Privacy Policy and GDPR Compliance Statement

In this privacy policy, we explain what types of personal information we collect and how we process it.

Below, you will find information about the personal data we collect, why we do so, and your rights regarding the processing of your personal data.

Roles and Responsibilities

Evolo Technologies AS is the data controller for personal data we process for our own purposes, including in connection with customer and user management, communication, and the development of our services.

When Evolo processes personal data on behalf of a customer through the Evolo Toppsystem, Evolo acts as a data processor. Such processing is governed by our data processing agreement.

Data Controller: Evolo Technologies AS
Corporate ID: 919 911 549
Contact Person: Heljar Suhr Mjøen
Email: heljar@evolo.no

Personal Data We Collect and Process

We process the following categories of personal data:

• Basic information: name

• Contact information: phone number, email address

• Customer activity: browsing and transaction history from our websites or electronic communications we send out. As well as technical information about the devices you use to visit the website, such as screen size.

• Cookies: We use necessary cookies to ensure the website functions properly. Cookies for analytics and marketing are used only with your consent. You can change or withdraw your consent through the consent settings on the website.

Personal data is collected when you contact us by phone or through the contact form, and when you use our websites and services. This may include technical data and information about user activity.

We process such information to ensure operations, detect errors, and improve our services. This processing is based on our legitimate interest, cf. Article 6(1)(f) of the General Data Protection Regulation (GDPR), provided that the conditions for this are met. Where consent is required, consent serves as the legal basis for processing.

Evolo uses external vendors for the operation and maintenance of the Evolo webToppsystem, and internal IT services. Personal data may be processed both within and outside the EU/EEA, depending on the vendor and service. The transfer of personal data to countries outside the EU/EEA must be carried out in accordance with the GDPR, with a valid legal basis for the transfer and the necessary safeguards in place.

How We Use Personal Data

Service Provision / Contract Formation

We process the names and contact information of representatives of customers and potential customers to enter into and follow up on agreements regarding our services. This processing is based on our legitimate interest in managing customer relationships and providing agreed-upon services, cf. Article 6(1)(f) of the General Data Protection Regulation.

Management of Customer Relationships

We process contact information and inquiries from customers’ contact persons to provide customer service, answer questions, handle complaints, and follow up on the customer relationship. This processing is based on our legitimate interest in providing customer service and necessary follow-up, cf. Article 6(1)(f) of the General Data Protection Regulation.

User Administration

When using Evolo Toppsystem, names, contact information, and information about user activity are processed to manage user access, ensure traceability, and safeguard the security of the service.

Personal data that Evolo processes on behalf of the customer is handled in accordance with the data processing agreement. When Evolo itself is the data controller, the processing is based on our legitimate interest in managing and securing the service, cf. Article 6(1)(f) of the General Data Protection Regulation.

AI Functionality

Evolo Toppsystem offers AI functionality through the assistant Eva. When using these features, relevant information from the service may be processed by external AI providers to generate responses, analyses, and assessments. If the information contains personal data, the processing is carried out on behalf of the customer and is governed by the data processing agreement.

Approved AI providers and relevant processing locations are listed at Overview of Sub-Processors.

Analysis, Business Development, and Service Improvement

We analyze the use of our websites and services to identify errors, understand usage patterns, and improve functionality. This may include technical data and information about user activity.

This processing is based on our legitimate interest, cf. Article 6(1)(f) of the General Data Protection Regulation (GDPR), where the conditions for this are met. Analytics tools that require consent are used only after consent has been given.

Sales and Marketing

We use personal data in connection with the sales and marketing of our products and services, for example when you receive emails from us. The legal basis for processing personal data for this purpose is consent. Emails sent for this purpose are sent with your consent, e.g., when you subscribe to a newsletter.

Customer Reviews

From time to time, we post customer reviews on our websites that may contain personal data. We always obtain customers’ consent before publishing their names along with their reviews. The legal basis for processing personal data for this purpose is consent.

System Monitoring, Troubleshooting, etc.

We monitor our systems for errors and issues. Some of these processes involve the storage and processing of personal data. The legal basis for processing personal data for this purpose is our legitimate interest.

Security, detection of fraud and criminal acts

We process personal data as part of our efforts to protect our users and ourselves against fraudulent activity, abuse, and criminal acts. The legal basis for processing personal data for this purpose is our legitimate interest.

Compliance with Legal Obligations

In certain cases, we are required to process personal data to comply with other legal obligations. An example of this is information related to sales, which we are required to record and retain in accordance with the Accounting Act. The legal basis for processing personal data for this purpose is that the processing is necessary to comply with a legal obligation to which we are subject.

Retention Period

We retain personal data for as long as necessary for the purpose for which it was collected, or when legislation requires further retention. When consent is withdrawn, processing based on that consent ceases, unless there is another lawful basis for processing.

Personal data that Evolo processes on behalf of customers through the Evolo Toppsystem is retained and deleted in accordance with the customer’s instructions and the data processing agreement.

Your Rights

If you wish to exercise any of your rights, please contact us at the email address listed at the top of the page.
You are entitled to a response without undue delay, and no later than one month.

Right to Access Your Personal Information

You may request a copy of all the information we process about you.

Right to rectification of personal data

You have the right to ask us to correct or supplement information that is incorrect or misleading.

Right to erasure of personal data

In certain situations, you may ask us to delete information about yourself.
Learn more about the right to erasure

Restriction of processing of personal data

In certain cases, you have the right to request that the processing of your personal data be restricted. Please contact us if you wish to exercise this right.

Objecting to the processing of personal data

If we process information about you based on our duties or on the basis of a balancing of interests, you have the right to object to our processing of information about you.

Data Portability

When processing is based on consent or a contract and is carried out automatically, you may have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.

You can file a complaint regarding our processing of personal data

We hope you will let us know if you believe we are not complying with the provisions of the Personal Data Act. Please feel free to contact us first through the contact method or channel you have already established with us. You may also file a complaint regarding our processing of personal data. You can do so with the Norwegian Data Protection Authority.

Other Processing of Personal Data

Facebook Pixel

‍Facebook Pixel is an analytics tool that helps us optimize ad campaigns on Facebook so that you, as a user, receive relevant information. It’s important to note that Facebook Pixel data is anonymous, meaning we cannot see an individual’s personal data. If you wish to avoid this type of tracking data, you can adjust your settings via our cookie banner.

Facebook Pixel is used only on our website, and not in our web app or mobile applications.

Google Analytics 4

Google Analytics 4 is a key tool we use to understand how visitors interact with our website. GA4 allows us to analyze and report data about website traffic in an anonymized and privacy-friendly manner.

We value your privacy and use GA4 to improve your user experience on our website while maintaining high privacy standards. If you wish to opt out of this type of tracking data, you can adjust your settings via our cookie banner.

Google Analytics 4 is used only on our website and not in our web app or mobile applications.

LinkedIn Insight

‍LinkedIn Insight is an analytics tool that helps us optimize ad campaigns on LinkedIn so that you, as a user, receive relevant information. If you wish to avoid this type of tracking data, you can adjust your settings via our cookie banner.

LinkedIn Insight is used only on our website, not in our web app or mobile applications.

Changes

The Privacy Policy is updated as needed, including in response to changes in our services or applicable regulations. The current version is always available in the Evolo Help Center.