Hopp til innholdet

Privacy policy

Download PDF

Privacy policy

DOWNLOAD PDF

This Privacy policy was last updated on 04 May 2026

Table of contents

1. About this policy

ITX Norge AS («ITX», «we») is committed to protecting personal data. This policy explains how we process personal data as a data controller—that is, when we decide why and how we process personal data.

Important distinction: When you use the ITX platform as an employee or customer of an ITX customer, ITX processes that data as a data processor on behalf of our customer, who is the controller. That processing is governed by the Data Processing Agreement between ITX and the relevant customer, not by this policy. If you are an end user or customer of a business that uses ITX, please contact that business to exercise your rights.

This policy applies to:

    • Visitors to itx.no and our other public websites
    • Prospective customers and people who contact us
    • Contact persons at our customers, suppliers and partners
    • Job applicants
    • Visitors to our premises
    • People who report security vulnerabilities to us

2. Data controller and contact details

Category What it is for
Controller
ITX Norge AS
Organization number
998 024 986
Address
Borgeskogen 4, 3160 Stokke, Norway
Email
support@itx.no
Telephone
+47 236 80 400
Privacy inquires
dpo@itxuc.com

3. What we process, why, and on what legal basis

3.1 Website visitors

Category What it is for
Personal data
IP address, browser and device type, operating system, referring URL, pages visited, time and duration of visit, language preference, cookie identifiers.
Purpose
Operating and securing the website; measuring and improving content; marketing
Legal basis
Strictly necessary cookies and server logs: legitimate interest (GDPR Art. 6(1)(f)) in operating a secure and functional website. Analytics and marketing cookies: consent (Art. 6(1)(a)), cf. the Electronic Communications Act § 3-15
Rentention
Server logs: 12 months. Cookie lifetimes vary by cookie and are listed in our Cookie Policy

Note: The technologies used to collect this data on your device, and how you control them, are described in our Cookie Policy.

3.2 Inquiries, demo requests and sales dialogue

Category What it is for
Personal data
Name, employer, job title, email, telephone number, and the content of your inquiry.
Purpose
Responding to enquiries, arranging demonstrations, preparing offers, and following up potential customer relationships
Legal basis
Steps taken at your request prior to entering into a contract (Art. 6(1)(b)), or legitimate interest in responding to business inquiries (Art. 6(1)(f)).
Rentention
24 months from the last contact, unless a customer relationship is established.

3.3 Marketing and newsletter

Category What it is for
Personal data
Name, employer, email address, and statistics on whether emails are opened and which links are clicked
Purpose
Sending newsletters and information about our services; measuring the effect of our marketing.
Legal basis
Consent (Art. 6(1)(a)), cf. the Marketing Control Act § 15. For existing customers, we may send information about similar services based on the existing customer relationship, cf. the Marketing Control Act § 15 third paragraph.
Rentention
Until you withdraw your consent or unsubscribe. Every message contains an unsubscribe link.

3.4 Contact persons at customers, suppliers and partners

Category What it is for
Personal data
Name, employer, job title, work email, work telephone, role in the contractual relationship, correspondence, and — for platform administrators — login identifier and activity logs in administrative interfaces.
Purpose
Administering the contractual relationship, delivering and supporting the service, invoicing, account management, and service notifications.
Legal basis
Legitimate interest in administering a business relationship with a legal person (Art. 6(1)(f)); legal obligation for accounting records (Art. 6(1)(c)), cf. the Bookkeeping Act.
Rentention
For the duration of the contractual relationship plus 3 months. Accounting documentation is retained for five years after the end of the financial year, cf. the Bookkeeping Act § 13.

3.5 Support requests

Category What it is for
Personal data
Name, contact details, employer, and any information you include in a support request — including screenshots, log extracts and system data.
Purpose
Investigating and resolving reported issues, and improving the service.
Legal basis
Performance of the contract with the customer (Art. 6(1)(b)) and legitimate interest in providing effective support (Art. 6(1)(f)).
Rentention
24 months from case closure.

Note: Where a support request contains personal data belonging to a customer’s own data subjects, ITX processes that data as a processor under the relevant Data Processing Agreement.

3.6 Job applicants

Category What it is for
Personal data
Name, contact details, CV, application letter, education and employment history, references, and any results from interviews or assessments.
Purpose
Assessing applications and administering recruitment processes.
Legal basis
Steps taken at the applicant’s request prior to entering into an employment contract (Art. 6(1)(b)) and legitimate interest in a documented recruitment process (Art. 6(1)(f)).
Rentention
Deleted 3 months after the position is filled, unless you consent to us retaining your application for future opportunities. Open applications sent to karriere@itx.no are retained for 6 months

3.7 Visitors to our premises

Category What it is for
Personal data
Personal data Name, employer, host, time of arrival and departure.
Purpose
Physical access control, security, and emergency evacuation
Legal basis
Legitimate interest in securing our premises and information assets (Art. 6(1)(f)).
Rentention
3 months.

3.8 Security vulnerability reports

Category What it is for
Personal data
Name, contact details, and the content of the report, where provided
Purpose
Receiving, assessing and responding to reported vulnerabilities
Legal basis
Legitimate interest in maintaining the security of our services (Art. 6(1)(f))
Rentention
24 months after the case is closed.

Note: Reports may be submitted anonymously. See our Vulnerability Disclosure Policy.

4. Cookies and similar technologies

We use cookies and similar technologies on our websites. Under the Electronic Communications Act § 3-15, we may only store information on, or access information in, your device only where you have given prior consent that meets the requirements of the GDPR. This does not apply to technologies that are strictly necessary to deliver a service you have requested.

Our Cookie Policy sets out which cookies and similar technologies we use, who provides them, what they are used for, and how long they remain on your device. You can change or withdraw your consent at any time via the cookie settings icon in the left footer of every page.

Where cookies result in the processing of personal data about you, that processing is described in section 3.1 above.

5. Who we share personal data with

We do not sell personal data. We disclose personal data to:

    • Data processors who process personal data on our behalf under a data processing agreement, including providers of consent management and marketing automation:
        • Consent Management provided by CookieYes Limited, 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.
        • Marketing automation provided by Make AS, Sandakerveien 116, 6 etg., 0484 Oslo, Norway. NO 993 555 002.
    • Public authorities, where we are legally obliged to disclose information.
    • Advisers, such as auditors and legal counsel, where necessary.

6. Transfers outside the EU/EEA

We seek to keep personal data within the EU/EEA. Where a processor transfers personal data to a country outside the EEA, we ensure a lawful basis for the transfer — either an adequacy decision by the European Commission, the EU Standard Contractual Clauses, or another basis under GDPR Chapter V, together with any supplementary measures required following an assessment of the transfer.

As of the latest update of this privacy policy, we do not transfer personal data outside of the EU/EEA.

7. Security

We have implemented technical and organizational measures to protect personal data against unauthorized access, alteration, deletion, and loss. These include least-privilege access control, encryption of data in transit, logging and monitoring, secure development practices, supplier assessments, and regular personnel training. Our information security management system is built on ISO/IEC 27001.

8. Your rights

Where we act as controller, you have the right to:

    • Access — obtain confirmation of whether we process personal data about you, and a copy of that data.
    • Rectification — have inaccurate or incomplete data corrected.
    • Erasure — have data deleted where the conditions are met.
    • Restriction — request that processing be limited.
    • Object — object to processing based on legitimate interest, including direct marketing.
    • Data portability — receive data you have provided in a machine-readable format, where processing is based on consent or contract.
    • Withdraw consent — at any time, where processing is based on consent. This does not affect the lawfulness of processing carried out before withdrawal.

 

To exercise your rights, contact us at dpo@itxuc.com. We will respond without undue delay and in any event within one month. We may ask you to verify your identity before we act on a request.

9. Complaints

If you believe we are processing your personal data unlawfully, we would like to hear from you first so we can address it. You also have the right to lodge a complaint with the Norwegian Data Protection Authority:

Datatilsynet
Postboks 458 Sentrum, 0105 Oslo
postkasse@datatilsynet.no
www.datatilsynet.no

10. Changes to this policy

We may update this policy as our services and our processing activities change. The current version is always available at itx.no. Where changes are material, we will notify affected individuals directly where practicable.