Privacy Notice

Inspera AS and its subsidiaries (collectively referred to as “Inspera”, “we”, “us”) are committed to protecting and respecting your right to privacy. This privacy notice (“Privacy Notice”) explains how Inspera processes personal data as Controller in accordance with applicable data protection and privacy law. Please read this information carefully.

This Privacy Notice applies to anyone whose personal data we collect and process as Controller in the course of our business, including contacts at our customers, suppliers and other business partners, visitors of this website and our social media profiles, as well as end users and job applicants. As we provide identity solutions and integration, we also comply with the GÉANT Data Protection Code of Conduct as a requirement for managing identities.

By continuing to visit Inspera.com, Inspera.se, Inspera.dk or Inspera.no (“Site”) or using any of our services ("Services"), you agree that you have read and understood this Privacy Notice.

1. Inspera as controller

This Privacy Notice applies to Inspera's processing of personal data as Controller (where we decide the purposes and means of the processing of your personal data). The purposes for which we act as Controller are set out in the table below.

Please note that for a substantial part of our business, we act as Processor (where our business customer, such as universities and other educational institutions, decides the purposes and means of the data processing). Where we act as Processor, this Privacy Notice does not apply, and we kindly refer you to the privacy notice of the relevant Controller, such as your educational institution, if you would like more information about how your personal data is processed in that regard.

2. How we process personal data

The table below explains how we typically process personal data as controller:

We may also collect or receive other types of data if required to fulfil the purposes listed above.

On a case-by-case basis, we may also use your personal data for certain purposes that are not incompatible with the purpose for which the data was originally collected or received, such as audits, analytics, reporting, innovation, dispute resolution and mergers and acquisitions.

We will not sell or rent your personal data to anyone.

3. How long we keep your personal data

We keep your personal data for as long as necessary for the purposes listed above. Some criteria that we use to determine when to delete your data are:

• We store username and password for as long as you have an active user account.

• We store data based on your consent (such as for sending out newsletters and promotions) until you withdraw your consent (unsubscribe).

• We store contact data to our customers, suppliers, and other business partners as long as we have a relationship or an ongoing dialogue with the person or business concerned.

• We store data received in relation to a recruitment process up to 6 months after the recruitment process is completed (but longer if you are hired). We may request the applicant's consent to store the personal data for a longer period.

• We will delete credit data immediately after the credit check is completed.

It is important to emphasise that special situations may lead to longer or shorter retention periods than the ones described above. We will in any case retain data as long as required subject to legal requirements, and in case special needs arise, e.g. by complaints or claims made against us or by us.

4. How we share your personal data

We may disclose your personal data to the following categories of recipients, to the extent necessary for the purposes mentioned above:

• Any member of the Inspera group, which means our subsidiaries.

• Our business partners and suppliers (such as suppliers of our IT systems).

• Authorised resellers of Inspera Assessment for marketing, sales, and support purposes.

• Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. However, we only provide them with aggregate information about our users (i.e. we do not disclose information about identifiable individuals to our advertisers).

• Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering a contract with you.

• Third parties in connection with possible merger or acquisitions of our business or assets.

• To authorities or third parties if required by law or a binding court order.

Personal data is not transferred to third parties without proper data processing agreements in place, to the extent required under applicable data protection law.

5. Transfer of personal data outside your jurisdiction

Our Services are global, and your personal data may be processed in any country where we have operations or where we engage service providers. Consequently, your personal data may be transferred to a destination outside the country where you are located, which may have data protection rules that are different from those of your country. By submitting your personal data, you acknowledge such transfer, storing or processing of personal data outside your jurisdiction.

We will take all steps reasonably necessary to ensure that your data is processed securely and in accordance with this Privacy Notice and applicable laws. This means that your personal data will only be transferred to a country that provides an adequate level of protection or where we have a valid transfer mechanism in place with the recipient in accordance with applicable law, such as the EU or UK standard contractual clauses.

We will provide you with further details about such international data transfers upon request. If you want to obtain a copy of the safeguards, please use the contact details below.

6. Your privacy rights

You have several rights as regards the processing of your personal data. Such rights include:

Please note that these rights are subject to conditions and limitations by law. Please contact us as set out at the end of this Privacy Notice if you want to exercise any of your rights or if you would like more information about the conditions/limitations that apply. We will respond to your inquiry as soon as possible and typically within one month at the latest.

To the extent that local data protection and privacy laws apply to the processing of your personal data, we will respect any additional rights you may have pursuant to such laws.

7. Complaints

If you have any complaints about our use of your personal data, please contact us as set out at the end of this Privacy Notice. You may also file a complaint to your local data protection authority, such as:

For all other individuals, please contact the data protection authority in the country in which you are located.

8. Data subjects under the age of 18

We do not knowingly collect or process personal data relating to children as Controller. However, should any parent or guardian be concerned that their child’s personal data has been collected by us, please contact us as set out at the end of this Privacy Notice.

For the avoidance of doubt, please note that customers of Inspera may use the Inspera Assessment SaaS solution to collect information relating to children. Where a customer collects such data about children, the customer, not Inspera, is the Controller for such personal data, and is responsible for having proper procedures and parental consent in place. This Privacy Notice does not apply to the processing of such data collected by customers.

9. Cookies

We use cookies on our Site to distinguish you from other users of our Site. Please see our Cookie Policy for further details on our use of cookies.

10. Third parties and social media

We have pages on social media, including LinkedIn and Twitter, where we provide information about our Services and interact with the users. On such social media pages, we may receive anonymised insight, such as statistics about age, gender, and location of our users. We may also receive information that you decide to share with us, such as chat, comments and likes. Your experience on the social media sites will be governed by the privacy policies of those sites. As we are joint Controllers with the social media for data processed from your use of social media tools or links on our site, and for aggregated insight that we get from your use of our pages on social media, you may also contact us if you would like to have more information, or if you want to exercise your privacy rights. However, please note that we may not be able to respond to all requests, and that we may have to refer you to the social media company for further information.

Our Site and Services may also contain links to and from websites of our partner networks, advertisers, and affiliates. If you follow such a link, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check the policies before you submit any personal data to such websites.

11. Changes to this Privacy Notice

We may change this Privacy Notice from time to time when deemed necessary. Any changes we make will be posted on this page. Please check back frequently to see any updates or changes to our Privacy Notice.

12. Contact us

Please feel free to contact us if you have any complaints, questions, or comments about our privacy practices, or if you would like to exercise your privacy rights. Please use the contact form below or by mail to the following address: Cort Adelers gate 30, 0254 Oslo, Norway.

The same details can be used to contact our Data Protection Officer (DPO).