Privacy and cookies policy Nofence

This Privacy and cookies policy ("Privacy Policy") is prepared by Nofence AS ("Nofence", "we", "our" or "us") to provide information on how we process your personal data, which is necessary for you to exercise your rights under the General Data Protection Regulation (the "GDPR") and the Norwegian Personal Data Act (together "data protection legislation").

We process your personal data as a controller. If you have any questions about this Privacy Policy or how we process personal data, or would like to submit a request to exercise your rights, please contact us at:

Nofence AS

Address: Nofence AS

Email: legal@nofence.no

Phone: +47 483 86 488

We process your personal data when:

• You provide it to us through our website or otherwise.
• When you make a purchase.
• You accept the use of cookies.

To receive, administer and carry out orders, provide customer service and otherwise establish and manage our customer, supplier and partner relationships, we need to process personal data about a contact person at our customers, suppliers and partners. What is considered personal data will depend on whether the customer, supplier or partner is a company or a physical person.

For these purposes, the following categories of personal data is processed about contact persons at companies: 

• Full name
• Title
• Phone number
• E-mail address
• Place of work/employer/farm

For contact persons at companies, the legal ground for processing is our legitimate interest in establishing and managing our relationship with the business you represent and carry out the agreements with them (GDPR Article 6 (1) f).

Such data will be processed as long as we have an active customer relationship with you or your company. If you decide to end your customer relationship, the information will, as a general rule, be deleted after 1 year.

Any personal data connected to purchase or other bookkeeping documentation will be processed based on our obligations under the bookkeeping legislation (GDPR Art. 6 (1) c). Depending on the nature of the documentation it will be stored for either 3 ½ or 5 years in accordance with the Norwegian Bookkeeping Act.

Nofence offers several payment solutions to our customers, currently Stripe and Vipps (for Norwegian customers). Which payment solution you have access to will depend on the country you order from. Please note that the payment solution you chose is the controller for the data they process in relation to the payment. For questions about their processing of your personal data, please consult the privacy policy of the payment solution you chose:

• Stripe Inc. (US) (Privacy Policy)
• Stripe Payments Europe, Limited (“SPEL”) (EU) (Privacy Policy)
• Vipps (Privacy Policy)
• Gocardless (Privacy Policy)

When you visit our website, we and some third parties may collect information about how you use our websites by using cookies. Cookies are small files of software that save and retrieve information about your visit to a website or application. They reside in your internet browser to help remember your preferences and previous activity.

The main purpose of processing personal data collected through cookies is to give country specific information, and also to better understand our customers' use of our products. For website visitors we rely on cookies for marketing and communication on social media platforms.

We ask for consent to place three different categories of cookies, that we use for three main purposes:

• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functional cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name, and remember your preferences (for example, your choice of language or region).
• Advertisement cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website, and the advertising displayed on it more relevant to your interests.

In addition we use necessary cookies that are not optional. These are cookies that are required for the operation of our website. These cookies ensure basic functionalities and security features of the website, anonymously.

You can find more information about the individual cookies we use, and the purposes for which we use them, in the table below.

We integrate with third party websites and plug-ins such as LinkedIn, Facebook and Instagram. These may collect information about your IP-address and which page you are visiting on our website, and they may set a cookie to ensure proper function.

Consent from the user is needed to place a cookie, unless the cookie is necessary to provide an information society service expressly requested by the user. We therefore ask for your consent to place analytical and performance cookies, functional cookies and marketing cookies.

A cookie-banner will appear on your screen the first time you visit our website, or access the website with a new device, informing you of our use of cookies. In this banner, we collect your consent to place cookies. You can accept the placing of all cookies, or cookies for specific purposes. If at first you do not accept our use of cookies, you may enable the use of cookies via the settings on your web browser. On the bottom of our website, you can withdraw or alter your cookie consent. You may also administrate and delete cookies via the settings on your web browser.

We process the personal data collected from cookies based on your consent in the cookie banner (GDPR Art. 6 (1) a). You can withdraw your consent at any time.

For any processing of personal data collected from the necessary cookies, the legal basis is our legitimate interest in using cookies which allow our website to function.

We maintain presences on social media platforms, including but not limited to Facebook, LinkedIn and Instagram.

On the social media platforms we have access to see posts, likes, followers, comments and messages, as well as aggregated information about visits and activity on our pages, boards and personalized ads.

The purpose of our presence and use of social media platforms is marketing our services and communicating with potential customers on social media platforms. Our processing is based on our legitimate interest in reaching out to customers and potential customers (GDPR. Article 6 (1) f).

The social media are the controllers for the information you leave there. We do not store this information ourselves, but we have access to it as long as we keep our social media page. You can delete information we process about you at any time, e.g. by removing content or reactions you have posted. Your data will not be deleted simply by unfollowing our site. The duration of our processing is until you or the social media delete the data.

The social media platforms we use process personal data in the United States and other countries listed in their privacy policies. You can get more information about how Facebook, Instagram and Linkedin process personal data in their respective privacy policies.

We cannot control the actions of other users of these platforms or the actions of the platforms themselves. Your interactions on these platforms are governed by the privacy policies of the companies that provide them. We encourage you to read these to understand how your personal data is processed by these platforms.

If you apply for a position at Nofence, we will process your personal data in order to assess you as a potential employee and to form a sound basis for decision-making in our recruitment processes.

We process personal data received from the job applicant to take measures at the applicant's request prior to entering into a contract (GDPR Article 6 (1) b) or based on the applicant's consent (GDPR Article 6 (1) a). Sensitive personal data processed in connection with recruitment are necessary for Engebretsen to fulfill its obligations as a potential employer (GDPR Article 9 (2) b). Any ability and personality tests, as well as online searches, are based on Nofence’ legitimate interest in finding the right candidate (GDPR Article 6 (1) f). We will only contact the job applicant's references if we have obtained consent for this (GDPR Article 6 (1) a).

We store your personal data while the relevant recruitment process is ongoing. If we wish to store your personal data for future recruitment needs, we will ask for your consent. You can withdraw your consent at any time, and Nofence will then no longer store your personal data for recruitment purposes. Separate procedures for storing personal data apply to candidates who are hired.

We use different service providers to process personal data. The following service providers will act as processors on our behalf and will receive personal data from us when providing their services:

• Visma. For accounting purposes.
• Xero. For accounting purposes.
• Please also see the table in sec. 4.2.

We have entered into data processing agreements with our processors which, for example, obligates the data processor to implement technical and organizational measures to ensure an appropriate level of security, confidentiality, and integrity of the personal data, as well as to only process the relevant personal data in accordance with data protection legislation.

We will also enter into non-disclosure agreements before we share any information and personal data with persons and companies (i.e. third parties) involved in our services. These non-disclosure agreements require the recipient of information to keep the information confidential and to only use it for specific purposes.

We will only transfer personal data to countries outside the EU/EEA with a valid legal basis, such as Standard Contractual Clauses adopted by the EU Commission ("SCCs").

We will not disclose your personal data to any other third parties than those listed above, unless we are required to do so under applicable law, or if it is necessary to establish, exercise, or defend legal claims.

As a general rule, we will delete or anonymize personal data when they are no longer necessary in relation to the purposes for which they were collected or otherwise processed. Specific storage periods are indicated under the description of the various processing activities where possible.

You have the following rights when we process personal data about you:

• Access. You may contact us if you want to obtain confirmation with respect to whether or not we are processing your personal data, as well as access to and further information regarding our processing of your personal data. You may also request a copy of the personal data we are processing about you.
  
  
• Correcting personal data (rectification). You may request us to rectify and/or complete inaccurate or incomplete personal data.
  
  
• Erasure (the right to be forgotten). You may request us to erase your personal data. We will respect and comply with your request unless we among other things are prohibited from deleting your personal data under mandatory retention requirements, or the personal data is necessary for the establishment, exercise or defense of legal claims. See GDPR Article 17 (1) to see when you can request erasure of data. As long as we have an ongoing customer relationship or in case of any unpaid invoices we retain the right to keep your customer data until debts are settled.
  
  
• Restriction. You may also request the restriction of our processing of your personal data in accordance with the criteria in GDPR Article 18. If the processing has been restricted, such personal data will, with the exception of storage, only be processed with your consent or for the exercise or defence of legal claims or for the protection of the rights of another person or for reasons of important public interest.
  
  
• Object. You are entitled to object to certain processing activities. You are furthermore, on grounds relating to your particular situation (for example, a specific need for protection of your identity), entitled to object to the processing of personal data based on legitimate interests, which we will comply with, unless there exist compelling legitimate grounds for our processing which override your interest, or if our processing is necessary for the establishment, exercise or defence of legal claims.
• Data portability. If we process your personal data based on consent or based on our performance of a contract, and the processing is carried out by automated means, you may request us to transfer the personal data to you or another controller, in a structured, commonly used and machine-readable format.
  
  Please note that the above rights may be subject to further exceptions and limitations in accordance with the data protection legislation.
  
  You may contact us at: legal@nofence.no if you wish to exercise any of the above rights. Please note that we may request additional information from you if such information is necessary to confirm your identity.

As a controller, we are responsible for the security and confidentiality of the personal data we process. We are furthermore responsible for implementing appropriate technical and organizational measures to ensure an appropriate level of security for the processing.

You may contact us at any time if you have any questions or complaints regarding our processing of your personal data. You may also file a complaint to a data protection authority in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged data protection infringement. For instance, you may file a complaint to the Norwegian Data Protection Authority. 

You can obtain the contact details of the Norwegian Data Protection Authority on the following website: www.datatilsynet.no. You may also find more information on your rights and the data protection legislation on this website.

We may update the Privacy Notice from time to time. The Privacy Notice will, for example, be updated to comply with any legislative amendments or if we make changes to our processing of personal data.

An updated version of this Privacy Notice will be published on our website if any revisions to the Privacy Notice are made. This Privacy Notice is effective from the date stated initially.