Norvestor Equity AS ("Norvestor") is committed to protecting the personal data processed by the company and thus the privacy of its data subjects. Pursuant to the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), Norvestor is obliged to provide you with information on its processing activities.
Norvestor has prepared this policy in order to provide you with information on how we process personal data in relation to the website, job applicants (including applicants to board positions) and any communication between Norvestor and natural persons affiliated with our investors, suppliers or business partners.
Norvestor acts as the data controller for the personal data it processes in connection with the website, job applicants and any communication between Norvestor and natural persons affiliated with our investors, suppliers or business partners. If you have any questions about how Norvestor process your personal data or would like to make use of your rights as a data subject, please contact our Risk Manager at:
Throughout this policy we use a number of terms that have the following meaning:
(1) "Personal data" means, briefly, any and all data which can be attributed to a (living) natural person, for example name, email, address, IP number, health data, or any combination of data which entails that a person can be identified.
(2) "Processing" means any and all measures performed on personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
(3) "Data controller" is the person who alone, or together with others, determines the purposes and means for the processing of the relevant personal data. The controller of personal data is the party with primary responsibility for ensuring that personal data is processed in accordance with the GDPR.
(4) "Data processor" is the person who processes personal data on behalf of the controller of personal data, for example a supplier of salary administration services.
(5) "Data subject" is the person whose personal data is processed by Norvestor, i.e. employees/freelancers, job applicants, users and contact persons at suppliers/business partners.
4 What Personal Data do Norvestor process concerning you and for which reasons?
Below is an overview of the types of personal data Norvestor process in relation to our website, our communication and the natural persons we interact with that is affiliated with our investors, suppliers or business partners.
Note that Norvestor does not necessarily process all of the below types of personal data, as it will depend on individual circumstances, e.g. how the website is used, which communication method is selected or the nature of the communication between you and Norvestor. Depending on the circumstances, Norvestor may also process other personal data. If you would like to now more of which personal data Norvestor process concerning you, please contact us by using the contact details in section 2 above.
In relation to our website users, we process cookies and data contained within cookies. Cookies are small text-based files that are placed on your device when you visit our site. The cookies contain information, which both Norvestor and third parties (e.g. the cookie provider) may access when you visit our website.
There are a number of reasons for us using cookies. The main reasons are to enhance your user experience and to analyse the general use of our website (e.g. by seeing how long you view our pages). To do this, we rely on third party cookie providers such as Google Tag Manager and Google Analytics. The cookies we use may include us processing your personal data, such as automatically generated unique identifiers (for the purpose of distinguishing between users) and information about your use of our website. For more information about the cookies we use, please see http://norvestor.nmo/cookies.
For more information about cookies in general, how to enable, view or delete cookies, please visit http://www.whatarecookies.com/.
Except for cookies and personal data contained within cookies, Norvestor does not process any other personal data in relation to its website.
4.3 Job applicants
In relation to job applicants, we process the following types of personal data:
· Contact details: Full name, e-mail address, address, phone number.
· Application data: Personal data in your application, CV, certifications and reference papers, such as where you are from, where you currently live, your marital status, skills, education, previous/current employment, background checks, various tests etc. Further, if we consider you towards a position within Norvestor or one of its affiliates, we may create and retain internal notes assessing your qualifications against that of other applicants.
The contact details and application data is processed so that we can contact you and consider you against available positions within our organization. The legal basis for the processing is that the processing is necessary for ensuring a legitimate interest.
If we do not have any positions available, we may ask for your consent to continue storing your contact details and application data so that we may consider you against future positions within our organization.
4.4 Natural persons affiliated with investors, suppliers or business partners
In relation to natural persons (that Norvestor interact with) employed or in other ways affiliated with investors, suppliers or business partners, we process the following types of personal data:
· Contact details: Full name, e-mail address, address, phone number, work related e-mail, work related phone number.
· General information: Your job position/connection to the investor, supplier or business partner and CRM related information (e.g. our interactions with you and your company).
· Miscellaneous data: Personal data contained in our documents (e.g. protocols from meetings or contracts which is signed by you), e-mail correspondence etc.
The contact details and general information is processed so that we can maintain and develop the relation between Norvestor, you and the company which you are employed in or in other ways affiliated with. The legal basis for the processing is that the processing is necessary for ensuring a legitimate interest.
Miscellaneous data is processed to ensure Norvestor's continued daily operations and to ensure that we fulfil legal obligations (e.g. in relation to the Bookkeeping Act). The legal basis for the processing will normally vary between i) that the processing is necessary for ensuring a legitimate interest that is not overridden by your data privacy, and ii) that the processing is necessary for fulfilling legal obligations.
5 How long do we process your personal data?
Generally, Norvestor will delete or anonymize your personal data when it is no longer necessary to process the data for the purpose it was collected for.
Below we have set out some general information about our retention guidelines in relation to the website, job applicants and the natural persons we interact with affiliated with our investors, suppliers or business partners. We note that the below is general guidelines and that Norvestor may retain the personal data for a prolonged period of time in certain circumstances, e.g. if personal data is necessary to establish, exercise or defend against legal claims.
Norvestor only retain and use the personal data we collect in and through the cookies for a limited time (usually only when you are visiting the website or during your session). When you revisit our website we might access the cookies and the personal data previously stored on these. The cookies we place on your device is placed for a limited period varying from 30 seconds to several years. For more information on how long we store the different cookies on your device, please see http://norvestor.nmo/cookies.
5.3 Job applicants
Norvestor will retain the contact details and application data for no more than two months following the end of the recruitment process. If you send us an open application or if we are unable to offer you a position at the current time, we may ask you to consent for our continued retention of your contact details and application data. If so, we will retain the document for the duration you have consented to. You may at any time withdraw your consent and request us to delete your application data.
5.4 Natural persons affiliated with investors, suppliers or business partners
Norvestor will retain the contact details and general information concerning natural persons (that we interact with) employed or in other ways affiliated with our investors, suppliers or business partners, for two years following our last interaction with the individual. However, in certain circumstances where we believe it to be in the interest of all parties that we continue retaining the contact details and general information, we may continue retaining such data for a prolonged period of time (e.g. where Norvestor has developed a relationship with an individual that is not limited to him/her holding a position at one of our investors, suppliers or business partners).
With regards to miscellaneous data we will retain these for as long as is necessary for complying with legal obligations and ensuring our legitimate interests.
6 Do we share your personal data with third parties?
Norvestor rely on a number of third party service providers that we might end up sharing your personal data with:
· IT-system providers: We have third party service providers delivering IT-systems and telephone services to us. In certain circumstances, e.g. if we need support from one of our providers, they might have access to your personal data.
· CRM-system provider: We use eFront as our CRM-system provider. This means that we will upload contact information and information about our interactions through the eFront application.
· Newsletter service provider: We have an agreement with Apsis regarding distribution of newsletters and other relevant information on behalf of Norvestor. For Apsis to distribute the newsletters, we must share some of your contact details with Apsis.
· Recruitment service provider: When we recruit personnel to job or board positions, we might use the service of a recruitment agency. If so, this may include sharing relevant CVs and application data with the recruitment agency.
Norvestor will take the necessary steps to ensure the protection of your personal data, e.g. by entering into data processor agreements with data processors such as our IT-system and CRM-system provider.
Our CRM-system provider, eFront has parts of its business operations in the US. To ensure the adequate protection of your personal data, eFront has certified that it adheres to the EU-US Privacy Shield. Except for the personal data shared with eFront, Norvestor does not share or transfer your personal data outside of the EU/EEA.
7 Your Rights as a data subject
As a data subject you have certain rights that you may make use of in relation to Norvestor's processing of your personal data:
· Right to access: As a data subject, you have a right to request us to confirm whether we process personal data concerning you, and if so, to give you access to the personal data and more detailed information about the processing activity.
· Right to data portability: If the processing is carried out by automated means and the legal basis for the processing activity is consent or performance of a contract, you may be entitled to request us to provide you with a subset of your personal data in a structured, commonly used and machine-readable format. In certain circumstances, you may also ask us to send the subset of your personal data directly to another data controller (e.g. another company).
· Right to rectification: Norvestor has a constant obligation to ensure that the personal data it is processing is accurate and up to date. If you discover that the personal data we process about you is inaccurate or incomplete, you may require us to rectify or complete the personal data.
· Right to erasure: Norvestor has an obligation to delete or anonymize your personal data when it is no longer necessary to process the data for the purpose it was collected for. Additionally, you have a right to request us to delete your personal data in the following situations:
o The processing is based on your consent and this consent is withdrawn (and there is no other legal basis for the processing).
o You object to the processing and there are no overriding legitimate interests for continuing the processing.
o The personal data was unlawfully processed.
o The personal data has to be erased in order to comply with a legal obligation.
We note that the right of erasure does not apply if further retention of the data in question is necessary for compliance with a legal obligation (e.g. bookkeeping obligations), or for the establishment, exercise or defence of legal claims.
· Right to restriction: Under the GDPR, you have a right to require that we (temporarily) restrict the processing of your personal data in certain situations, e.g. if you contest the accuracy of your personal data which we process or are of the opinion that Norvestor do not have a sufficient legitimate interest for a processing activity.
· Right to objection: In certain circumstances, e.g. where the legal basis for processing is a legitimate interest, you may object to the continued processing. If you do so, Norvestor will re-evaluate the legitimate interest and the interest of your data privacy. We will only continue the processing activity if i) there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms; or ii) the processing is necessary to establish, enforce or defend against legal claims.
If you would like to make use of your rights as a data subject, please contact us at the contact details set forth in section 2.
8 Update of policy