Privacy policy

Smartakva AS is the data controller responsible for your Personal Data.

Under the GDPR, we may only process your Personal Data where we have a valid legal basis to do so. Depending on the purpose, we rely on one or more of the following legal bases:

• Performance of a contract (GDPR Art. 6(1)(b)): Providing your Account and access to course content (Services/Systems)
• Performance of a contract (GDPR Art. 6(1)(b)) and compliance with legal obligations, e.g. bookkeeping requirements (GDPR Art. 6(1)(c)): Processing payments
• Legitimate interest (GDPR Art. 6(1)(f)): Internal record keeping and improvement of our products/services
• Consent (GDPR Art. 6(1)(a)), in accordance with Section 15 of the Norwegian Marketing Control Act (markedsføringsloven), which requires prior consent for electronic marketing: Sending you marketing communications by email
• Consent (GDPR Art. 6(1)(a)): Market research contact by email, telephone or mail
• Consent (GDPR Art. 6(1)(a)), in accordance with Section 2-7b of the Norwegian Electronic Communications Act (ekomloven) — see our Cookie Policy: Use of non-essential cookies (analytics, marketing)
  
  You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

5.1 We only retain Personal Data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

5.2 As a general rule:

• Account and course-related Data is retained for the duration of your use of the Services, and for up to [insert period, e.g. 3 years] after your last activity, to allow you to resume your studies or re-access certificates.
• Data submitted through any communications System (e.g. support chat, messages) may be retained for up to one year.
• Financial and invoicing records are retained for the period required under the Norwegian Bookkeeping Act (bokføringsloven), currently 5 years.
• Marketing consent and related contact data is retained until you withdraw consent or unsubscribe, after which it is deleted or anonymised within a reasonable period.

5.3 When Data is no longer needed for these purposes, it will be securely deleted or anonymised.

6.1 Unless we are obliged or permitted by law to do so, and subject to Clause 7, your Data will not be disclosed to third parties, including our affiliates and/or other companies within our group, except as described in this Policy.

6.2 All Personal Data is stored securely in accordance with the GDPR and the Norwegian Personal Data Act. For more details on security, see Clause 10 below.

6.3 We may use your Data for the following purposes, as set out in Clause 4 above: 6.3.1 internal record keeping; 6.3.2 improvement of our products/services; 6.3.3 transmission by email of promotional materials that may be of interest to you, where you have consented to receive these; 6.3.4 contact for market research purposes, which may be done using email, telephone, fax or mail, where you have consented to this. Such information may be used to customise or update the Web Site.

7.1 Smartakva may, from time to time, employ the services of other parties (data processors) for matters that may include, but are not limited to, payment handling, delivery of purchased items, marketing automation, and customer support. We currently use Hubspot for marketing and communication purposes.

7.2 Any Data used by such processors is used only to the extent required by them to perform the services that Smartakva requests, under a data processing agreement that complies with GDPR Article 28. Use for any other purpose is strictly prohibited.

7.3 International transfers: Some of our processors, including Hubspot, may process Data outside the EU/EEA (e.g. in the United States). Where this occurs, we ensure an adequate level of protection through appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. You may request further details of these safeguards by contacting us (see Clause 2).

8.1 Smartakva may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties. Data provided by Users will, where relevant to any division so transferred, be transferred along with that division, and the new owner or controlling party will, under the terms of this Policy, be permitted to use the Data for the purposes for which it was supplied by you.

8.2 In the event that any Data submitted by Users is transferred in such a manner, you will be contacted in advance and informed of the changes. When contacted, you will be given the choice to have your Data deleted or withheld from the new owner or controller, where this is possible under applicable law.

Under the GDPR, you have the following rights in relation to your Personal Data:
  

• 9.1 Right of access – you may request confirmation of whether we process your Data and obtain a copy of it. The first copy is provided free of charge; we may charge a reasonable fee for further copies or for manifestly unfounded or excessive requests.
• 9.2 Right to rectification – you may request correction of inaccurate or incomplete Data.
• 9.3 Right to erasure ("right to be forgotten") – you may request deletion of your Data where certain conditions apply.
• 9.4 Right to restriction of processing – you may request that we limit how we use your Data in certain circumstances.
• 9.5 Right to data portability – you may request that we provide your Data in a structured, commonly used, machine-readable format, or transfer it to another controller, where technically feasible.
• 9.6 Right to object – you may object to processing based on legitimate interest or to direct marketing at any time.
• 9.7 Right to withdraw consent – where processing is based on consent, you may withdraw it at any time (see Clause 4).
• 9.8 Right to lodge a complaint – if you believe we have not processed your Data in accordance with the law, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet), Postboks 458 Sentrum, 0105 Oslo, www.datatilsynet.no.

To exercise any of these rights, please contact us using the details in Clause 2.

10.1 Wherever you are required to submit Data, you will be given options to restrict our use of that Data. This may include the following:

• 10.1.1 use of Data for direct marketing purposes; and 10.1.2 sharing Data with third parties.

11.1 You may access certain areas of the Web Site without providing any Data at all. However, to use all Services and Systems available on the Web Site, you may be required to submit Account information or other Data.

11.2 You may restrict your internet browser's use of Cookies. For more information, see our separate Cookie Policy.

12.1 You may access your Account at any time to view or amend the Data. You may need to modify or update your Data if your circumstances change. Additional Data as to your marketing preferences may also be stored, and you may change this at any time.

Data security is of great importance to Smartakva. To protect your Data, we have put in place suitable technical and organisational measures to safeguard and secure Data collected online, in accordance with GDPR Article 32.

Smartakva reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law. Any changes will be posted on the Web Site, and you are deemed to have accepted the terms of the Policy on your first use of the Web Site following the alterations.

If you have any questions regarding this Privacy Policy, or wish to exercise any of your rights under Clause 9, please contact us at post@smartakva.no.