October 2025
In connection with your contractual relationship with Cedra, Cedra as the data controller will collect and process personal data of data subjects for the purposes set out below. Cedra processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. We refer to our other privacy notices for more information about our processing of personal data for other purposes.
This privacy notice explains what personal data we may collect from our clients in connection with the services offered, what we use this personal data for and to whom we disclose this personal data. It also sets out your rights with respect to your personal data, and whom you can contact for more information or questions.
Topics
1. What data do we collect and for what purposes
We may collect and process the following personal data:
The personal data mentioned above is collected and processed for the following purposes:
We may also collect the following types of special categories of personal data (GDPR Art. 9) for the purposes set out above:
2. The legal basis for the collection and processing of your personal data
We collect and process your data based on the following grounds:
We do not collect and process special categories of data unless there is a legal basis under GDPR Article 9(2); the establishment, exercise or defence of legal claims, or consent.
3. Where do we collect your personal data from?
We collect your personal data from you, as well as from public authorities, insurance providers, banks, employers, business partners, third-party advisors, our websites, registered information and other Cedra entities, depending on the nature of the engagement.
4. Who do we share your personal data with and why?
In connection with one or more of the purposes described above, the personal data provided or collected may be shared with the following recipients: public authorities, our professional advisors (e.g. auditors and legal advisors), suppliers and other Cedra entities.
5. To whom do we transfer your personal data?
Transfer of personal data to data processors
We may transfer your personal data to other Cedra entities. We may also transfer personal data to IT suppliers, including cloud service providers, or to external service providers, who process, access and/or store personal data on our behalf.
Transfer of personal data to data controllers
We may transfer your personal data to other data controllers, for example if Cedra has a legal obligation to transfer the data to public authorities.
Transfer of personal data to recipients in countries outside the EU/EEA
We may transfer personal data provided by or collected from you to recipients in countries outside the EU/EEA for the purposes listed in section 1. In such cases, the legal basis (transfer mechanism) for the international transfer is either our internal data transfer agreements, an adequacy decision or the EU Standard Contractual Clauses (SCCs).
In addition to ensuring an adequate transfer mechanism, Cedra will assess the privacy implications of such potential transfers in accordance with the CJEU’s ruling in Schrems II and the EDPB’s guidelines.
6. How long do we store your personal data?
We store personal data for as long as necessary to fulfil the purposes mentioned above, but (i) no longer than necessary for the administration of the client relationship, (ii) no longer than we have a legitimate interest in doing so, or (iii) no longer than necessary for compliance with legal requirements or internal policies. We have specific retention periods for client data, which are based on either legal obligations or Cedra’s legitimate interest in retaining the personal data for a given period. As an example, we may have a legitimate interest in retaining personal data in order to defend a potential legal claim. These periods depend on the service being provided and are based on a risk assessment of Cedra’s need to retain the data for the relevant period, weighed against the data subject’s interest in having the data deleted. Cedra will store data securely and in accordance with the requirements of the GDPR.
7. Your rights
Subject to the conditions set out in applicable data protection legislation, the data subject has certain rights. Below you can read about your rights and how to exercise them:
The right to request access to your personal data
You may send us a request for access to information about whether we process personal data about you in connection with your client relationship with Cedra, and thereby gain insight into what information we process about you if you are a data subject.
The right to rectification of your personal data
If you believe that the information we have stored about you is incorrect (e.g. incorrect contact information), you may request that we correct this at any time.
The right to erasure of your personal data
You may withdraw your consent to Cedra’s processing of your personal data at any time. If you withdraw your consent, we will delete the personal data processed on this basis.
If you request the erasure of your personal data, the data will be deleted. However, the right to erasure is not absolute, as it is assessed against legal requirements and Cedra’s legitimate interests.
The right to restriction of processing
If you do not wish us to delete your information, but have reasons for wanting us to stop processing it in ways other than storage, you may under certain circumstances have the right to request this.
The right to data portability
Pursuant to Article 20 of the GDPR, you have the right to data portability for personal data about yourself that you have provided to Cedra, and for which the legal basis for processing is consent or contract. The main legal basis for the processing of your personal data is the contract between you as a client and Cedra. If you wish to exercise your right to portability, the relevant information from your profile will be exported to a Microsoft Excel document and provided to you.
The right to object
You have the right to object to the processing of personal data about you, where the processing is based on public interest or a legitimate interest of Cedra, for example profiling. In such cases, Cedra will no longer process your personal data, unless after a balancing of interests there remains a legitimate basis for continuing the processing.
The right to object to profiling
You have the right to object to the processing of your personal data for direct marketing purposes. This includes profiling to the extent it is related to such direct marketing.
Filing a complaint
You also have the right to file a complaint with the relevant supervisory authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet). Complaints can be submitted on their website by following this link.
8. Contact
Please contact us by sending an email to personvern@cedra.no if you have questions regarding the protection of your personal data, or if you wish to exercise any of your rights.
Address details:
Cedra AS
Ruseløkkveien 30
0251 Oslo
Norway
9. Updates to our privacy notice
We update our privacy notices regularly, and they will be subject to changes. The date of the last revision of the privacy notice can be found at the top of the page.