Privacy notice

This notice explains how Flexibemanning AS, org. no. 931 015 737, Årvollskogen 103, 1529 Moss (“we”), processes personal data. It applies to the website flexikompetanse.no (the “website”) and to the Flexikompetanse portal at app.flexikompetanse.no (the “portal”). See also the terms and the data processing agreement.

1. Who is responsible

When a company uses the portal for information about its own employees, the company is the data controller and we are the data processor. The data processing agreement then applies, and the company decides what is recorded and for how long it is stored.

We are ourselves the data controller for information about customers’ contact persons and users that is needed to deliver the portal, for invoicing and agreements, for enquiries to us and for visits to the website. This is what this notice covers.

The service is designed for employers and their employees. It is not directed at children.

2. What personal data we process, and where it comes from

• User account: name, email address, role, chosen language and login details. Users are created by the customer’s administrator or by us, and the user enters their own password. Passwords are stored only as a one-way hash, never in plain text.
• Two-factor authentication: a secret key used to verify one-time codes.
• Access log and security: logins, failed login attempts, important actions in the portal, time and IP address.
• Error log: technical information when something goes wrong on the server, for example which page was being used.
• Customer and agreement: the company’s name, organisation number, contact person, chosen package and invoicing basis.
• Enquiries: what you write to us by email or say on the telephone, and who you are.
• Notifications: messages the portal sends to users by email, and to telephone if the portal’s app is in use.

Information about the customer’s employees (HR, absence, hours, courses, HSE and documents) and everything else the customer enters or uploads is processed by us only on behalf of the customer. The customer is responsible for that content. See the data processing agreement.

The website has no login, no forms, no analytics tools and no tracking. We do not collect information about you when you read it. The hosting provider that delivers the pages may record technical information such as IP address, time and which page was requested in its server logs. (Proposal, to be confirmed.)

3. Purposes, legal basis and how long we store data

• Delivering the portal and performing the agreement with the customer (the General Data Protection Regulation (personvernforordningen), “GDPR”, Article 6(1)(b)). User accounts are stored for as long as the customer relationship lasts, and are deleted when the customer removes the user or when the customer relationship has ended and the data has been deleted under section 6.
• Security, troubleshooting and preventing misuse (legitimate interests, Article 6(1)(f)). The access log is deleted automatically after 12 months. Records that a customer has been created or deleted are kept as documentation. Failed login attempts are deleted after 30 days, and expired sessions and password reset links are deleted automatically. The error log is deleted automatically after 90 days.
• Notifications in the portal: read notifications are deleted after 180 days and unread ones after 365 days.
• Invoicing and accounting (legal obligation, Article 6(1)(c)). Accounting records are kept for as long as the Norwegian Bookkeeping Act (bokføringsloven) requires, currently up to five years after the end of the financial year. (Proposal, to be confirmed.)
• Responding to enquiries (legitimate interests, Article 6(1)(f)). Enquiries that do not lead to a customer relationship are deleted no later than 12 months after the last contact. (Proposal, to be confirmed.)

We do not use the data for marketing, profiling or automated decisions, and we do not send newsletters.

4. Cookies

The website does not set any cookies. The portal uses only cookies that are needed for it to work, and none for analytics or advertising:

• “sesjon” (session): keeps you logged in. Necessary. Cannot be read by scripts in the browser. Lasts 14 days, or 10 minutes while the two-factor code is awaited, and is deleted when you log out.
• “sprak” (language): remembers which language you have chosen. Lasts one year.
• “tema” (theme): remembers whether you have chosen a light or dark appearance. Lasts one year.
• “kom-i-gang-skjult” and “kom-i-gang-maler”: only for administrators in new companies. Remembers whether the “Get started” guide on the overview has been hidden, and whether the templates have been viewed. Lasts one year.

When you enter several new employees at once, the draft is stored temporarily in the browser (sessionStorage), so that it is not lost if something fails. It is deleted when the form has been submitted and when the tab is closed. Course videos are shown in a player from our video provider (see Appendix B of the data processing agreement). Which cookies the player itself sets has not yet been checked. (Proposal, to be confirmed.)

5. Sub-processors and where the data is processed

We use sub-processors for the operation of the server and database, email delivery, course video and possibly notifications to telephone. Who they are and what they do is set out in Appendix B to the data processing agreement. The portal is operated by Hostinger with a server in Lithuania, where the database, the uploaded files and the portal’s own encrypted backups are located. Hostinger’s own backups are stored in France. Both countries are in the EU/EEA. More is set out in Appendix C. If a sub-processor processes data outside the EU/EEA, this happens only with a valid transfer mechanism under Chapter V of the GDPR.

Internally, only those of our employees who need it to operate the service or provide support have access to the data. Important actions are logged in the access log.

6. Deletion

When a customer terminates the agreement, the customer’s administrator can download all of the company’s data from the portal, also after the subscription has expired. When the customer asks us to, or no later than 90 days after the agreement has ended (Proposal, to be confirmed.), we delete the company with all users, employees, files and logs that belong to it. The deletion cannot be undone. The data then disappears from the portal’s own backups as they are replaced, normally within 16 days, see Appendix C of the data processing agreement.

If you want us to delete data for which we are ourselves responsible, write to kontakt@flexikompetanse.no. We confirm that we have received the request, check that it comes from you, and reply no later than within one month. We tell you what has been deleted, and what we may have to keep because the law requires it.

7. Security

We protect the data with role-based access control, two-factor authentication for administrators, passwords stored only as a hash, encrypted transmission (HTTPS) and an encrypted backup of the database every six hours. The two-factor keys and the backups are encrypted with AES-256. Other data in the database is not encrypted field by field. More is set out in Appendix C of the data processing agreement.

8. Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to object to processing that is based on legitimate interests, and the right to data portability where applicable. If a processing operation is based on consent, you may withdraw it at any time. You may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

If the data concerns you as an employee, you should address the request to your employer, who is the data controller. We assist the employer in responding. For data for which we are responsible, contact us.

9. Changes

We update this notice when the processing changes. The date at the top shows the latest version. In the event of material changes, we notify the customers’ administrators in the portal or by email before the change takes effect.

10. Contact

Flexibemanning AS, Årvollskogen 103, 1529 Moss. Email kontakt@flexikompetanse.no, telephone +47 402 80 400. We have not appointed a data protection officer. (Proposal, to be confirmed.)