Privacy statement for Norway Consulting AS

Version 2 · last changed 14 October 2026

This is an English translation of the Norwegian personvernerklæring. Where the two differ, the Norwegian text governs.

Norway Consulting AS will process personal data in connection with our business operations. We are committed to processing personal data in a secure and lawful manner.

Our processing of personal data is based on the business we conduct and the purpose of our operations, which is to place IT consultants in assignments with our clients. Information about the personal data we process, the lawful basis for processing, the purpose of processing, the retention periods, and related matters can be found below.

We may also process personal data in ways other than those described below, but in such cases we will inform the data subjects concerned through means other than this statement.

If you have any questions or would like to know more about our processing of personal data, please contact us – see contact details below.

In brief

• We place IT consultants. We therefore process information about consultants, vendors, contact persons at clients, and candidates for positions.
• Consultants and contact persons at vendors: we retain the data for as long as you are relevant, and delete it no later than six years after your last contact with us.
• Contact persons at clients: no later than three years after last contact, or six years where the organisation has requested or purchased consultants through us.
• Candidates for permanent positions: twelve months after the position has been filled, unless you have asked to remain in our network.
• We use AI as a tool. A person always makes the decisions. You may object to AI processing and still continue to work with us — please notify us at post@norway-consulting.no or when you are in contact with us.
• Your data is stored and processed within the EU, including when we use AI. Some of our vendors are based in the United States, and in certain cases data may be processed there. Any such transfer takes place on a lawful transfer basis — see the section on transfers to countries outside the EEA.
• You have the right to access, rectify, download, or erase your data. Write to post@norway-consulting.no. The remainder of this statement explains the details.

Controller

Norway Consulting AS is the data controller, i.e. determines the purposes and means of processing the personal data covered by the processing activities described below.

Contact details for the controller:
Norway Consulting AS
Address: Apotekergata 10B, 0180 Oslo
Organisation number: 917 616 647
Email: post@norway-consulting.no
Telephone: +47 22 17 00 00

Processing of personal data

We collect and use personal data for various purposes depending on who you are and how we come into contact with you.

All processing of personal data shall be carried out in accordance with the applicable data protection rules in force at any given time, including the Personal Data Act and the General Data Protection Regulation (GDPR).

Personal data means any information relating to an identified or identifiable natural person. The natural person to whom the data relates is referred to as the 'data subject'.

Processing of personal data means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, transmission, or erasure.

The following sets out the processing activities we carry out as controller in our business.

Consultants

We process personal data about independent consultants and consultants employed by consultancy firms in order to identify and offer relevant assignments, present consultants to clients, prepare proposals for clients, and enter into and follow up agreements concerning assignments. We also send tips about assignments that may be suitable for you, by email, telephone, or via the consultant portal. This forms part of the placement service, and you may at any time ask us to stop sending you assignment tips.

In this connection, we process the following personal data:

• Name and contact details, such as email address, telephone number, and place of residence
• CV, competencies, experience, education, certifications, and references
• Availability, assignment preferences, hourly rate, and rate expectations
• Which assignments you have been considered for or presented to, and your history of collaboration with us
• Communications with us and notes from conversations
• The company, if any, through which you provide your services

Where you have asked us to find assignments for you, registered with us, or submitted your CV to us, the processing is based on its being necessary in order to take steps at your request prior to entering into a contract and to perform the contract with you (GDPR Article 6(1)(b)).

Where we have become aware of you through publicly available sources, such as LinkedIn and websites, or because others have referred you to us, the processing is based on our having a necessary legitimate interest in contacting consultants who may be suitable for assignments (GDPR Article 6(1)(f)). In such cases we process only information about your professional profile and contact details, and we inform you of the processing no later than when we first contact you. We have assessed that our legitimate interest outweighs the privacy interests of the data subject, given that the information is professional in nature and has been made available in a professional context, and that you may at any time ask us to cease processing it.

Data is collected from you, from publicly available sources such as LinkedIn and websites, from others who refer you to us, and from clients who provide us with feedback on assignments you have carried out.

When you are being considered for an assignment, we provide your CV and relevant information about you to the client or partner to whom the assignment relates.

We ask that you do not provide us with special categories of personal data, such as information relating to health, religion, political opinions, or trade union membership, or any other information that is not relevant to assignments. Should we receive such data, we will not record it and will delete it. Our tools are configured to prevent such data from being extracted from a CV and included in your profile. Errors may nonetheless occur.

We process your personal data for as long as you are a candidate for assignments with us. Data relating to consultants with whom we have had no contact for six years will be deleted, or anonymised where records of assignments and agreements must be retained under the Bookkeeping Act. The period is calculated from the last contact initiated by you, for example that you have replied to us, updated your CV or profile, logged into the portal, applied for an assignment, or been on an assignment through us. Where we have entered into an agreement with you or your company, the agreement and the data relating to the assignment will be retained for as long as is necessary to document the contractual relationship and to comply with the requirements of the Bookkeeping Act (GDPR Article 6(1)(c)). The same applies to contact persons at vendors and partners from whom we source consultants: we retain their data for up to six years after the last contact initiated by that person.

Use of artificial intelligence

We use artificial intelligence (AI) based tools within our system to assist in the work of placing consultants. AI is used to search through CVs and profiles to identify consultants who may be suitable for an assignment, to draft proposals and CVs tailored to individual assignments, and to summarise and structure communications and notes. AI is also used to read the CV you upload and suggest how your profile may be completed; the suggestion is presented to you or to a member of staff, who accepts or rejects it.

AI is used solely as a support tool. There is always a person at our organisation who assesses which consultants are suitable and who reviews proposals and CVs before they are sent to the client. AI is not used to evaluate or rank consultants independently, and we make no decisions about you that are based solely on automated processing.

When you apply for an assignment, AI may compile your responses and CV against the requirements of the assignment as an aid for the member of staff handling the application. The compilation does not constitute a decision; a person reads your application and determines whether you are presented.

The use of AI is carried out on the same legal basis as the processing of personal data otherwise, as described above in relation to consultants and below in relation to clients and partners (GDPR Article 6(1)(b) or (f)). We have assessed that the use of AI as a working tool is compatible with the purposes for which the data was collected, and that our legitimate interest in operating the placement process efficiently outweighs the impact on your privacy, given that AI is used only as a support tool and a person always makes the assessments.

The AI services are provided by vendors who process personal data on our behalf as processors. They do not use the data to train their own models and do not retain content beyond what is required to process the request; in certain cases, content may be stored for a short period for misuse monitoring before being deleted. AI processing takes place within the EU, subject to the exceptions described below regarding transfers to countries outside the EEA.

If you do not wish your personal data to be processed using AI, you may inform us accordingly. Your data will then be stored in a part of the system that the AI tools cannot access. You may also select this option when you register or apply for an assignment. If you opt out, we will continue to work with you in the usual manner and to the best of our ability. Some tasks may take longer. Our system is designed to keep opted-out data outside the AI tools. Errors may nonetheless occur, both technical and human. Should this happen, we will correct the error as soon as we become aware of it and ensure that no decision about you is based on it.

The consultant portal

If you register in our consultant and vendor portal, we process your name, email address, and any other information you enter, as well as login history and technical logs. Login is carried out via a one-time link sent to your email address.

Personal data is processed in order to perform the agreement with you so that you can use the portal (GDPR Article 6(1)(b)). We also process technical logs and security logs on security grounds, as we have a legitimate interest in securing our systems and preventing misuse (GDPR Article 6(1)(f) and Article 32). Forms on the website and in the portal are protected against automated misuse by a service that processes IP addresses and technical information about the browser.

Your account in the portal is your profile with us and is subject to the retention period described under 'Consultants'. When you log in, update your profile, or apply for an assignment, this is counted as contact. Within the portal, you can correct your own data, opt out of AI processing, and request to be removed from the network, and you may request a copy of the data you have provided to us.

Communication and contact

We process personal data about those who contact us in order to respond to and document communications and to make contact with others. This applies to all forms of communication, physical and digital, written and verbal.

In such cases, we process name, telephone number, email address, and any personal data that may accompany the enquiry, including history and logs relating to the enquiry.

The processing of personal data is based on our having a necessary legitimate interest in processing personal data in connection with the above (see GDPR Article 6(1)(f)). We have therefore assessed that our legitimate interest in maintaining contact with the outside world is part of our business activities and in documenting those activities, as well as in responding to those who contact us and recording such contact. We have assessed that this is necessary for us to handle the enquiries we receive and that the data subjects' privacy interests do not override these interests.

Providing us with personal data is voluntary, but it will be necessary for us to receive the data in order to respond to enquiries.

We process the information until we consider that there will be no further follow-up on the contact, normally for one year. This applies to enquiries from persons other than consultants and clients; for those individuals, the retention periods set out in the sections on consultants and clients apply.

Email

We use email as a communication solution which contains personal data. The processing is based on our having a necessary legitimate interest in processing personal data via email (see GDPR Article 6(1)(f)) in order to have a working tool and communication solution, and that the data subjects' privacy interests do not override these interests. The personal data processed in emails depends on the purpose of the email and its content. Emails are deleted no later than six years after they were sent or received. Emails that document an agreement or a dispute are retained for as long as is necessary to document the agreement or to handle the dispute.

Information and marketing

If you subscribe to our newsletter, or if you are a consultant or contact person at a client or partner, we may send newsletters and information about our services and available consultants. In such cases, we will process your email address and any information you provide to us in this context.

We process personal data in order to inform you of services that may be of interest to you, on the basis of our legitimate interest in marketing our services (GDPR Article 6(1)(f)). We only send marketing emails to you where you have consented to this, or where it is otherwise permitted under section 15 of the Marketing Control Act, for example within an existing client relationship. Where we contact you in your capacity as a contact person within an organisation and the communication relates to services relevant to your role, we regard this as communication addressed to the organisation. You may nonetheless at any time request that we cease such communications. You may unsubscribe at any time by using the unsubscribe option in communications you receive, or opt out of direct marketing under GDPR Article 21(2) by contacting us.

We process only the personal data required to carry out the mailing, namely email address and name to make the communication more personal and to ensure that the mailing reaches the correct person. Data you have provided solely to receive the newsletter is used only for the newsletter and other information about our services, such as available consultants.

Processing continues until you have unsubscribed. Your data provided for the newsletter will then be deleted, but we will retain a record of your opt-out so that we do not send you further mailings. Unsubscribing from the newsletter does not affect a client relationship or a registration as a consultant; those are governed by their respective sections.

Information about services

We may also send out information about our services that does not contain marketing. Personal data will in such cases be processed on the basis that we are either fulfilling a contract with you (GDPR Article 6(1)(b)) or our legitimate interest in informing our contacts about our services (GDPR Article 6(1)(f)). The purpose of the processing is to keep you updated on the services you receive. The processing of personal data will take place for as long as you receive our services.

Existing and potential clients, vendors and partners etc.

We process personal data about contact persons at existing and potential clients (in business relationships), vendors and other partners for sales and marketing activities, to administer our relationship with vendors and others, to prepare, carry out and document services, and to evaluate the use of services. In these cases we will process names, contact information, company names and information related to the contact with the company in which the individual is employed.

The processing of personal data is based on our necessary legitimate interest (GDPR Article 6(1)(f)) in administering our relationships with clients, partners and vendors, and that our interest outweighs the privacy interests of the individual.

We also store and disclose information where we have a legal obligation to do so, for example under accounting and tax legislation.

Information is stored and processed for as long as it is necessary, for example to document matters relating to services.

In many cases it will be necessary for us to obtain personal data in order to enter into agreements with clients and vendors, including to document that an agreement has been concluded. If we do not receive the information we require, we will be unable to enter into agreements.

It is voluntary for contact persons whether they wish to provide us with personal data. Where we collect personal data from other sources, this will primarily concern contact details (including name, address, telephone number and email address), job title, function and employer, as well as any competencies and references where relevant. The source of such information will be the contact person's employer, for example from the employer's website, and publicly available sources such as LinkedIn, the Brønnøysund Register Centre and advertisements for assignments and positions. In some cases we obtain references from others in order to assess the suitability of vendors and partners.

We store information about a contact person for as long as that individual is a contact person for us, and delete it no later than three years after the last contact from that individual. Where the organisation has purchased services through us, asked us to find consultants for an assignment, or received an offer or tender response from us in reply to its enquiry or advertisement, we retain the contact person for up to six years after the last contact or last assignment, subject to the exceptions mentioned above. If the contact person leaves the organisation, the registration with that organisation is closed; information about the collaboration is retained linked to the organisation without a name. If the individual joins another organisation that may be of relevance to us, we may register that individual there as a new contact and will inform them of the processing upon first contact.

Contact persons at organisations with which we do not have a client relationship are registered only with their name, role, contact details and organisation, in order to be able to make contact regarding a possible collaboration. The information is deleted no later than 12 months after registration if no dialogue is established. If you respond to us, you will from that point be regarded as a contact person at a potential client, and the paragraph above applies.

Recruitment

In connection with recruitment for new positions at our company or at our clients, we will among other things process personal data in relation to CVs, applications, references, notes from interviews, results from reference checks, etc.

Where the recruitment concerns a position at a client, we provide the application and relevant information to the client, who is itself the controller for its own processing of that information.

The legal basis for processing personal data in connection with recruitment is that the processing is necessary in order to take steps prior to entering into an employment contract with the job applicant (GDPR Article 6(1)(b)).

Where we conduct enquiries beyond contacting individuals listed as references, carrying out searches into background and history etc., personal data is processed on the basis of our necessary legitimate interest in ensuring that the right candidate is selected for the position (GDPR Article 6(1)(f)). With regard to the latter, we have assessed that our legitimate interest in recruiting new employees outweighs the privacy interests of the individual. We ask you not to include special categories of personal data, such as health information, religion, political opinions or trade union membership, in your application.

If we nevertheless receive special categories of personal data, we do not record them. Errors may occur.

Personal data collected in connection with recruitment for positions at our company is deleted no later than twelve months after the recruitment process has been completed, unless you have asked us to retain it for future positions or assignments. If you apply for a position at a client through us, the application is deleted no later than twelve months after the recruitment process has been completed, unless you have asked to be registered for assignments with us, in which case the information is processed in the same manner and subject to the same retention period as information about consultants, as described above. You may ask us to delete your information at any time.

When you apply for a position at a client, you may tick a box to indicate that you also wish to be considered for consultant assignments and to be added to our network. You may change your mind at a later stage.

Social media

We engage with interested parties and others through social media. Among other things, we have pages on LinkedIn and Facebook, where we are jointly responsible for the processing of personal data in this context together with the social media platform.

We also have accounts on other social media platforms. Through these, personal data will be processed if you comment on posts or "like"/follow us/our page. Our purpose in processing personal data through social media is to maintain contact with those who wish to communicate with us or interact with us in other ways; see also the section on communication and contact above.

In this context, your name is processed along with links to other information you have published on the social media platform in connection with your name/account on that platform. In addition, everything you share through posts and comments in connection with us on the social media platform is processed, as well as the fact that you have "liked"/are following us. What you share on the social media platform is up to you and is voluntary.

If you share personal data in posts or comments in connection with us on the social media platform, and in particular personal data about others, for example by "tagging" or mentioning individuals, this is your responsibility as a user of the social media platform.

We process personal data on social media on the basis that we consider ourselves to have a necessary legitimate interest in communicating with the outside world through social media and will process personal data in this context accordingly (GDPR Article 6(1)(f)). We have assessed that this is necessary for us in order to communicate with the outside world and handle enquiries we receive, and that the privacy interests of data subjects do not override these interests.

The data will be processed for as long as the posts/comments are available on the social media platform, and you may delete them yourself at any time. This applies only on the social media platform; a profile you hold with us as a consultant or contact person is not affected by what you delete there.

Use of websites and cookies etc.

Cookies and similar technologies are used on the websites and in the portal. Some are necessary for the pages to function; others are used only if you consent.

Necessary cookies are processed on the basis of our legitimate interest in delivering and securing the service (GDPR Article 6(1)(f), the Electronic Communications Act § 3-15). Cookies for analytics and marketing are set only following consent given in a banner the first time you visit the pages (GDPR Article 6(1)(a)), and you may at any time change or withdraw your consent in the banner or via the link at the bottom of the page. Information collected in this manner is used to understand how the pages are used and to improve them, and is transferred to the provider of the tool.

We use the following cookies etc.:

Processing on the basis of consent

Where we process personal data on the basis of your consent, as described above, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Please contact us if you wish to withdraw your consent. Please note that if you withdraw your consent, we may still be able to continue processing all or part of the data if another legal basis for the processing exists.

Retention and storage (erasure) of personal data

We retain personal data for as long as is necessary for the purpose for which the personal data were collected, and delete the data in accordance with the requirements of applicable legislation. The length of time for which we retain personal data varies depending on how the data were obtained and the purpose for which they were obtained.

When we delete the data is either set out above where the individual processing activities are described, or the retention period is based on the following criteria:

• Whether we have a legal or contractual need to retain the data, such as where claims may be brought against us
• Whether the data are necessary for our business
• Where the legal basis for processing is consent, when consent is withdrawn.

When we no longer have an ongoing legitimate need to process your personal data, they are deleted or anonymised as promptly as possible in accordance with applicable law.

Instead of deleting personal data, it may in certain cases be appropriate to anonymise the personal data. Anonymisation means that all identifying or potentially identifying attributes are removed from datasets that are retained. Information about assignments and agreements that we are required to retain under the Bookkeeping Act is retained without the individual's name beyond what the agreement requires.

If you request erasure, or opt out of being contacted, we retain only the record that you have made such a request, so that we do not register or contact you again.

Backups of our system are retained for up to twelve months and are used solely for recovery following a failure.

This means, for example, that personal data we process on the basis of your consent are deleted if you withdraw your consent. Personal data we process in order to fulfil a contract with you are deleted when the contract has been performed and all obligations arising from the contractual relationship have been fulfilled, such as statutory obligations relating to accounting, follow-up of the customer relationship in connection with complaints, etc. Personal data we process as a result of a statutory obligation will be deleted as soon as we are no longer required to retain the data.

Transfer or disclosure of personal data

We do not pass personal data on to others in cases other than those referred to in this statement and unless a lawful basis for doing so exists. Examples of such a basis will typically be an agreement with or consent from the data subject, or a statutory obligation requiring us to disclose the information. The latter applies to public bodies such as tax collection authorities (where necessary), accountant/auditor, and others whom we require in the course of our business such as our bank.

We use processors to collect, store or otherwise process personal data on our behalf. In such cases, we have entered into agreements to safeguard your rights and the security of your personal data at every stage of the processing.

Recipients of personal data are:

• Clients and partners relevant to the assignment, when consultants are presented for assignments or candidates for positions
• Accountant and auditor
• Vendors of operation and storage of our system, backup, AI services, sending of email from the system, email and office support, protection of websites and forms against misuse, and collection and structuring of information from publicly available sources
• Public authorities, where we are required to do so by law

Where required by law or where there is suspicion that a criminal offence has been committed in connection with the use of our services, personal data we have stored about you may be disclosed to public authorities, such as the police in the course of an investigation.

Where personal data may be subject to transfer to another organisation in connection with a merger, financing, reorganisation or dissolution transaction involving all or part of us, we will only do so where the parties involved have entered into an agreement under which the collection, use and sharing of the personal data is limited to the purposes relating to the transaction, including a provision regarding whether the transaction is to proceed or not, and the personal data shall be used by the parties involved solely to carry out and complete the transaction. If another company acquires us or our business or assets, that company will have access to the personal data collected by us, and will assume the rights and obligations regarding your personal data as described in this privacy notice.

Transfer of personal data to recipients in countries outside the EEA

It is our objective that all processing of personal data shall take place within the EEA; however, we may use vendors or process personal data outside the EEA. In such cases, transfers and processing outside the EEA (third countries) will take place in countries approved by the European Commission or in accordance with a valid legal basis for the transfer of personal data under Chapter V of the GDPR. Where transfers are not made to countries approved by the European Commission, transfers will only take place subject to the safeguards set out in Article 46(2) of the GDPR. You may obtain information about the basis used for any transfer by contacting us.

Our system and the AI processing of your data run within the EU. Some of our vendors — including providers of AI services and email distribution, protection of forms against misuse, and collection of information from publicly available sources, as well as certain tools used for operations and development — may process data in the USA.

Information about the basis for the transfer may be obtained by contacting us.

Links to third parties/other websites

Our websites may contain links to other websites or third parties offering products or services, and to other locations not under our control. These links are provided solely as a convenience to enable users to obtain further information. Websites that do not form part of our own — i.e. those not hosted under the address norway-consulting.no — will process personal data as independent controllers and may have separate and independent privacy policies. We accept no responsibility for the content and activities of those websites.

Security of processing

We place a high priority on the security of personal data in our operations and will implement all required technical and organisational measures to protect your personal data.

We handle information in a manner that ensures it is accurate, accessible, and managed in accordance with the sensitivity of the data. We also employ a range of security technologies and information security procedures to protect personal data from unauthorised access, use, or disclosure. Risk assessments are carried out in respect of the processing of personal data.

We have entered into data processing agreements with all of our vendors that process personal data, under which they assume the same standard of security as we apply to our own processing of personal data.

We restrict access to personal data to those members of staff or third parties who are required to process the data on our behalf. These parties are subject to a duty of confidentiality. Access to our system is personal, and changes to data are recorded.

Procedures have been established for handling information security incidents and breaches (personal data breaches), and where a breach occurs that gives rise to a risk to the privacy of the data subjects concerned, we will notify the Norwegian Data Protection Authority (Datatilsynet) as quickly as possible and no later than 72 hours after the breach was discovered. Where the breach is likely to result in a high risk to the privacy of those affected, we will also notify those individuals.

We do our utmost to keep your data secure, but no system is completely secure. An objection to AI processing applies to the tools we ourselves use on the data you have provided to us; it does not prevent information you have made publicly available yourself — for example on LinkedIn — from forming part of public sources that we and others access.

Your rights when we process personal data about you

Set out below are your rights in relation to the processing of personal data. To exercise your rights, you must contact us — see the contact details above. If you are registered in the portal, you can exercise most of your rights there.

We will respond to your enquiry as quickly as possible and no later than one month. If it takes longer than one month, you will be notified.

We may ask you to verify your identity or to provide additional information before we allow you to exercise your rights against us. We do this to ensure that we provide access to your personal data only to you — and not to someone purporting to be you.

Information

You have the right to receive information about the personal data we process about you. Through this notice, we inform you of our processing of personal data. You are also welcome to contact us if you require further information.

Where we have disclosed data to others, we are obliged to inform the recipient of any request for rectification or erasure of personal data — see below — or restriction of processing — see below — unless such notification is impossible or involves a disproportionate effort. We are obliged to inform you of any such disclosure if you request it.

Access

You have the right to request access to the personal data processed about you. Please contact us if you wish to exercise your right of access. If you are registered in the consultant portal, you can view most of the data you have provided to us there.

If you so request, you will also receive a copy of the personal data we process about you. We may ask you to specify which data you wish to receive a copy of, in order to facilitate the disclosure on our part. When providing a copy of your personal data, we may require you to identify yourself so that we can ensure we do not disclose personal data to unauthorised persons. Your data will be provided in digital form unless you request that it be transferred in another format.

Rectification and erasure

You may also ask us to rectify inaccurate data we hold about you or to erase personal data. You may also rectify or delete your data in the consultant portal. We will, to the extent possible, comply with a request to erase personal data; however, we cannot do so if we still have a need for the data. Erasure is permanent: should you wish to be part of our network again at a later stage, you will need to re-register.

Processing on the basis of consent

Where we process personal data on the basis of your consent, you may withdraw that consent at any time. The simplest way to do so is to use the method indicated when you gave your consent, or to contact us.

Right to Restrict or Object to Processing

You may request that our processing of your personal data be restricted in certain circumstances, provided the conditions for doing so are met. Where processing is restricted, the personal data will be stored only. See GDPR Article 18 for further details.

Where our processing is based on legitimate interests, you have the right to object to the processing of your personal data. If you object, we shall cease the processing in question unless there are compelling legitimate grounds to continue the processing.

You may also opt out of the processing of personal data concerning you for marketing purposes, including profiling to the extent that it is related to direct marketing; see GDPR Article 21(2).

Right to Data Portability

For data that you have provided to us and that is necessary for the performance of a contract with us, and that is processed automatically (i.e. not manually by us), you may request that your personal data be delivered to you or transferred to another provider in a structured, commonly used and machine-readable format (data portability).

Automated Processing, Including Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. See GDPR Article 22.

Right to Notification

Should a personal data breach occur — that is, a breach of security relating to personal data that is likely to result in a high risk to your privacy — we will notify you without undue delay.

Complaints

If you consider that our processing of personal data does not accord with what we have described here, or that we are otherwise in breach of data protection legislation, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We would, however, ask you to contact us first, so that we are able to remedy any incorrect processing as quickly as possible.

You will find information about your rights and how to contact the Norwegian Data Protection Authority on their website: www.datatilsynet.no.

Changes

Should there be any changes to our processing of personal data, or changes to the legislation governing the processing of personal data, this may result in changes to the information provided here. Where changes directly concern you and are material to your privacy, we may contact you if we hold your contact details. Otherwise, an updated version of this privacy notice will at all times be available on our website.