We are committed to protecting your privacy and processing personal data in a secure, responsible and lawful manner. This Privacy Notice explains how we collect, use, store and, where applicable, share personal data relating to visitors to our website, individuals who contact us, and individuals with whom we interact, such as representatives of customers, suppliers, business partners and other business contacts.
The Caiano Group company with which you, or the organisation you represent, have a customer relationship or other contact is responsible for processing your personal data as the data controller.. Enquiries about how we process your personal data, or questions about your rights, may be directed to Caiano AS, Strandgata 92, 5528 Haugesund, post@caiano.no, telephone +47 52 70 90 70.
Personal data we process and why
Personal data means any information relating to an identified or identifiable natural person. The information we process depends on the customer relationship and your contact with us. It will normally include information such as your name, job title and employer or organisational affiliation, address, telephone number and email address. It may also include information relating to communications and enquiries, or other information that naturally arises from the customer and business relationship you have with us.
We may process personal data, among other purposes, to respond to enquiries and follow up requests, to enter into, administer and perform agreements, to communicate with customers and other contacts, and to administer invoicing, payments and accounting. As a general rule, personal data will be processed on the basis of Article 6 of the General Data Protection Regulation (GDPR), depending on the purpose of the processing concerned.
We do not request more personal data than is necessary for the matter in question. As a general rule, we do not process special categories of personal data in connection with customer and business relationships. If such data nevertheless need to be processed, the necessary legal basis must exist under Articles 6 and 9 of the GDPR.
For information about the data collected when you visit our website, please refer to our Cookie Policy.
Where the information comes from and who it is shared with
We receive most personal data directly from you or from the organisation you represent. We may also receive information from other contacts at the customer, from our business partners, or from publicly available sources where this is relevant and lawful. Where personal data are obtained from someone other than you, we provide information in accordance with Article 14 of the GDPR where required.
Technical information may be collected automatically when you visit our website.
Access to the information we collect is granted only to individuals within our organisation who need it to perform their duties.
We may share personal data with external recipients where this is necessary and there is a legal basis for doing so. These recipients may include banks and payment service providers, accountants, auditors, legal advisers, public authorities, and providers of IT, storage, communications and other system services.
Where external service providers process personal data on our behalf, we enter into data processing agreements as required by law.
We primarily process personal data within the EU/EEA. If personal data are transferred or made accessible outside the EEA, a valid transfer mechanism must be in place.
Retention
We retain personal data for as long as necessary for the purpose for which they were collected and for as long as we are required to retain them under applicable law.
Information necessary to manage the customer relationship is normally retained for as long as that relationship continues. Once the customer relationship has ended, information may be retained where necessary to comply with statutory retention requirements, provide evidence of agreements and deliveries, or establish, exercise or defend legal claims. The information is deleted or anonymised when there is no longer a need or obligation to retain it.
Your rights and right to lodge a complaint
Under data protection law, you have a number of rights in connection with our processing of your personal data.
You may request access to the personal data we process about you, and you may request that inaccurate or incomplete information be corrected or completed. Where the applicable conditions are met, you may also request erasure or restriction of processing, receive your personal data in a structured, commonly used and machine-readable format, and object to processing based on legitimate interests.
If you wish to exercise any of your rights, you may contact us by email or telephone. We will respond as soon as possible and no later than one month after receiving your request, unless data protection law permits us to extend the deadline.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe that the processing of your personal data is contrary to data protection law. Contact details and information about how to submit a complaint are available on the Norwegian Data Protection Authority’s website.
Changes
We may update this Privacy Notice if our processing of personal data or the applicable rules change. The current version will be made available on our website.