In short
- Incrementi AS is the controller of the personal data described here.
- We use the data to reply to enquiries, work with clients and partners, run the website and – only if you consent – for analytics and marketing.
- We never sell personal data.
- You can change your cookie choices at any time, ask for access, correction or erasure, and complain to the Norwegian Data Protection Authority.
Who is responsible
Incrementi AS (org. no. 930 168 408), Dronning Eufemias gate 26, 0191 Oslo, Norway, is the controller for the processing of personal data described in this policy. Incrementi is part of 99X Group.
Send privacy questions and requests to exercise your rights to espen.slyngstad@incrementi.no, or call +47 934 00 825. You can also write to us at the address above. We are not required to appoint a data protection officer and have not done so; requests are handled by management.
What this policy covers
This policy applies when you visit incrementi.no, contact us, receive information from us, or are a contact person at a client, supplier or partner.
When we process personal data on behalf of our clients in an engagement – for example data in systems we build or operate – the client is the controller and we are the processor. In that case the client's privacy policy and our data processing agreement with the client apply, not this policy.
Processing follows the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR). Cookies are also governed by section 3-15 of the Norwegian Electronic Communications Act, and electronic marketing by section 15 of the Norwegian Marketing Control Act.
What we process, why and on which legal basis
We only process data we need for a specific purpose. The table shows the purposes, the data and the legal basis under Article 6 GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Running and securing the website – serving pages, detecting errors and preventing abuse. | IP address, browser type, device, URL visited, referring page and time, in technical logs. | Legitimate interest (Art. 6(1)(f)) in a secure and stable website. |
| Replying to enquiries via forms, email or phone, and booking meetings. | Name, email, company, job title and phone number if provided, what you write to us, and the page you submitted the form from. | Steps taken at your request before a possible contract (Art. 6(1)(b)), and legitimate interest (Art. 6(1)(f)) in replying to and following up business enquiries. |
| Client and supplier relationships – entering into and performing agreements, communicating, invoicing. | Contact details and role of contact persons, correspondence, meeting notes, agreements and invoicing data. | Legitimate interest (Art. 6(1)(f)) in managing the agreement with the organisation you represent, contract (Art. 6(1)(b)) where you are a party yourself, and legal obligation (Art. 6(1)(c)) under the Norwegian Bookkeeping Act. |
| Marketing and invitations – newsletters, articles and events for business contacts. | Name, email, company, job title, interests you have shared, and whether our emails are opened and links clicked. | Consent (Art. 6(1)(a)) where the Marketing Control Act requires it. Otherwise legitimate interest (Art. 6(1)(f)), for example towards existing clients about similar services. You can always opt out. |
| Analytics and improvement of the website with Google Analytics and HubSpot. | Page views, clicks, form submissions, approximate location, device, browser, referral source and random identifiers in cookies. | Consent (Art. 6(1)(a), cf. section 3-15 of the Electronic Communications Act). Without consent: see the Google Consent Mode section below. |
| Measuring and targeting ads on LinkedIn. | Visits to our pages linked to a LinkedIn identifier, URL, referring page, IP address, device and browser data. | Consent (Art. 6(1)(a), cf. section 3-15 of the Electronic Communications Act). |
| Legal claims – establishing, exercising or defending claims. | Data relevant to the claim. | Legitimate interest (Art. 6(1)(f)). |
Where we rely on legitimate interest, we have assessed that our interest outweighs your privacy interests, among other things because the data is limited, relates to your professional role and is used as you would reasonably expect. You can ask for the assessment and you can object (see “Your rights”).
You are not obliged to give us personal data. Without contact details, however, we cannot reply to you, and without the necessary data we cannot enter into or perform agreements.
We do not ask for special categories of personal data, such as health data. Please do not send such data in forms or emails.
Who we share data with
We do not sell personal data or share it with others for their own marketing. We use these providers as processors under written data processing agreements. They may only use the data on our instructions:
| Provider | Service | Storage and transfer |
|---|---|---|
| Vercel Inc. | Hosting and delivery of the website, technical logs and the form endpoint. | Global content delivery network, US company. |
| HubSpot Ireland Ltd. (HubSpot, Inc.) | Forms, contact and client register (CRM), email, visitor analytics, cookie banner and video on some pages. | Data is stored in HubSpot's EU data centre in Germany. Access from the US may occur for operations and support. |
| Google Ireland Ltd. (Google LLC) | Google Tag Manager and Google Analytics 4. | EEA and US. |
| Microsoft Ireland Operations Ltd. | Email, documents and meetings (Microsoft 365). | EEA, with possible access from the US for operations and support. |
For the LinkedIn Insight Tag, LinkedIn is a joint controller, not a processor (see above).
We may also share data with companies in 99X Group when they contribute to a client engagement or a sales process, with our accountant and auditor, with advisers when needed, and with public authorities when required by law. If all or part of the business is sold or merged, the data may be transferred to the new owner, who must comply with this policy.
Transfers outside the EEA
Some providers are US companies or use sub-processors outside the EEA. We only transfer personal data outside the EEA when the transfer has a lawful basis under Chapter V GDPR:
- EU–US Data Privacy Framework: the European Commission's decision that the US provides adequate protection. It also applies in Norway through the EEA Agreement. Vercel, HubSpot, Google, Microsoft and LinkedIn are certified under the framework.
- EU Standard Contractual Clauses with supplementary measures, such as encryption, where the framework does not cover the transfer.
Contact us at espen.slyngstad@incrementi.no if you would like a copy of the safeguards we use.
How long we keep data
We do not keep data longer than the purpose requires. When the retention period ends, we delete or anonymise the data.
| Data | Retention |
|---|---|
| Technical logs at our hosting provider | A short time, normally no more than 30 days. |
| Enquiries that do not lead to a client relationship | Up to 24 months after the last contact. |
| Contact persons at clients, suppliers and partners | For as long as the relationship lasts, and up to 24 months after the last contact. |
| Accounting records, such as invoices and agreements | Five years after the end of the financial year, as required by section 13 of the Bookkeeping Act. |
| Marketing recipients | Until you opt out, or after 24 months without activity. |
| Marketing opt-outs | For as long as needed to respect the opt-out. |
| Analytics data in Google Analytics | Up to 14 months. |
| Cookies | See the table above. |
Data may be kept longer if needed to establish, exercise or defend a legal claim.
Your rights
You have the right to:
- access the data we hold about you and get a copy (Art. 15),
- rectify incorrect or incomplete data (Art. 16),
- erase data when we no longer have grounds to process it (Art. 17),
- restrict processing, for example while we assess a request for rectification (Art. 18),
- receive data you have given us in a machine-readable format, when processing is based on consent or contract (Art. 20),
- object to processing based on legitimate interest (Art. 21). If you object to direct marketing, we always stop,
- withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
Send your request to espen.slyngstad@incrementi.no. We reply without undue delay and within one month at the latest. If the request is complex, the deadline may be extended by up to two months, and we will tell you if it is. It is free of charge. We may ask you to confirm your identity before we disclose or delete data. Every marketing email also has an unsubscribe link.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22).
Complaints to Datatilsynet
If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet). We would appreciate the chance to put things right first, so please contact us.
Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway. Phone +47 22 39 69 00. datatilsynet.no. If you live or work in another EEA country, you can also complain to the supervisory authority there.
How we protect data
We use technical and organisational measures to protect data: encrypted transfer (HTTPS), access control so that only those who need the data can access it, data processing agreements with providers, and procedures for handling incidents. Our deliveries are covered by 99X's certified management systems for information security (ISO/IEC 27001) and privacy (ISO/IEC 27701).
If a personal data breach occurs, we notify Datatilsynet within 72 hours when the rules require it. If the breach is likely to result in a high risk to you, we will also notify you.
Children, links and changes
Our website and services are aimed at businesses, not children, and we do not knowingly collect data about children.
The website links to other websites, such as LinkedIn, 99x.io and Google Maps. We are not responsible for how they process personal data. Please read their privacy policies.
We update this policy when our processing changes. The date at the top shows when it was last changed. If there are material changes that affect you, we will let you know on the website or directly, and ask for new consent where needed.