1. Purpose. Why we collect this information
This text describes how EVRY collects and processes personal data. It is EVRY’s policy to adhere to local data privacy legislation as well as corporate policies and procedures and applicable privacy directives.
Personal information collected through this website is used only for purposes that are objectively justified by EVRY’s services and to perform the processing in accordance with privacy rights and regulations, including the need to protect personal integrity and private life and to ensure that personal data are of adequate quality. The processing does not involve automated decision making.
If you choose not to provide personal information to EVRY, some functions or services may be unavailable or communication impossible.
Processing may include collection, recording, alignment, storage, transfer and disclosure or a combination of this. EVRY may use resources from subsidiaries outside EU-/EEA-area in a way that is considered as transfer of personal data for carrying out tasks (inter alia support services) based on EU standard contractual clauses. EVRY processes personal data both as a processor and as a controller, as defined in the Personal Data Directive.
2. Categories of Personal data
The personal data processed by EVRY are related to employees, customers, and customers of the customers, suppliers, complainants, correspondence, enquiries, visitors on EVRY’s webpages, and data subjects whose personal data is controlled by any of those listed.
EVRY processes these types of personal data:
- Personal data on behalf of EVRY’s customers and
- Personal data where EVRY is data controller, which may include:
a. Personal data on employees
b. Information and assessments connected to other categories of personal data. It is the policy of EVRY to limit these data only to include contact details, strictly professional information and information related to the activities EVRY has performed in relation to the persons concerned. EVRY may collect, store, use and transfer personal data for specifically expressed purposes when the user visits EVRY’s internet page. Such purposes are in general daily operation of the system and communication.
- Principle rules
When processing personal data EVRY will fulfil its obligations:
1. towards the data subjects;
2. towards public authorities; and
3. towards customers and other controllers than EVRY with regard to how the processing is carried out.
These obligations are further detailed below.
1. In relation to the data subject there are provisions in the applicable personal data act stipulating conditions for authorizing the processing. Consent from the data subject is normally a sufficient authorisation. Dependent upon the data being sensitive or not, other conditions may authorize the processing.
Furthermore, EVRY has an obligation to provide information to the data subject and upon request to provide access to the data. To ensure that personal data are of adequate quality, deficient personal data may be rectified.
2. In relation to the public authorities the applicable Personal Data Act contains an obligation to give notification and - for some processing - an obligation to obtain a license.
3. When EVRY provides services to customers that include processing of personal data, such processing can only take place when there is a contractual basis for such processing. The transfer of personal data to EVRY companies in countries outside EU/EEA can only take place when the data subject or the customer has approved the transfer. A legal basis is required for such transfer, for example a specific export agreement.
4. As regards the processing itself there are obligations with regard to data security and internal control. Organisational, physical and technical security measures shall be implemented to ensure adequate level of data security. The measures shall be in proportion to the probability and consequences of any breaches of security in order to prevent loss of life or health, economical loss or loss of reputation and personal integrity. The use of external resources to process personal data may be subject to specific provision of applicable Personal Data Act, as well as the transfer of data to other countries. EVRY will delete personal data when all purposes of the processing of the personal data are fulfilled. The retention time of each category of personal data is assessed in light of practical, technical and other considerations.
4. Who we share information with
The information will be shared within EVRY ASA, residing in Norway, Sweden, Finland, Denmark, Latvia, Ukraine, India, under safeguards in compliance with the General Data Protection Regulation. You can obtain a copy of this documentation by contacting us at the contact information provided below.
5. How long we store your information
Your information will be stored for up to 24 months, counting from the date it was entered or updated.
6. Audit programme
In order to verify that EVRYs processing meets data protection and privacy requirements, EVRY and its companies will conduct audits according to EVRY’s standard audit regime.
7. Our contact information and your rights
If you have any questions or would like to request access to or rectification of personal data in your records, feel free to contact us at firstname.lastname@example.org / +47 23145000. You can also contact our Data Protection Officer at email@example.com for any questions or concerns.
You have the right to file a complaint regarding concerns about how your personal data is being processed with the Data Protection Authorities.
If you choose, you can later withdraw your consent for this processing at any time, and we will then delete your information. In this case, please contact firstname.lastname@example.org.
You may object to your data being processed because of the direct marketing, profiling, automatic decision making or scientific and historical research and statistics that is being conducted and that includes your personal data. If you object to receiving direct marketing, you will automatically be removed from the database and will receive no further marketing communications from us.
You may exercise your right of restricting processing if you deem your personal data is inaccurate, cannot be processed based on the legitimate interest stated above, processing is happening illegally, needed to be kept for a legal claim.
You may exercise your right to object to the automated decision making or profiling and/or obtain human intervention by contacting us.
You have the right to receive your data in a portable format: please contact email@example.com to do so.
8. Complaint Mechanisms
Complaints may be addressed to firstname.lastname@example.org