Privacy notice

1. Data controller

Firmaradar AS is the data controller for personal data processed in the portal, unless otherwise expressly stated in an agreement or specific information.

2. Which data we process

We may process name, email address, password hash, roles, permissions, customer profile, login and security data, API keys, usage logs and messages sent via the contact and support pages.

The portal also makes available company and ownership information from open and lawful sources, including company names, organisation numbers, group structure, ownership stakes and certain personal data when this forms part of the data basis.

For users who are not logged in, the portal does not show such data beyond any aggregated counts.

3. Where the data comes from

The data comes from you or your business when creating and using an account, from internal administration of customer relationships and permissions, from open public sources such as the Brønnøysund Register Centre and shareholder registers, and from technical logs that arise when the portal is used.

4. Purpose of the processing

We process personal data to provide portal access and authentication, administer users and API keys, make company and ownership data available in line with the customer's access level, offer search, downloads, API functionality and monitoring, and keep logs for security, abuse prevention, troubleshooting and documentation.

5. Legal basis

The processing takes place on the basis of contract, legal obligation and/or legitimate interest, depending on which part of the service is used. For ownership and company data, the legal basis is normally not consent, but an assessment of legitimate interest and necessity, combined with access control and data minimisation.

6. Sharing of data

Data is shared only when necessary and lawful, for example with providers of operations, hosting and email, internal administrators with a work-related need, customers with contractual access and public authorities when we are legally obliged to.

Relevant suppliers may include Norwegian hosting/e-mail, payment provider, accounting system, CDN/WAF and DMARC mailbox. The Brønnøysund registers, official sanctions/PEP registers and other public registers are sources, not data processors.

Core and portal data is stored in Norway. Certain support, transit and payment processes may involve processing outside the EEA. Such transfers are to be covered by a data processing agreement, SCC/DPF where applicable, a Transfer Impact Assessment and supplementary measures.

7. Access control

We use role and access control to limit which data is shown to which users. Users who are not logged in shall not gain insight into person-related ownership data beyond any aggregated counts. Extended access to full ownership overview, CSV extracts and API functions is granted separately.

For support and troubleshooting, an authorised Firmaradar administrator may temporarily view and operate the portal as your user ("test as user"). Such access requires a documented reason, is time-limited, is logged separately (who, when and why), is attributed to the administrator and not to you, and does not incur any payment, purchase or change to your subscription. Your own login is not affected. You and the company administrator are notified by email and in the portal when such a session ends, so you can get in touch if the access was unexpected.

8. Retention period

We store personal data for as long as necessary for the purposes for which it was collected, unless longer storage follows from law or documented needs.

Typical retention: search/request logs 180 days, person-profile audit 365 days, revoked API keys 30 days, IP at registration anonymised after 90 days, shareholder history 7 years, and AML/audit evidence up to 5 years where required by customer instruction, security or documentation requirements.

9. Information security

We use authentication, access control, logging, monitoring and restriction of export and API access to protect personal data against unauthorised access, alteration or loss.

10. Your rights

You may have the right to access, rectification, erasure, restriction, to object to processing based on legitimate interest and to complain to the Norwegian Data Protection Authority. Contact us via the stated contact point if you wish to exercise these rights.

Firmaradar does not use personal data for automated decisions with legal effect. Risk and compliance signals are decision support and require the customer's own assessment where the outcome may affect an individual.

Firmaradar has not appointed a data protection officer as of today. Privacy enquiries should be sent to the contact address above.

11. Changes

We may update the privacy notice as needed. The latest version shall always be available in the portal.

Versjonsnummeret over er datoen for siste innholdsmessige endring i den fullstendige erklæringen. Les hele personvernerklæringen.