Finnfjord AS
Norsk English

Privacy and Due Diligence Assessments

Due Diligence Assessments

Cookies

Cookies are small text files that are stored on your computer when you load a website.

As most browsers are set to automatically accept cookies, by visiting our website you consent to cookies being stored in your browser.

If you do not want to accept the use of cookies, you can change the settings in your browser yourself. Please note that this may mean our website does not function optimally.

Processing of Personal Data at Finnfjord AS

When you are in contact with us, for example as a private individual or as a contact person at a company, Finnfjord AS may process personal data about you. Below you will find information about which personal data is collected, why we do this, and your rights related to the processing of personal data.

The HR Manager is the data controller for personal data at Finnfjord AS.

Finnfjord AS's contact information is:
Address: Ferroveien 1, 9308 Finnsnes, Norway
Email: firmapost@finnfjord.no
Phone: +47 778 70 500
Organisation number: 934 039 254

If you have any questions about our processing of personal data, you can contact us.

Why we collect personal data and what kind of information we collect:

We collect and use your personal data for various purposes depending on who you are and how we come into contact with you. We collect the following personal data for the purposes stated here:

  1. Establishment of customer relationships and administration of the customer relationship. In this connection, contact information, documentation of identity, payment information, etc. is processed. The processing is based on GDPR Article 6(1)(b) (the processing is necessary for the performance of a contract to which the data subject is party) for private customers, and GDPR Article 6(1)(f) (the processing is necessary for purposes related to legitimate interests) for contact persons of corporate customers and other matters processed in connection with corporate customers. In addition, Finnfjord AS may be subject to legal obligations in connection with establishing customer relationships, and in such cases processes data under GDPR Article 6(1)(c) (the processing is necessary for compliance with a legal obligation).
  2. Case handling. In this connection, personal data necessary in relation to the case in question is processed. The processing is based on GDPR Article 6(1)(b) for private customers, and GDPR Article 6(1)(f) for contact persons of corporate customers and other matters processed in connection with corporate customers.
  3. Information about third parties. In this connection, personal data necessary in relation to the case in question is processed. The processing is based on GDPR Article 6(1)(f). We have assessed that the processing is necessary in order to resolve incoming cases as efficiently as possible, in accordance with commercial considerations. When processing special categories of data, the processing has its legal basis in GDPR Article 9(2)(f) (the establishment, exercise or defence of legal claims).
  4. Legal violations. In this connection, personal data necessary in relation to the case in question is processed. The processing is based on GDPR Article 9(2)(f) (the establishment, exercise or defence of legal claims).
  5. Storage/retention of case documents. In this connection, personal data necessary in relation to the case in question is processed. The processing is based on a legal obligation to archive ongoing and closed cases.
  6. Invoicing. In this connection, contact information and payment information is processed. The processing is based on GDPR Article 6(1)(b) for private customers, and GDPR Article 6(1)(f) for contact persons of corporate customers.
  7. Sending marketing, newsletters and other relevant information about our business. In this connection, name and email address are processed. The processing is based on the consent of the recipient of the marketing under Section 15 of the Norwegian Marketing Control Act, usually a private customer or a contact person at a corporate customer.
  8. Information about potential customers. In this connection, contact information is processed. The processing is based on GDPR Article 6(1)(f). We have assessed that the processing is necessary to safeguard the commercial interests of our business.
  9. Knowledge management (e.g. reuse of documents in later cases). Personal data processed in this connection is personal data that is necessary in relation to the case in question. The processing is based on GDPR Article 6(1)(f). We have assessed that the processing is necessary for internal learning processes and to work more efficiently.
  10. Recruitment. In this connection, CVs, applications, references, certificates/diplomas, statements from referees, internal assessments/interview notes and, where applicable, personality and aptitude tests are processed. Processing of personal data is based on an agreement with the person applying for a position with us, i.e. GDPR Article 6(1)(b). If we retain application documentation after a recruitment process has ended, this is done on the basis of consent from the applicant, cf. GDPR Article 6(1)(a).
  11. Security. In this connection, server logs, and the detection, investigation and follow-up of security incidents, etc. are processed. The processing is based on GDPR Article 6(1)(f). We have assessed that this processing is necessary to safeguard information security and prevent unauthorised disclosure of personal data.

Disclosure of Personal Data to Others

We do not disclose or transfer your personal data to others unless there is a lawful basis or requirement for such disclosure. Examples of this would typically be legal obligations that require us to disclose information to opposing parties, courts or public authorities.

Finnfjord AS does not share your personal data with external third parties other than sub-processors who perform services related to personal data on behalf of the company, or suppliers and operators of our IT and ICT systems.

Your personal data and rights are safeguarded through data processing agreements with these suppliers.

All processing of personal data that we carry out takes place within the EU/EEA.

Retention Period

We store your personal data for as long as is necessary for the purpose for which the personal data was collected.

This means, for example, that personal data we process on the basis of your consent is deleted if you withdraw your consent. Personal data we process in order to fulfil an agreement with you is deleted once the agreement has been fulfilled and all obligations arising from the contractual relationship have been met. Personal data we process to fulfil a legal obligation from the authorities is deleted when the legal basis so determines. This applies, for example, to bookkeeping and accounting rules.

Your Rights When We Process Personal Data About You

You have the right to request access to, rectification of, or deletion of the personal data we process about you. You also have the right to request restricted processing and, under certain conditions, to object to the processing. You can read more about these rights on the website of Datatilsynet (the Norwegian Data Protection Authority): www.datatilsynet.no.

To exercise your rights, you must contact us by email or phone. We will respond to your enquiry as soon as possible, and at the latest within 30 days. We may ask you to confirm your identity or provide additional information before we allow you to exercise your rights with us. We do this to ensure that we only grant access to your personal data to you — and not to anyone pretending to be you.

Complaints

If you believe that our processing of personal data does not comply with what we have described here, or that we are otherwise in breach of data protection legislation, you can file a complaint with Datatilsynet. You can find information about how to contact Datatilsynet on their website: www.datatilsynet.no.

Changes

If there are changes to our services or changes in the regulations regarding the processing of personal data, this may result in changes to the information provided here.