Privacy policy

1 Data controller

This privacy policy explains how we collect and use (process) personal data in our business. CARL HQ AS, represented by its CEO, is the controller for this processing.

Our contact details are:

• CARL HQ AS
• Business address: Fridtjof Nansens vei 8, 0369 Oslo, Norway
• Organisation number: 934440323
• Email:

We take your privacy seriously and have taken several steps to give you clear information about how we process your data and what rights you have. If anything is unclear or missing, please contact us.

2 Your rights

Contact us if you have questions about your rights or want to use any of them. You are entitled to a reply within 30 days. Read more on the Norwegian Data Protection Authority's website.

• Access and correction: You can ask for a copy of all the personal data we process about you, and ask us to correct data that is wrong.
• Erasure or restriction: In some situations you can ask us to erase personal data about you and/or restrict how we process it, but we cannot erase data we are required to process.
• Objection: If we process personal data about you on the basis of a legitimate interest, you have the right to object.
• Data portability: If we process personal data about you on the basis of consent or a contract, you can ask us to transfer that data to you or to another controller.

You also have the right to withdraw your consent at any time.

If you are not satisfied with how we process your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet), but we hope you will tell us first, so we can try to resolve the matter for you.

3 Whose personal data we process

We process personal data about:

• Customers
• Potential customers
• Contact persons at suppliers and partners
• Website visitors
• Job applicants
• Employees

4 How we collect personal data

Giving us personal data is voluntary, but we need certain information from you to complete a purchase.

We process personal data when you:

• buy our products or services
• contact us by phone, SMS, our website, email or social media
• sign up for events we organise
• use our website
• are a supplier or partner of ours

5 Purpose, legal basis and storage

Under Article 6(1) of the General Data Protection Regulation (GDPR), personal data may be processed on the basis of:

• Your consent
• A contract we have entered into
• A legal obligation we have
• Protecting the vital interests of the data subject or another natural person
• Performing a task in the public interest or exercising official authority
• A legitimate interest we believe we have

As a general rule, personal data must not be processed or stored for longer than necessary to fulfil the purpose of the processing. If we process your personal data on the basis of a legitimate interest we believe we have, you can object to the processing by contacting us. We will then assess your objection and get back to you promptly.

We keep data for as long as we are required to under applicable legal obligations, for example under accounting, tax or employment law and/or other relevant rules and regulations. You can contact us at any time if you want us to stop processing or erase your personal data, but note that we cannot erase personal data we are legally required to process.

Accounting records are kept for up to five years under the Norwegian Bookkeeping Act (bokføringsloven).

6 How we process personal data

Here we describe in detail when and how we process your personal data, for what purposes, on what legal basis and for how long. We process personal data when:

You communicate with us

When you give us your business card or contact us through the website (contact form, comment field, chat or similar), by email, by phone (call or text message) or on social media, we process personal data. Depending on where and how you send us a message, this can be your name, contact details, IP address and any other information you choose to send us.

The purpose is to answer your enquiries, keep a history and have documentation in case we receive warranty claims, complaints or legal claims.

The legal basis can be:

• Your consent
• A contract we have entered into
• A legal obligation we have
• A legitimate interest we believe we have, where the legitimate interest is to answer your enquiries, keep a history and have documentation in case we receive warranty claims, complaints or legal claims

We review, archive and delete enquiries as needed, and at least once a year.

You buy our products and services

When you buy products and services from us, we process personal data such as your name, contact details, order and payment information and purchase history.

The purpose is to deliver products and services to you after you order or buy them, keep a history of products and services sold, and otherwise manage and follow up our customer relationship with you.

The legal basis can be:

• Your consent
• A contract we have entered into
• A legal obligation we have, under the Norwegian Bookkeeping Act and Tax Act among others
• A legitimate interest we believe we have, where the legitimate interest is to answer your enquiries, keep a history and have documentation in case we receive warranty claims, complaints or legal claims

Marketing to existing customers

When you become a customer, we process personal data as described above. If you are an existing customer, we may send you marketing by email and SMS, in line with section 15 of the Norwegian Marketing Control Act (markedsføringsloven). The legal basis is then legitimate interest, but it can also be consent.

The purpose of the marketing is to provide good customer service.

You can unsubscribe from marketing by email and SMS at any time. Every marketing email and SMS we send tells you how to unsubscribe.

You sign up for an event

When you attend free events with us, we process personal data such as your name and contact details. For paid events, we also collect order and payment information. The purpose is to offer relevant courses, talks and workshops, or to fulfil the agreement for an event you have booked.

The legal basis can be:

• A contract we have entered into

We may also use your personal data to ask you to evaluate the event you attended, and possibly to invite you to similar events. The legal basis is then legitimate interest, where the legitimate interest is to keep improving our products and services and to follow up with you as a customer.

How long we keep the data depends on the type of event, but it is usually deleted within 12 months.

You are a supplier or partner

When you enter into an agreement with us as a supplier, partner or data processor, we process personal data such as your name, contact details and correspondence.

The purpose is to enter into an agreement with you, and the legal basis can be:

• Your consent
• A contract we have entered into
• A legal obligation we have, under the Norwegian Bookkeeping Act and Tax Act among others
• A legitimate interest we believe we have

The data is kept for as long as we have an ongoing relationship. We process personal data related to general correspondence and communication as described above.

You use our website

When you use our website, we process personal data in line with the choices you make under “Cookie settings” at the bottom of every page. The purpose is to run our website, promote the company and answer enquiries from visitors. The legal basis for cookies that store or process information covered by section 2-7b of the Norwegian Electronic Communications Act (ekomloven) is the consent you give there. You can change or withdraw your consent at any time under “Cookie settings”.

7 Who we share personal data with

To run our business efficiently and securely, we sometimes need to share your personal data with parties such as:

• Data processors: providers of various services who process your personal data on our behalf (see the list below)
• Professional advisers in fields such as law, finance, accounting, auditing and insurance
• Support for IT and administration systems
• Public authorities we are required to report to

We require everyone we share your personal data with to protect it in line with good information security practice and the requirements of the GDPR. We enter into a data processing agreement with everyone who processes data on our behalf, and confidentiality agreements as needed.

We use data processors for:

• email, calendar and online meetings
• bookkeeping, accounting and invoicing
• cloud storage
• electronic signatures

For security reasons we have not named them, but feel free to contact us if you want to know more.

8 Security

We take information security seriously and always do our utmost to protect your personal data as well as we can. Among other things, we use the following to secure our data and prevent unauthorised people from viewing, changing, deleting or in any way affecting the data we store, including your personal data:

• strong passwords
• data encryption
• access control
• two-factor authentication

We only use reputable providers of IT and administration services, such as web hosting, website and computer security, antivirus software, email, backup and more. We only let others access and/or process your personal data according to our instructions, and only where strictly necessary (for example for IT support).