PRIVACY POLICY

This privacy policy explains how Power Energy processes personal data.

​

​

1 Legislation

​

Here you can read about how we collect, store and protect personal data in accordance with applicable data protection legislation.

​

​

2 When do we collect personal data?

​

We may collect personal data in the following situations:

• When we are in contact with customers

• When we perform services and assignments for customers

• When we carry out marketing activities

• When you use our website, power-energy.no

• When you apply for a position with us

• Handling our employees

​

​

3 Controller and processor

​

When we process personal data in connection with our own services, we act as the controller under data protection legislation. This means that we are responsible for ensuring that the personal data we process is handled lawfully, securely and transparently, and that your rights are protected.

In some situations, we act as a processor on behalf of a customer. This means that we process personal data according to the customer’s instructions. This may apply, for example, to customer assignments or advisory services where the customer determines which personal data we are to process. In such cases, we enter into a data processing agreement with the customer and process the personal data in accordance with that agreement.

​

​

4 Your rights

​

If you wish to exercise your rights, please contact our data protection officer by email at GDPR@power-energy.no. We will respond without undue delay and no later than within 30 days.

Below we explain the rights that are most relevant to our processing activities. You can also read more about your rights on the Norwegian Data Protection Authority’s website.

​

4.1 Access

You have the right to receive information about how we process personal data, including general information about the purposes and basis for the processing. This information is provided in this privacy policy.

If you request access to personal data we may hold about you, we will make reasonable enquiries to determine whether we process such data. We may refuse requests that are manifestly unfounded or excessive, in accordance with Article 12(5) of the General Data Protection Regulation.

​

4.2 Deletion and rectification

You may request that personal data about you be deleted if it is no longer necessary for the purpose for which it was collected, and we are not legally required to retain it.

In some cases, we may have a legitimate interest in retaining information for a longer period, for example where this is necessary to defend ourselves against legal claims or allegations, in accordance with Article 6(1)(f) of the General Data Protection Regulation.

If the personal data we process about you is inaccurate or incomplete, you may request that it be corrected, subject to the limitations set out in data protection legislation and other applicable laws.

​

4.3 Complaint

If you believe that we are not complying with data protection legislation, we encourage you to contact our data protection officer first.

You also have the right to lodge a complaint about our processing of personal data with the Norwegian Data Protection Authority.

​

​

5 Personal data we collect and what we use it for

​

5.1 Customer contact and marketing

When we communicate with existing, former or potential customers, we may process contact information for relevant contact persons, such as name, email address, telephone number and job title. We process this information because we have a legitimate interest in maintaining customer relationships and marketing our services, in accordance with Article 6(1)(f) of the General Data Protection Regulation.

​

5.2 Use of our website

We use cookies to help our website recognise your computer or mobile device. Cookies may be used, for example, to collect visitor statistics. We use Google Analytics to obtain information about website traffic and how visitors use our pages.

​

5.3 Employees and job applicants

The personal data we process about employees may include personal details, salary information, evaluations, next-of-kin information and education or position level. The legal basis for this processing is the performance of the employment contract, in accordance with Article 6(1)(b) of the General Data Protection Regulation, and compliance with our legal obligations to report information about employees to public authorities, in accordance with Article 6(1)(c), or Article 9(2)(b), cf. section 6 of the Norwegian Personal Data Act. Personal data is retained for as long as the employee is employed by us and is deleted 18 months after the employment relationship ends. Personal data that forms part of accounting material is retained in accordance with statutory bookkeeping requirements.

If you apply for a position with us, we need to process personal data about you in order to assess your application. The legal basis is taking steps at your request before entering into a possible employment contract, in accordance with Article 6(1)(b) of the General Data Protection Regulation. Personal data about applicants who are not hired is deleted after the recruitment process has been completed, and no later than within one year.

​

​

6 Information security and storage

​

We have procedures in place to protect the confidentiality and integrity of our customers’ data. Our security measures include role-based access control and requirements for privacy by design in our IT systems. When material containing sensitive personal data is transferred electronically to or from us, the information must always be protected against unauthorised access through encryption. This applies to special categories of personal data. Further information about our information security measures is available to customers upon request.

​

Where we store personal data in connection with customer assignments, we do so because it is necessary for the proper performance and follow-up of the assignment. Personal data is normally deleted five years after the assignment has been completed.

​

​

7 Transfer of personal data

​

7.1 Storage within the EEA

We store customer data, including personal data, in Norway or in other EEA countries. The same applies to information about employees and job applicants. We only use processors that store information in Norway or another EEA country.

For customers that are part of an international business, it may be necessary to transfer personal data to another country. If the transfer is made to a country outside the EEA that has not been approved by the European Commission, we will use an appropriate transfer mechanism, such as the European Commission’s standard contractual clauses, binding corporate rules for a group or group of undertakings, or transfer to recipients certified under the Trans-Atlantic Data Privacy Framework in the United States.

​

7.2 Our use of processors

We use service providers to operate our information systems and store data on our behalf. This may involve the processing of personal data as described in section 5 above. We have data processing agreements in place with all service providers that process personal data on our behalf.