Cflow AS v/the general manager is the controller, i.e. decides why and how the personal data should be processed. If you have questions or would like to know more about our processing of personal data, you can contact us using the contact details below.
Address:
E-mail:
Phone:
Organization number:
We collect and use personal data for different purposes depending on who you are and how we come into contact with you. All processing of personal data takes place in accordance with the applicable data protection rules at all times, including the Data Protection Act and the General Data Protection Regulation (GDPR). “Personal data” means any information that can be linked to a natural person. “Processing” means everything that is done with personal data, such as collection, registration, organization, structuring, storage, adaptation or modification, use, disclosure by transfer, restriction of dissemination, deletion or destruction, etc. We process the following personal data for the purposes set out here:
1. Marketing, newsletters and providing information about our business: For this purpose, we collect email address, consent time and IP address. The processing takes place on the basis of your consent and/or existing customer relationship, cf. Marketing Act § 15. The data will be deleted when you withdraw your consent. A newsletter unsubscribe link is located at the bottom of every marketing email you receive from us.
2. Communication and contact: We process personal data about those who contact us to answer and document the communication and to contact us with others. In such cases, we process the name, telephone number, e-mail address and any personal data that may result from the request, including history/logs of the request. It is voluntary to provide us with personal data, but it will be necessary to provide us with information in order to respond to inquiries. The processing therefore takes place on the basis of a balance of interests, cf. GDPR Art. 6 (1) f. We have considered that this is necessary for us to handle inquiries we receive and that the data subjects' privacy does not take precedence over these interests. The data will be deleted when we consider the dialogue to have ended.
3. Visits to our website: When you visit our website, we only collect anonymised action data — that is, what you do and not who you are — in our analytics tool HubSpot and Google Analytics. We process personal data on the basis of a balance of interests, cf. GDPR art 6 (1) f. We have considered it necessary for us to do this in order to adapt the website to our users. See otherwise cookies policy.
4. When recruiting for new positions with us, among other things, CV, application, testimonials, references, notes from interviews will be processed. The processing of personal data takes place on the basis of consent that you have given, while the processing is necessary to carry out measures before an employment contract with the job applicant is possibly concluded, cf. GDPR Art. 6 (1) a and b. You may withdraw your application at any time and delete your data in cVideo. You can read more about processing of personal data in cVideo here.
5. Customer relations and conclusion of contracts: In existing customer relationships and when concluding contracts, we process personal data such as name, telephone number, email address and any personal data that may arise from the customer relationship. The processing is necessary for administration and to fulfill the agreement we have concluded with the customer, cf. GDPR Art. 6 (1) b
We store personal data (contact details) in our ERP system; Monitor, CRM system; HubSpot, and recruitment system; cVideo, for as long as necessary for the purpose for which the personal data was collected, and delete the data in accordance with the requirements of the regulations. The length of time we process the individual types of data we process is included in the above where the individual treatments are discussed. This means, for example, that personal data that we process on the basis of your consent will be deleted if you withdraw your consent. Personal data that we process in order to fulfill an agreement with you is deleted when the contractual relationship has ended, and all obligations arising from the contractual relationship have been fulfilled, such as legal obligations related to accounting, follow-up of the customer relationship related to complaints, etc. Personal data that we process as a result of a legal obligation will be deleted as soon as we are not obliged to keep the data. See also point 2 above for our deletion routines.
We do not pass on your personal data to others unless there is a lawful basis for doing so. Examples of such grounds would typically be an agreement with you or a legal obligation requiring us to disclose the information. We use data processors to collect, store or otherwise process personal data on our behalf, where they assume the same level of security as we have for our processing of personal data. All processing of personal data that we undertake takes place within the EU/EEA area.
All processing of personal data is ensured with the required technical and organizational measures. We handle information so that it is correct, accessible and handled according to the degree of sensitivity of the information. We also employ a variety of security technologies and information security procedures to protect your personal data from unauthorized access, use or disclosure. Risk assessments are carried out for the processing of personal data.
Below are your rights for the processing of personal data. In order to exercise your rights, you must contact us using the contact details listed in paragraph 1 above. We will respond to your inquiry to us as soon as possible and within one month at the latest. If it takes longer than a month, you will be notified.
Information
You have the right to receive information about the personal data we process about you. Through this statement, we inform you about our processing of personal data.
Insight
You have the right to request access to the personal data processed about you.
Modification and deletion
You can also ask us to correct incorrect information we hold about you or ask us to delete personal data. We will, as far as possible, accommodate a request to delete personal data, but we cannot do this if we still need the information.
Processing on the basis of consent
We process personal data on the basis of your consent, so you can withdraw your consent at any time. The easiest way to do this is to use the way stated at the time you gave your consent or contact us.
Right to restrict or object to processing
You have the right to have your processing restricted in certain cases such as:a) You dispute the accuracy of the personal data - the processing is stopped for a period that allows us to verify the accuracy of the personal data.b) The processing is unlawful and you object to the erasure of the personal data and instead request that the use of the personal data be restricted.c) We no longer need the personal data for the purposes of the processing, but you need it in order to establish, enforce or defend legal claims.You can also object to processing under Article 21 (1) GDPR pending the verification of whether our legitimate interests take precedence over your privacy.
Right to data portability
For information that you have provided to us and is necessary for the performance of an agreement with us and which is processed automatically (i.e. not manually by us), you can request that the personal data about you be disclosed or transferred to another provider in a structured, commonly used and machine-readable format (data portability).
Automated processing, including profiling
There will be no automated processing, including profiling, based on your personal data that has legal effects or significantly affects those to whom the personal data relates.
