Privacy statement and cookies

Summary

This privacy statement explains what information we collect about you, what we use it for, and who we share it with. It also describes the rights you have in relation to your data and who you can contact for further information or questions.

Data controller

The data controller for personal data processed in connection with orgsec.no and ORGSEC is Bråten Innovation AS, Postboks 5218 Majorstuen, 0303 OSLO, Norway. ORGSEC is a brand owned by Bråten Innovation AS. Questions about privacy can be sent to post@orgsec.no.

How we protect your privacy

Privacy is part of how we work with security. We assess privacy risks before introducing new solutions or processing activities, and we apply these principles:

• Transparency: you should know what data we process about you, and why.
• Purpose limitation: data is used only for the purposes for which it was collected.
• Data minimisation: we do not collect more data than we need.
• Deletion: data is deleted or anonymised when we no longer need it.
• Privacy by design: privacy is built in from the moment solutions and services are designed.
• Agreements with suppliers: everyone who processes data on our behalf is bound by data processing agreements.

Scope

ORGSEC is committed to protecting your personal data. This statement describes how we process personal data collected through the website orgsec.no, through the contact form and through the ORGSEC member area.

In this statement, information about you is referred to as "personal data". By "processing" we mean collecting, using, storing, protecting and deleting such data.

Links to third parties

The website may contain links to websites operated by others that do not follow ORGSEC's privacy practices. When you visit such a website, this statement no longer applies. We recommend that you read the privacy statement of that website before providing personal data there.

Collection of personal data

When you use the website, we may collect information such as name, job title, organisation, address, email address and telephone number, either directly from you or from the systems we use to manage customer relationships and access to the ORGSEC area.

Examples of how you may provide us with personal data:

• when you contact us through the contact form;
• when you subscribe to newsletters or publications;
• when you respond to surveys or register for seminars, courses and exercises;
• when you are given access to the ORGSEC area as a member or user;
• when you visit the website while logged in to a social media platform; and
• when you give us a business card or other contact details.

We do not intend to collect special categories of personal data through the website, such as data about ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, genetic or biometric data, sex life or criminal offences. We therefore ask you not to provide such information in the contact form or in enquiries to us.

As a principle, we collect only the data necessary to answer your enquiry or deliver the service. If you believe we have collected more data about you than necessary, please let us know.

Use of personal data

We use personal data for the purposes described in this statement, or as made clear where the data is collected, including:

• to answer enquiries and follow up agreements with your organisation;
• to administer the website and the ORGSEC area, including verifying your identity and preventing unauthorised access;
• to deliver programmes, courses, training and exercises, and document completion to the organisation;
• to develop our services and carry out quality assurance and risk management; and
• to ensure that the terms of use of our services are followed.

We do not sell personal data, and we do not collect it for others to use in marketing.

Legal basis

The processing of your personal data may rely on one or more of the following grounds in GDPR Article 6:

• processing necessary to enter into or perform an agreement with you or your organisation (point b);
• processing necessary to comply with legal obligations, such as accounting requirements (point c);
• our legitimate interest in delivering information and services efficiently and running our business responsibly, provided this does not override your rights (point f); and
• consent, where none of the other grounds apply, for example for newsletters (point a).

Security of personal data

We have implemented technical and organisational measures to protect personal data against loss, misuse, alteration and destruction. Only people with a work-related need have access to the data, and they are bound by confidentiality.

Traffic between your browser and orgsec.no is encrypted, and logged-in users are automatically logged out after a period of inactivity.

Although we apply security measures as soon as we receive the data, transmission of data over the internet, including email, is never completely secure. We therefore cannot guarantee the security of data transmitted to or from us.

When we carry out assessments

In assessments we carry out on behalf of an organisation, the organisation is the data controller and we are the data processor. A separate data processing agreement then governs purpose, access, retention and deletion.

Responses are reported in aggregate. No unit is reported with so few respondents that individuals can be identified, and free-text responses are only reproduced when this can be done without identifying the respondent.

Cookies

Cookies are small text files placed on your computer or mobile device by websites you visit. They are mainly used to make a website work, or work better, and to provide information to the website owner.

Necessary cookies. orgsec.no uses cookies that are necessary for the pages, the contact form and the login to work. These are set by Kajabi and do not require consent.

We do not use Google Analytics, advertising pixels or other analytics or marketing tools that set cookies. You will therefore not be asked to consent to cookies when you visit orgsec.no.

In the ORGSEC area we record, by agreement with you or your organisation, who has started and completed programmes, so that completion can be documented.

You can delete or block cookies at any time in your browser settings. If you block necessary cookies, login and forms may stop working.

Transfer of personal data

Processors. The website, contact form and login are delivered on the Kajabi platform, which acts as our data processor. We may also use other providers of services such as hosting, storage, backup and security. We use only providers that are obliged to maintain security and confidentiality, to process data according to our instructions and to impose the same requirements on their subcontractors.

Transfers outside the EEA. Kajabi is a US company, so data may be processed in the United States. Such transfers are based on the EU Standard Contractual Clauses or another valid transfer mechanism under the GDPR.

Other cases.

Reorganisation or sale. If the business or parts of it are reorganised or sold, personal data may be transferred to the new owner, who then takes over the obligations in this statement.

We may also share personal data when you have expressly asked us to, when necessary to run a seminar or exercise hosted by another party, or when required by law or regulation, for example towards public authorities.

Storage and deletion

We keep personal data only for as long as we need it for the purpose for which it was collected, or as long as the law requires. Enquiries that do not lead to an agreement are deleted within one year. Data linked to an agreement is kept for as long as the agreement runs and thereafter for as long as documentation and accounting requirements demand, before it is deleted or anonymised. Contact details on mailing lists are kept until you unsubscribe or ask us to delete them.

Marketing and newsletters

We only send you marketing and newsletters by email if you have consented, or if you are a customer and the law permits it. If you have chosen a subscription, you will receive an email when there is new content within the topics you have selected.

We respect registrations in the Norwegian Register of Reservation against Direct Marketing (Reservasjonsregisteret) and do not carry out telemarketing or addressed advertising to people who have registered.

You can unsubscribe at any time by following the link in the email or by contacting us. When you unsubscribe, we may keep enough information to make sure you receive no further mailings.

Your rights

Under the GDPR you have the right:

• to access, and receive a copy of, the personal data we hold about you;
• to have inaccurate or incomplete data corrected;
• to have data deleted when there is no longer a basis for keeping it;
• to request restriction of processing, and to receive your data in a common format (data portability);
• to object to processing based on our legitimate interest; and
• to withdraw consent at any time, without affecting processing that took place before consent was withdrawn.

We do not use automated decision-making or profiling that has legal effects for you or similarly significantly affects you.

Contact us at post@orgsec.no if you wish to exercise your rights. We will reply without undue delay and within 30 days at the latest. You can also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Children

Our services are aimed at working life and are not intended for children. We do not knowingly collect personal data about persons under 18.

Changes

This statement is updated when our processing changes. The date at the top shows the latest change.

For significant changes we give notice on the website before the changes take effect. Earlier versions of the statement are available on request.

Complaints

If you believe we are not processing your personal data in accordance with the rules, please contact us first so that we can correct any errors and answer your questions. If you are still not satisfied, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Definitions

• Personal data: any information that can be linked to you as an individual, directly or indirectly.
• Data controller: the party that determines the purpose and means of the processing.
• Data processor: the party that processes personal data on behalf of the controller.
• Anonymised data: data that can no longer be linked to an individual.
• Consent: a freely given, specific, informed and unambiguous indication that you accept a processing activity.

Questions

If you have questions or comments about this privacy statement, you are welcome to contact us at post@orgsec.no.