Privacy statement
Last updated:
This is a translation. The Norwegian version applies.
This statement explains what personal data Infino AS processes, what we use it for and what rights you have. It applies to everyone we are in contact with: contact persons at companies we approach, people who write to us, contact persons at customers and suppliers, and visitors to our websites.
In short
- We process work-related contact details, not information about your private life.
- We do not sell personal data or use it for advertising.
- Our website sets no cookies and uses no analytics tools.
- You can ask us at any time not to contact you. We then delete the data we hold about you.
1. Controller
Infino AS is the controller for the processing described here.
Infino AS
Organisation number 938 777 195
Fredensborgveien 25C, 0177 Oslo, Norway
E-mail: post@infino.no
We have no data protection officer. Please send any privacy questions to the address above.
2. What data we process, and why
2.1 Contact persons at companies we approach
We contact companies that may benefit from what we deliver. To reach the right person, we record data about the general manager, board members or others with a role in the company.
Data: name, role, company and organisation number, business address, and work-related phone number and e-mail address where these are published. Once we have been in contact, we note what was said about the matter and what was agreed next.
Sources: We did not get the data from you. It comes from publicly available sources:
- the Central Coordinating Register for Legal Entities (Enhetsregisteret) at the Brønnøysund Register Centre
- the central approval register (Sentral godkjenning) at the Norwegian Building Authority (DiBK)
- the company’s own website, and other public information about the company, such as annual accounts
In some cases, someone you know has put us in touch with you.
Purpose and legal basis: The purpose is to contact companies about our services. The basis is our legitimate interest in marketing our services to businesses, under Article 6(1)(f) of the General Data Protection Regulation (GDPR). We have weighed this interest against your privacy. The data is work-related and publicly available, and you can decline further contact at any time. You can ask to see the assessment.
We make contact by phone. We send marketing by e-mail to a personal e-mail address only if you have agreed to it.
2.2 Enquiries and e-mail
If you write to us or call us, we process your name, your contact details and what you write, in order to reply and follow up. The basis is our legitimate interest in answering enquiries (Article 6(1)(f)), or that you are asking for an offer or an agreement (Article 6(1)(b)).
2.3 Contact persons at customers and suppliers
When we have an agreement with a company, we process data about the contact persons there: name, role, work-related phone number and e-mail address, correspondence, meeting notes, agreements and invoices. If you sign an agreement with us electronically, the time, your e-mail address and the IP address you signed from are also stored, as evidence of the signature.
The purpose is to enter into and follow up the agreement, and to invoice and pay. The basis is our legitimate interest in managing the customer or supplier relationship (Article 6(1)(f)), or the agreement itself where it is made with you personally (Article 6(1)(b)). We keep accounting records because the Norwegian Bookkeeping Act requires it (Article 6(1)(c)).
2.4 Visits to our websites
Our websites set no cookies, store nothing in your browser and load no scripts, fonts or analytics tools from anyone else. The websites are hosted by Cloudflare, which processes your IP address and technical details of the request in order to deliver the page and protect it against attacks. The basis is our legitimate interest in providing a secure website (Article 6(1)(f)). We keep no logs of our own of who visits the sites.
2.5 Overview
| Who | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact persons at companies we approach | Contacting companies about our services | Legitimate interest (Art. 6(1)(f)) | See section 4 |
| People who contact us | Replying and following up | Legitimate interest (Art. 6(1)(f)) or contract (Art. 6(1)(b)) | 24 months after the last contact, unless it leads to an agreement |
| Contact persons at customers and suppliers | Entering into and following up agreements, invoicing and paying | Legitimate interest (Art. 6(1)(f)), contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) | For as long as the agreement lasts and three years after. Accounting records as long as the Bookkeeping Act requires |
| Website visitors | Delivering the site securely | Legitimate interest (Art. 6(1)(f)) | We store no data about visits |
3. When we process data on behalf of customers
We build and operate solutions for our customers. Personal data processed in those solutions is processed on the customer’s behalf, with us as data processor. The customer is then the controller, and the processing is governed by a data processing agreement. If you use such a solution, or data about you is recorded in it, the customer’s privacy statement applies. Please send questions and requests about your rights to the customer. If we receive such a request, we forward it to the customer.
4. How long we keep the data
For contact persons at companies we approach:
| Situation | What we do |
|---|---|
| We have not been in contact with you | We delete the data 12 months after it was recorded |
| We have been in contact, without anything further coming of it | We delete the data 24 months after the last contact |
| You have told us you do not want to be contacted | We delete the data about you. We keep only the company’s organisation number on a block list, so that we do not contact the company again |
| The company becomes a customer | The data is then processed as described in section 2.3 |
For enquiries, customers and suppliers, the retention periods in the table in section 2.5 apply. Accounting records, such as invoices and agreements, are kept for up to five years after the end of the financial year, as required by section 13 of the Bookkeeping Act.
5. Who has access to the data
The data is available only to those at Infino who need it for their work. We do not sell personal data and do not pass it on to others for their marketing.
We use the following suppliers, who process personal data on our behalf under data processing agreements:
| Supplier | What they do for us | Where the data is processed |
|---|---|---|
| Microsoft (Microsoft 365 and Azure) | E-mail, documents, internal systems and signing of agreements | Norway and the EU/EEA |
| Cloudflare | Hosting of the websites, domain names and secure access to internal systems | Global network, including the US |
| GitHub | Storage of internal documents and source code | US |
| Anthropic | The AI tool Claude, which we use to compile public information about companies and to write drafts | US |
In addition, data may be disclosed to our accountant, our bank and public authorities where this is necessary for accounting and payment, or where the law requires it.
6. Transfers outside the EEA
Some of the suppliers in section 5 may process data in the US. Microsoft, Cloudflare and GitHub are certified under the EU–US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection. Our agreements with them also include the European Commission’s standard contractual clauses. The transfer to Anthropic is based on the standard contractual clauses. You can ask us for a copy of these safeguards.
7. Your rights
You have the right to
- access the data we hold about you, and receive a copy of it
- have incorrect or incomplete data corrected
- have the data erased
- ask us to restrict the processing
- receive data you have given us yourself in a machine-readable format, where the processing is based on a contract
- object to processing based on our legitimate interest
You always have the right to object to direct marketing. You do not need to give a reason. Tell the person who calls you, or send an e-mail to post@infino.no, and we will stop contacting you and delete the data about you, as described in section 4.
To exercise your rights, send an e-mail to post@infino.no. We reply without undue delay and within one month at the latest. If the request is extensive, the deadline may be extended by up to two further months. We will tell you within the first month if so. Exercising your rights is free of charge. We may ask you to confirm your identity before we disclose any data.
If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet). See Complaints to Datatilsynet.
8. Automated decisions
We make no decisions about you based solely on automated processing, and we do not build personal profiles. When we choose which companies to contact, we look at the company’s industry, size and location.
9. Security
The data is stored in systems that require sign-in with two-factor authentication, and access is limited to those who need it.
10. Changes
When we change this statement, we update the date at the top. If we make significant changes that concern data we hold about you, we will tell you directly.
11. Contact
Please send privacy questions to Infino AS, post@infino.no, Fredensborgveien 25C, 0177 Oslo, Norway.