Last updated: October 2025
This privacy policy applies to Cedra.no (referred to below as “this website”), and to Cedra’s surveys, newsletters, invitations to seminars, courses, workshops, networking events and similar, and other communications (collectively referred to as ”seminars/events”), where other platforms/tools are also used.
For information about the processing of personal data for purposes other than those described in this policy, we refer to our other privacy policies.
Cedra Norge AS (also referred to below as “we”, “us”, “our” or “Cedra”) provides this website, our newsletters, surveys (also collectively referred to as our “digital channels”), and hosts professional seminars and other events that can be registered for via our digital channels.
Cedra is the data controller for the personal data processed about visitors, subscribers, survey participants and seminar participants in this context.
This privacy policy is intended to explain in more detail how Cedra processes personal data on this website in connection with our newsletters, surveys, seminar invitations and other communications.
If you have questions regarding the content herein, or our processing of personal data in general, please send an email to personvern@cedra.no.
This privacy policy is reviewed regularly to ensure that it reflects our processing of personal data, and may therefore be amended from time to time.
1. Definitions
To help you get the most out of the information provided in this privacy policy, we will provide an overview of some key terms that will be used.
“Personal data”: Any information relating to an identified or identifiable natural person (“the data subject”) cf. GDPR Article 4(1).
“Processing”: Any operation or set of operations which is performed on personal data, e.g. collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction cf. GDPR Article 4(2).
“Data subject”: An identified or identifiable natural person whose personal data are processed cf. GDPR Article 4(1). This may be a subscriber to our newsletter, or a registrant for our seminars.
“Data controller”: A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data cf. GDPR Article 4(7).
“Data processor”: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller cf. GDPR Article 4(8).
“Sub-processor”: A natural or legal person engaged by the data processor to carry out processing activities on behalf of the data processor.
“Legal basis for processing”: A fundamental prerequisite for the processing of personal data to be lawful is that it is based on a valid legal basis. According to GDPR Article 6, this may include the data subject’s consent or various necessity grounds, including that the processing is necessary for the performance of a contract to which the data subject is party, or that the processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party.
“Your rights”: Under privacy legislation, every data subject has various rights they may exercise. These include the right to request access to their personal data being processed, the right to have them rectified or erased, the right to request restriction of processing or to object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority.
“Profiling”: A form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements cf. GDPR Article 4(4).
2. How, why and for how long we process data
2.1 As a visitor to our website
This website collects standard internet log information, including IP address, browser type and language, access times and referring web addresses. To ensure that this website is well managed and to facilitate better navigation, we or our service providers may also use cookies (small text files stored in the user’s browser) or tracking images (“web beacons”, electronic images that allow this website to count the number of visitors who have accessed a particular page, and to access certain cookies) to collect aggregated data.
This website has integrations for various blogs, forums, wikis and other social media applications or services that allow you to share content with other users (for example Facebook, Twitter and LinkedIn, collectively referred to as “social media”). Personal data or other information that you have provided to any social media may be read, collected and used by other users of the social media service, over which we have little or no control. Therefore, we are not responsible for others’ use, misuse or misappropriation of personal data or other information that you yourself contribute to any social media services.
2.2 As a participant at our seminars/events
2.2.1 Personal data
When you register for one of our seminars, we will request information about you that we consider necessary to carry out the event. This includes:
The purpose of processing the aforementioned personal data is to be able to administer your participation in our seminars and events, and to provide you with necessary information about the seminar.
The data is collected and processed on the basis of your consent obtained when you register for the seminar. You may withdraw your consent at any time by using the contact information below. If you withdraw your consent, the information we have stored about you will be deleted.
2.2.2 Special categories of personal data
We will not normally request special categories of personal data (e.g. data relating to race or ethnic origin, religious beliefs, criminal records, physical or mental health or sexual orientation) from visitors. As food is served at most of our seminars, we do however request information about food allergies so that we can accommodate these and not unnecessarily risk allergic reactions. In order for all registrants to be able to participate regardless of their health condition, we also request information about other special needs that may require accommodation on our part. All such data is processed on the basis of your consent; it is only collected if you choose to provide this information, and only for the purpose of holding the relevant seminar. The data will be deleted shortly thereafter.
2.2.3 Bookkeeping legislation
When you participate in our events/seminars with catering, Cedra is obliged to store your name and the business you represented at the event pursuant to the Norwegian Bookkeeping Regulation Section 5-10, cf. GDPR Article 6(1)(c). Following your participation, we therefore store your name and the name of the business in the vouchers documenting the expenses related to the catering to fulfil this legal obligation. This data is stored for five years after the end of the financial year pursuant to the Norwegian Bookkeeping Act Section 13, second paragraph.
Please note that in special situations there may be a requirement for you to be anonymous, for example in connection with a duty of confidentiality. In such cases, the Bookkeeping Regulation allows for anonymity.
2.3 As a participant in one of our surveys
When you participate in one of our surveys, we will request information about you that we consider necessary to carry out the survey. What is necessary may vary from one survey to the next. The personal data may include:
The purpose of processing the aforementioned personal data is to administer the survey, market our products and services, and map the subject matter to which the survey relates.
The legal basis for processing personal data in surveys is your consent given in connection with your registration as a participant in the survey.
You may withdraw your consent at any time by using the contact information below. If you withdraw your consent, the information we have stored about you will be deleted.
2.4 As a subscriber to our newsletters
You may choose to register to receive our newsletters, as well as information about current seminars and reports. Occasionally, the newsletter may contain an invitation to a survey. See section 2.3 above for information about participation in surveys.
In such cases, the information you provide will be stored on your profile. This includes the information you fill in about yourself upon registration:
The purpose of processing the aforementioned personal data is to administer and send you our newsletter, and in this connection to market Cedra’s products and services.
The legal basis for the distribution and sharing of newsletters is your consent given in connection with your registration as a subscriber.
You may withdraw your consent at any time by using the contact information below. We will then stop sending you newsletters and other communications by email in response to your registration on this website.
When you are a subscriber, Cedra will record which newsletters and seminar invitations you receive, which articles you click through to, which of our web pages you visit, and whether you register for and attend the seminars we hold.
We may collect information about the company you have stated that you work for, but we will not collect personal data about you from sources other than your interaction with us. The information about your activity is stored on your profile and used to give us insight into how actively you use our websites and seminars, how interested you are in our services and which topics interest you most. This information may be used to tailor our communications so that they are as relevant and interesting to you as possible.
Cedra has a legitimate interest in getting to know the preferences and interests of the readers of our newsletters better, so that we can offer seminars, news and services that better suit their needs and wishes. The recording of such information is necessary to pursue this interest. The logic used for this limited profiling activity is simple and mainly consists of assigning a point value to the various activities carried out by subscribers, which are then summed. The recording is limited and is therefore not considered too intrusive, so that our legitimate interest can serve as a legal basis for processing. For further questions regarding this, you may contact us using the contact information below.
Your personal data may also, in exceptional cases, be used to protect our and our users’ rights or property and, where relevant, to comply with legal proceedings. This will only be relevant in very special circumstances, and will never occur without being in accordance with applicable privacy legislation.
The personal data we have stored about you as a consenting newsletter subscriber is retained for as long as you are a subscriber. If you withdraw your consent, the information we have stored about you will be deleted.
3. Your rights
As a data subject, you have several rights relating to our processing of your personal data. Here you will find information about what these are, and how you can exercise these rights vis-à-vis Cedra in connection with our digital channels, newsletters and seminars.
If you have questions regarding your rights, or wish to exercise them vis-à-vis Cedra in connection with our digital channels, newsletters and seminars, you may do so by sending an email to personvern@Cedra.no.
3.1 Access
You may send us an access request to obtain information about whether we process personal data about you in connection with our newsletters and events, and thereby gain access to which data we process about you if you are registered.
3.2 Rectification
If you believe the information we have stored about you is incorrect (e.g. email address, employer or position has changed), you may request that we rectify this at any time. In connection with verifying your newsletter subscription when downloading reports, or when you register for one of our seminars, the information stored on your profile will automatically be updated to what you yourself register.
3.3 Right to object
If you do not wish for us to record your activity on our digital channels, and your attendance at our seminars and other events as part of the profiling, you may object to this. If you object, we will stop recording such information about you.
3.4 Withdrawal of consent
You may at any time easily withdraw the consent you gave us by either unsubscribing from our newsletter via the links at the bottom of emails sent to you, or by contacting us. We will then delete your information associated with our newsletter within 30 days. For other enquiries regarding deletion, please send us an email to personvern@cedra.no.
3.5 Erasure
If you withdraw your consent to receive newsletters, the personal data we process about you will be deleted. If you choose to object to our processing of information about your use of our digital channels, all activity we have previously recorded on your profile will be deleted. Information about your activity on our digital channels, and attendance at seminars, will be deleted after two years.
3.6 Portability
Under GDPR Article 20, you have the right to data portability for personal data about yourself that you have provided to Cedra, and which has consent or contract as its legal basis. Our newsletter mailings are based on consent, and you therefore have the right to receive the information you registered about yourself when you subscribed. This includes name, contact information, employment details and postcode. If you wish to exercise your right to portability, the relevant information from your profile will be exported to a Microsoft Excel document and provided to you.
3.7 Right to restriction of processing
If you do not wish for us to delete your data, but have a reason to request that we cease processing it in ways other than storage, you have, under certain circumstances, the right to request this.
3.8 Right to lodge a complaint with a supervisory authority
If you believe our processing of your personal data is in breach of the GDPR, or other privacy legislation, you have the right to lodge a complaint with the supervisory authorities. For Norway, this is the Norwegian Data Protection Authority (Datatilsynet), and complaints can be submitted on their website by following this link.
4. Sharing, data processors and location
Cedra may share personal data with, for example, our affiliated Cedra entities abroad, service providers, police, public authorities, advisors etc. Such third parties may be located in other countries. In connection with seminars we hold, participant lists may for example be shared with co-organisers if we cooperate with such parties in individual cases. Furthermore, we may also share personal data in connection with other business purposes, such as advertising and marketing, security monitoring, maintenance, billing and auditing. Any transfers will have undergone necessary assessments and measures to ensure that all personal data is processed with adequate security and the necessary legal basis. All transfers are made on the basis of valid transfer mechanisms; EU Standard Contractual Clauses, adequacy decisions or by means of our inter-firm transfer agreements based on EU Standard Contractual Clauses.
Cedra uses several data processors to process personal data on its behalf. These will under no circumstances process personal data for purposes other than those we determine, as set out in this privacy policy.
5. Information security
We have implemented good commercial standards for technology and operational security, to protect all information provided by visitors via this website, as well as for other tools we use, from unauthorised access, disclosure, alteration or destruction.
6. Children’s privacy
We understand the importance of protecting children’s privacy in the interactive electronic world. This website is not designed for or intentionally directed at children aged 13 or younger. It is not our intention to knowingly collect or maintain information about anyone under the age of 13.
7. Changes to our privacy policy
We may change this privacy policy from time to time at our sole discretion. When we make changes to this policy, we will update the revision date at the top of this page, and a modified privacy policy shall take effect from that revision date. We encourage you to review this privacy policy to stay informed about how we protect your information.
8. Questions
If you have questions or concerns regarding your privacy while using this website, you may contact our marketing department via email at marked@cedra.no.