interest in performing tasks related to our business, for example by cooperating with your employer. 2.3 Legal obligations We are required by law to process personal data in certain situations, such as to comply with tax, accounting or legal requirements. This may mean that we must process personal data about you, for example if your name is on an invoice or contract that we are required to keep. The legal basis for the processing is the legal obligation to which we are subject. The data will be deleted when we have fulfilled the purpose of the processing, for example when the reporting obligation has been fulfilled or we are no longer required to retain the data. 2.4 Due diligence When evaluating potential business partners, we may conduct a due diligence process (company review). This involves obtaining information such as self-declarations, confidentiality agreements, and conducting background checks and security assessments of employees of the company in question. In connection with the due diligence process, we may also process personal data such as name, gender, age, position, and publicly available information that we believe is necessary to conduct the review. The basis for processing this personal data is our legitimate interest in verifying business partners and ensuring a necessary level of quality and security in our processes, services and deliveries. If the processing requires more than our legitimate interest can justify, we will obtain your consent. 2.5 When applying for a position When you apply for a job with us, we collect your personal data such as your name, contact information, experience and possibly a photo. Later in the recruitment process, we also collect information about your country of residence, work and residence permit, salary information and the references you provide to us and what they choose to share with us. The purpose of the processing is to assess you for employment with us. Our basis for processing the personal data is that this is necessary for us to be able to enter into a possible agreement with you for permanent or temporary employment. If you are not hired, we will delete your personal data after the employment has been made, and at the latest within three months. If we wish to keep your CV for future positions, we will ask for your consent to this. In that case, your data will be stored in our systems for up to 3 years. 3. Sharing of personal data 3.1. Data processors Your personal data will be available to our suppliers who process it on our behalf. To ensure your rights, an agreement will be entered into with our suppliers which, among other things, means that your personal data cannot be used for other purposes. Our suppliers must also agree with their own subcontractors to ensure that they follow the same rules. Some of our suppliers are located in countries outside the EU/EEA. This means that personal data may be transferred to or is available from a country with regulations that do not provide the same level of protection of personal data compared to the rules in Norway. To protect your privacy, we will ensure that the transfer takes place in accordance with applicable data protection legislation, for example by using the EU's standard contracts for international transfers or adapting the contract to Norwegian requirements. 3.2 Other third parties We do not share your personal information with others without a lawful basis. This may be your consent or a law that requires or permits disclosure of the information. If we need to share your information with third parties in countries outside the EU/EEA, we will ensure that this is done in accordance with applicable data protection laws to protect your privacy. 3.3 Other Companies in Norwegian Group We collaborate with other companies in the Norwegian Group and from time to time it may be necessary to share personal data with them. This may be necessary to fulfill your request, because we collaborate to provide a service or because we share IT systems. 3.4 Website cookies To manage cookies and similar technologies (tracking pixels, web beacons, etc.) and associated consents, we use the consent tool "Real Cookie Banner". You can read more about how the "Real Cookie Banner" works at https://devowl.io/rcb/data-processing/. The legal basis for the processing of personal data in this context is Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of used cookies and similar technologies as well as the associated consents. Providing personal data is neither a contractual requirement nor necessary to enter into a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents. 4. Securing our IT services and solutions Norwegian Group's IT services are based on a hybrid model with both on-premise and cloud solutions. 5. Deletion of personal data We delete personal data when it is no longer necessary to fulfill the purpose for which it was collected. We determine the retention period based on an assessment of the purpose of the processing, statutory retention periods, risk of potential legal disputes, limitation periods and business needs. If the processing is based on your consent, we will delete the personal data if you withdraw your consent, unless there is another valid basis for continuing to process the personal data. 6. Your rights You have the right to request access to, rectification of or deletion of the personal data we hold about you, with certain exceptions. You can also request restriction of processing, object to processing, and in certain cases request that the data be transferred to another party. If we process your data based on your consent, consent is voluntary and you can withdraw it at any time. You can read more about the content of your rights and when they apply on the Data Protection Authority's website: www.datatilsynet.no. Please note that we may be obliged to retain certain information due to legal requirements, such as the Accounting and Bookkeeping Act, or to protect the privacy rights of others. If you wish to exercise your rights, please contact us as described under "contact information". 6.1 Complaint about processing of information If you believe that we are processing your personal data incorrectly, we encourage you to contact us so that we can clarify any misunderstandings and consider your objections. If we do not reach an agreement, you have the right to complain to the Norwegian Data Protection Authority. You can find more information at www.datatilsynet.no. 7. Contact information If you have questions, comments, wish to exercise your rights or complain about the processing of your information, you can contact us via email at [email protected]. 8. Changes to the Privacy Policy We update our privacy policy when there are changes to how we process personal data. You will always find the latest version of our privacy policy on our website, www.nog.no.