GNIST · PRIVACY

Privacy Policy

What data we handle, why, for how long, and what your rights are. In plain words.

In short

  • No analytics, ads or trackers, and the site loads nothing from third parties.
  • The site sets no cookies. It keeps two small preferences in your browser, nothing more.
  • If you write to us, we use your details to answer you, and we never sell them.

01Who we are

The controller of your personal data is GNIST Group, Storgata 00, 0155 Oslo, Norway, Org. 000 000 000. For any privacy matter, write to hi@gnist.eu.

02What this policy covers

This policy covers gnist.eu and your contact with us by email or phone.

When we process personal data on behalf of clients within their projects, we act as a processor under a data processing agreement with the client, and the client’s policy applies.

03The data we process

When you visit the site
Our hosting and content delivery provider (Cloudflare) processes the technical data needed to deliver and protect the pages: IP address, browser and device type, the page requested and the time. We don’t use it to identify you, and we keep no visitor logs of our own.
Storage in your browser
We keep two preferences in your browser; they are never sent to us. Details are on the cookies and storage page.
When you contact us
Your name, email or phone number, the content of your message and any attachments, and your organisation if you mention it. We use them to answer you, prepare a proposal or estimate, and start a contract if we agree on one.
When you apply for a job
Your CV and anything you send with it. We use it only to assess your application and contact you about it.

04Legal basis

We process data under the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act:

  • Delivering and protecting the site: our legitimate interest in running a secure, working website (Art. 6(1)(f)).
  • Answering you and preparing proposals: steps you request before a contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).
  • Job applications: steps before a contract (Art. 6(1)(b)). If we want to keep your application for future roles, we ask for your consent first (Art. 6(1)(a)).
  • Accounting records: legal obligation (Art. 6(1)(c)).

05How long we keep it

  • Technical visit data: kept briefly by our hosting provider under its own policy; we keep no copy of our own.
  • Correspondence: as long as needed to deal with you, and at most 24 months after our last contact, unless a contract or the law requires longer.
  • Job applications: deleted within 6 months after the recruitment ends, or after 12 months if you agree to us keeping them for future roles.
  • Accounting documents: the period required by the Norwegian Bookkeeping Act, generally five years.

06Who we share it with

  • Our hosting and content delivery provider (Cloudflare), to deliver and protect the site.
  • The email providers through which we receive your messages.
  • Our professional advisers, such as lawyers and accountants, when needed and under confidentiality.
  • Public authorities, when the law requires it.

We don’t sell personal data, and we don’t share it for advertising.

07Transfers outside the EEA

Cloudflare’s network operates worldwide, so some technical data may be processed outside the European Economic Area. Whenever personal data is transferred outside it, we make sure an appropriate safeguard is in place, such as a European Commission adequacy decision or the EU Standard Contractual Clauses.

08Security

Every page of the site is served over an encrypted connection (HTTPS), and we limit access to your messages and attachments to the people on our team who need it.

09Your rights

  • Access your data and get a copy of it.
  • Correct inaccurate data.
  • Have your data erased.
  • Restrict or object to processing.
  • Receive your data in a machine-readable format.
  • Withdraw your consent at any time, where processing is based on consent.

To use any of these rights, write to hi@gnist.eu; we will reply within one month. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or to the data protection authority in your country.

10Children

The site is meant for businesses and professionals, not for children under 16, and we don’t knowingly collect their data.

11Changes

We may update this policy when the site, our services or the law change. The date at the top shows the latest update, and we will clearly flag any material change.

12Contact us

For any question about this page, write to hi@gnist.eu. Responsible entity: GNIST Group, Storgata 00, 0155 Oslo, Norway, Org. 000 000 000.