01
Introduction
This Privacy Policy explains how Norland & Co AS (“we”, “our”, “us”) collects, uses, stores, and protects personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Norwegian privacy laws.
We primarily process business contact information for communication with potential clients, partners, and the people who receive our outreach.
02
Data Controller
Norland & Co AS is the data controller for all processing of personal data described in this policy. For any questions or requests regarding your personal data, contact mads.trippestad@norlandco.com.
03
Data We Collect
We collect only the personal data necessary for legitimate business purposes. This may include:
- Contact details
- Name, company, position, email address, and phone number, to respond to inquiries, schedule meetings, and manage relationships.
- Communication data
- Correspondence through email, HubSpot, WhatsApp, or LinkedIn, to maintain business communications.
- Website visits
- When you visit our homepage, we record that a visit happened, where you came from, and whether you use a phone, tablet, or computer. If you have opened your personal page in the same browser, the visit is linked to you.
- Transactional data
- Billing details, company name, and VAT number collected through Stripe, to issue invoices and process payments.
- Meeting bookings
- Name, email address, and the time you choose when you book a meeting through Calendly on your personal page, to hold the meeting.
- Personal page visits
- If you received a box, the page linked from your card is made for you. We record when it is opened and how it is used, to know whether, and when, to follow up.
We do not collect or process sensitive personal data.
04
How Data Is Collected
Personal data is collected when you:
- Book a meeting through the Calendly scheduler on the personal page linked from your card.
- Communicate with us through email, WhatsApp, or LinkedIn.
- Enter into a contract or payment through Stripe or PandaDoc.
- Visit our website or the personal page linked from your card.
If you received a box from us, we found your name, role, and business address in publicly available sources only, such as LinkedIn, company websites, and public business registers. We use this information for one business introduction.
We do not set cookies ourselves, and we do not use third-party analytics or advertising tools. We keep a small note in your browser’s local storage so we can recognise a return visit from the person a page was made for. The Calendly scheduler on personal pages sets its own cookies.
05
Purpose & Legal Basis for Processing
All processing is performed in accordance with Article 6 of the GDPR, based on:
- Legitimate interest
- Art. 6(1)(f): communicating with potential clients and partners in a B2B context.
- Contractual necessity
- Art. 6(1)(b): to deliver agreed services, send proposals, and manage invoicing.
- Legal obligation
- Art. 6(1)(c): compliance with bookkeeping and tax laws.
We do not rely on consent except where required by law (e.g., for optional marketing messages).
We do not make automated decisions that have legal or similarly significant effects on you.
06
Use of Data
Your personal data is used to:
- Respond to requests and schedule meetings.
- Communicate about ongoing or potential projects.
- Manage invoicing and contractual documentation.
- Maintain security and compliance.
- Improve our communication and website experience.
We may also use physical mail for business correspondence or marketing purposes.
07
Sharing of Data
We do not sell personal data. We share limited information with trusted third-party processors who assist in our operations:
| Processor | Purpose |
|---|---|
| HubSpot | CRM and communication. |
| Cloudflare | Hosting of the website, personal pages, and their videos. |
| Calendly | Meeting booking. |
| Stripe | Payment processing. |
| PandaDoc | Contracts and proposals. |
| Google Workspace | Email and file storage, including the videos and cards for each box. |
| Anthropic (Claude) | AI assistance with research and writing. |
| Strawberry | AI browser used for research. |
| Make and ntfy | Notifications when a personal page is visited. |
| Bring / Posten and DHL | Delivery of boxes. |
All processing partners act as data processors under binding agreements ensuring compliance with GDPR. We may also share contact data with advisors or project partners when necessary for coordination and service delivery.
If you received a box on behalf of one of our clients, we share your name, role, and any meeting you book with that client, so they can hold the meeting.
08
International Data Transfers
Some data may be transferred outside the EU/EEA (e.g., to HubSpot, Stripe, Calendly, Google, or Anthropic servers in the U.S.). All such transfers are protected by the EU–US Data Privacy Framework, where the provider is certified, or by Standard Contractual Clauses (SCCs) approved by the European Commission.
09
Data Retention
We store data only for as long as necessary:
| Data type | Retention period |
|---|---|
| Contact, research & page visits | Up to 12 months after the last interaction, or after the box is sent if there is none. |
| Contract & payment | 5 years, in accordance with Norwegian accounting law. |
Data may be deleted earlier upon request, unless required for legal or accounting purposes.
10
Security Measures
We apply appropriate technical and organizational measures to protect personal data:
- Encrypted communication (SSL / TLS).
- Two-factor authentication for internal accounts.
- Access controls and cloud-based data management.
- Regular security updates on all integrated platforms.
All systems used are cloud-based and hosted by reputable providers with strong data protection standards.
11
Your Rights
You have the following rights under GDPR:
- Access
- Request a copy of your data.
- Rectification
- Correct inaccurate information.
- Erasure
- Request deletion (the “right to be forgotten”).
- Restriction
- Limit how your data is used.
- Portability
- Receive your data in a structured, machine-readable format.
- Objection
- Object to processing based on legitimate interests.
- Withdrawal of consent
- Where processing is based on consent.
To exercise these rights, contact mads.trippestad@norlandco.com. We will respond within 30 days.
12
Direct Marketing & Opt-out
We may contact business representatives through digital or physical communication channels for legitimate business purposes. You can opt out at any time by contacting us at mads.trippestad@norlandco.com.
We do not operate newsletters or mass-marketing lists.
13
Data Subject Complaints
If you believe your personal data has been processed in violation of GDPR, you may contact:
Datatilsynet
The Norwegian Data Protection Authority.
datatilsynet.no · postkasse@datatilsynet.no
14
Changes to This Policy
We may update this Privacy Policy from time to time to reflect operational or legal changes. The latest version will always be available on our website with an updated “Effective Date.”
15
Contact
For all inquiries or requests related to this Privacy Policy, please contact us.
Norland & Co AS
- Address
- Gunnar Schjelderups vei 13 C
0485 Oslo, Norway - Org. no.
- 927 677 822