Privacy notice

1. Introduction

In connection with your visit to our website and our Customers' use of the Service, REVIA may process personal data about you. Personal data means information that can be linked to a natural person, for example information about name, place of residence, telephone number and e-mail address. Processing refers to any use of personal data, such as collection, registration, compilation, storage and disclosure.

This privacy notice contains, among other things, information about which personal data REVIA processes, for which purposes they are processed, which third parties are involved, your rights and, not least, how REVIA safeguards the information. Please read the privacy notice carefully so that you gain a clear understanding of how REVIA collects, uses, protects or otherwise handles your personal data.

If you have questions about how REVIA processes personal data, you are welcome to contact us at kontakt@revia.no.

2. Data controller responsibility

Unless otherwise stated here, REVIA AS (org. no. 834 199 262, Tordenskjolds gate 9, 4612 Kristiansand S) is the data controller where the personal data is collected directly from you as the data subject. This means that REVIA is obliged to protect your personal data and inform you about how REVIA uses your personal data.

For content that Customers upload to the Service (Customer Data), the Customer is the data controller and REVIA is the data processor. Such processing is regulated by REVIA's data processing agreement, which is an appendix to the terms. This privacy notice applies to the information for which REVIA itself is the data controller: account information, licences, invoicing, customer follow-up, support and use of the website.

'Data controller' means the natural or legal person who determines the purpose of the processing of personal data and which means are to be used in such processing. The data controller has the overall responsibility for the processing of your personal data.

3. Personal data we process

To achieve the purposes mentioned in this notice, REVIA may process personal data about you, including but not limited to:

• Name
• E-mail address
• Telephone number
• Employer
• Usage data

Personal data is collected directly from you or from our Customers.

4. Purpose and legal basis for processing

REVIA processes your information for the following purposes and on the following grounds:

• Performance of a contract: To the extent necessary to enter into or perform an agreement and to handle any questions or complaints. REVIA's legal basis for such processing is the General Data Protection Regulation Article 6(1)(b).
• Marketing: If you have consented to it, REVIA will use your e-mail address to send you newsletters with offers and information. REVIA's legal basis for such processing is Article 6(1)(a). Remember that subscribing to REVIA's newsletter is voluntary and your consent can be withdrawn at any time by unsubscribing from the newsletter or contacting us.
• Legal obligations: REVIA processes your name, e-mail address, telephone number and purchase and payment history in order to fulfil the legal obligations resting on REVIA. REVIA's legal basis for such processing is Article 6(1)(c).
• Legitimate interest: REVIA processes anonymised and aggregated usage data, statistics and other non-personal information related to use of the Service for product improvement, analysis and research. REVIA's legal basis for such processing is Article 6(1)(f). REVIA has assessed that this processing is necessary to further develop and improve the Service, and that the processing does not come at the expense of the data subject's rights and freedoms, since the information is anonymised before use.

REVIA may also process personal data for purposes other than those mentioned in this privacy notice, provided that these purposes are compatible with the original purposes for which the personal data was collected.

5. Your rights

As a data subject you have the following rights:

• Information: You have the right to receive information about which categories of your personal data REVIA processes and how they are processed.
• Access: You can request a copy of the personal data REVIA processes about you.
• Rectification: You can require that your personal data be corrected or supplemented.
• Erasure: You can require that REVIA delete all your personal data, unless we are legally required to retain the personal data for a certain period or otherwise have the right to retain the information under law.
• Restriction: You can request that REVIA restrict the processing of your personal data.
• Data portability: You can request to receive the personal data REVIA holds about you, or to have the data transferred to a third party, in a structured, commonly used and machine-readable format.
• Objection: You can object to REVIA's use of your personal data for direct marketing, including profiling for direct marketing purposes. You can also object to being subject to decisions based solely on automated processing.
• Consent: If you have consented to REVIA processing your personal data, you can withdraw such consent at any time.

REVIA may need to ask you to confirm your identity to ensure that you are entitled to exercise rights related to the personal data REVIA processes.

6. Storage

REVIA stores your personal data for as long as is necessary for the purpose for which the information was collected, unless REVIA must store the information for a longer period as a result of law, or if REVIA has a particular need in connection with, for example, complaints or claims made against or by REVIA.

If you have a user account, REVIA will store your personal data until you close the account, unless otherwise agreed. If you have consented to receive a newsletter from REVIA, REVIA will store your e-mail address until you unsubscribe from such newsletter.

REVIA stores information about your order for five years in order to fulfil our obligations under accounting and bookkeeping legislation. When your personal data is no longer necessary for the purposes for which it was collected, REVIA has procedures to destroy, delete or anonymise the personal data.

7. Third parties

REVIA discloses your personal data to the extent necessary for administration and operations, and to comply with applicable legislation. REVIA may otherwise disclose your personal data to authorities, insurance companies, and REVIA's suppliers of payment solutions, IT systems and software, marketing services, operations and accounting reporting.

All third parties that receive personal data from REVIA are obliged to treat the personal data confidentially and to fulfil their obligations in accordance with applicable data protection legislation.

Use of AI services and data processors

To deliver the Service's AI functionality and data storage, REVIA uses the following third-party service providers as data processors:

• Anthropic — AI models for analysis and guidance, delivered via Amazon Web Services (AWS) Bedrock. All data processing takes place in the EU (Frankfurt).
• Cohere — Ranking of search results, delivered via Amazon Web Services (AWS) Bedrock. All data processing takes place in the EU (Frankfurt).
• Amazon Web Services (AWS) — Infrastructure for AI services. Data processing takes place in the EU (Frankfurt).
• Google Cloud — AI services via Vertex AI. Data processing takes place in the EU.
• Mistral AI — AI services for document processing. Data processing takes place in the EU (France).
• Supabase — Data storage and database services. Data storage takes place in the EU (Ireland).
• Vercel — Hosting and delivery of the web application. Data processing takes place in the EU (Dublin, Ireland).
• Sentry — Error logging and stability monitoring. Data processing takes place in the EU (Frankfurt).
• Resend — Sending of e-mail from the Service (invitations, notifications and confirmations).
• HubSpot — Customer relationship management (CRM) for contact and deal information.

The sub-processors that process Customer Data on behalf of the Customers are listed in Appendix 3 to the data processing agreement; see the data processing agreement.

All data processing and data storage related to AI services and customer information takes place within the EU/EEA. If it should exceptionally become necessary to transfer data outside the EU/EEA, this will be done on the basis of the European Commission's standard contractual clauses (SCCs) or adequacy decisions pursuant to GDPR Articles 46 and 45.

REVIA has entered into data processing agreements (DPAs) with all of the suppliers listed above. The suppliers are not entitled to use Customer Data beyond what is necessary to deliver the service.

8. Cookies

REVIA uses cookies to ensure that the service functions correctly and to understand how it is used.

• Necessary: Login, session data and storage of your consent choice. These are always active.
• Analytics: REVIA uses PostHog to understand usage patterns and improve the service. These are only activated if you accept analytics cookies.

You choose for yourself whether to accept analytics cookies via the banner shown on your first visit. You can change your choice at any time by deleting cookies in your browser.

9. Security

It is important to REVIA that your personal data is safe. REVIA therefore maintains and applies reasonable measures for physical, procedural and technical security with regard to the offices and information storage systems involved in your personal data, in order to prevent loss, misuse, unauthorised access, disclosure or alteration of your personal data.

Your personal data is kept behind secured networks and is accessible only to a limited number of people who have special access rights to such systems and are required to keep the personal data confidential. REVIA uses computer systems with limited access in facilities that apply physical security measures.

If any of REVIA's employees misuses personal data, this will be regarded as a serious breach for which disciplinary action may be taken, including termination of employment.

10. International transfer

REVIA processes and stores all personal data within the EU/EEA. All sub-suppliers that process personal data on behalf of REVIA have their data processing located in the EU (see section 7 for an overview).

If it should exceptionally become necessary to transfer personal data to countries outside the EU/EEA, REVIA will ensure that adequate safeguards are in place, for example by using the European Commission's standard contractual clauses (SCCs), or that the country is approved by the European Commission as a country with an adequate level of protection pursuant to GDPR Articles 45 and 46.

11. Changes

This privacy notice may be updated from time to time due to changes in REVIA's processing or in applicable law. If REVIA has your contact information, REVIA will inform you of material changes and any new purposes and other relevant information before REVIA processes your personal data for a new purpose.

12. Contact

If you wish to withdraw your consent, exercise your rights regarding access, information, rectification, erasure, restriction, data portability or the right to object to the processing of personal data, or if you have questions or requests regarding this privacy notice or REVIA's processing, or wish to submit a complaint, please contact us:

REVIA AS

Org. no.: 834 199 262

Tordenskjolds gate 9, 4612 Kristiansand S

E-mail: kontakt@revia.no

REVIA will investigate all complaints. If a complaint is found to be justified, REVIA will take all reasonable steps to resolve the problem. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) regarding REVIA's processing of your personal data. For information on how to contact the Norwegian Data Protection Authority, visit Datatilsynet's website (www.datatilsynet.no).