1.1. The Company

This Privacy Notice applies to Crayon Group. In the following referred to as “We” or “Crayon”.

We are registered in Norway under registration number 981125592, and the registered office is located at Sandakerveien 114a, 0484 Oslo, Norway.

1.2. Contact Details

• Post: Sandakerveien 114a, 0484 Oslo, Norway
• Telephone: +47 22 89 1001 or;
• Email: dpo@crayon.com
• Name and Title: Dr. Scott Richardson, Data Protection Officer
• Address: Landsvägen 50A, 17263 Sundbyberg, Stockholm, Sweden
• Email address: dpo@crayon.com

1.3. Data Protection Officer

• Name and Title: Dr. Scott Richardson, Data Protection Officer
• Address: Landsvägen 50A, 17263 Sundbyberg, Stockholm, Sweden
• Email address: dpo@crayon.com

Crayon Group views the protection of Personal Data and Data Privacy as more than a legal obligation; we consider personal privacy a fundamental right that we as a company have the responsibility to protect. Crayon is committed to safeguarding all Personal Data that we may process about customers, suppliers, or our employees to the best of our ability. 

We abide by all applicable national or international data privacy laws and we fully cooperate with and support any activities that aim to verify our compliance in the form of investigations and audits. We report data breaches as quickly as possible and take a result-oriented approach to effectively and efficiently resolve any issues resulting from an unintentional or unforeseen data breach. 

This Privacy Notice describes the framework for honoring these privacy commitments. We strive to be transparent and provide accessible information, so if you have any questions related to this Privacy Notice, please contact our Data Protection Officer on the contact information listed above.

We apply the following seven principles when collecting and/or processing personal data:

Personal Data: means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Art.4(1) EU GDPR

1. 1. Personal Data will be processed lawfully and fairly
2. 2. Personal Data will be kept, used, or disclosed for specific and lawful purposes
3. 3. Personal Data will be adequate and relevant, not excessive
4. 4. Personal Data will be retained for no longer than is necessary for the purposes for which they were obtained
5. 5. Personal Data will be accurate, complete, and up-to-date.
6. 6. Personal Data will be provided in transcript copy to individuals upon request, in line with our commitment to the law
7. 7. Personal Data will be kept secure using technical and organizational measures, grounded in privacy by design.

This Privacy Notice applies where Crayon is acting as a Data Controller with respect to the Personal Data of:

• Participants in our events, web-based or physical
• Subscribers to our newsletter; or
• Potential or existing customers/suppliers that are subject to our direct marketing or other communications from us regarding marketing or sales.
• Data Controller: Crayon considers itself acting as a Data Controller when we determine the purposes and means of the processing of the personal data.

5.1. What Personal Data

In the interest of providing the services and communications listed in Section 4.1 (Scope) we may process the following personal data:

• Name
• Role/Title
• Work e-mail address
• Work phone number

As the Personal Data that we process is limited to what you may provide to us, we strongly discourage providing additional Personal Data that is not relevant to our services or communications.

Under no circumstances do we collect special categories of personal data as defined in Article 9 and 10 of the GDPR.

5.2. Lawful basis

We may process any information that you send to us in relation to an enquiry or request for services.

Taking into consideration that:

• All Personal Data covered by this Privacy Notice is provided to us by you
• You have an expressed interest in receiving communication about our events, services; and or marketing material
• We have a legitimate interest in providing this relevant communication to existing or potential partners and customers

We consider Legitimate Interest the most appropriate lawful basis. To ensure that we can document and justify this decision, we have conducted a Legitimate Interest Assessment, which can be issued upon request. To request an LIA, please contact our DPO on the Contact Details listed on the top of this page

6.1. Location of your Personal Data

Crayon Group operates in over 20 countries within and outside the European Union (EU) and European Economic Area (EEA). As a result, your personal data may be subject to international transfers. 

Despite the limitations of the geographical scope of the General Data Protection Regulation (GDPR), we apply the same standards and principles governing data protection to every employee, contractor, consultant and agency staff employee working for any of our subsidiaries worldwide. 

To ensure a consistent high level of protection, we have put in place our corporate binding rules. To request a copy of our corporate binding rules, please contact our DPO on the Contact Details listed on the top of this page.

6.2. Access to your Personal Data

The confidentiality and integrity of data stored on our IT systems are protected by controls to ensure only authorized employees have access to those capabilities required for their duties. All employees have signed a confidentiality agreement. 

We may distribute your Personal Data to any member of Crayon Group, i.e. any of our subsidiaries, if it is necessary and reasonable for the purposes set out in this Privacy Notice. We have Binding Corporate Rules in place to ensure all the same consistent level of protection. To request a copy of our corporate binding rules, please contact our DPO on the Contact Details listed here.

We do not disclose your personal data to any third parties, public or private without your prior consent, unless we are obligated to by EU or national law, or it is necessary to protect the vital interests of you or any other natural person that we process personal data concerning.

6.3. Protection of our Personal Data

Crayon protects your Personal Data and has internal Information Security rules, process and controls in place to protect your Personal Data. Our Information Security is based on a thorough evaluation of the risks involved taking into consideration the categories of Personal Data and the types of Data Processing in question. 

We have put in place technical and organizational security measures to ensure that protect your Personal Data against unauthorized or unlawful processing and against accidental loss, destruction or damage.

Additionally, we ensure that only authorized persons gain access to your Personal Data. To prevent data loss, we continuously back up all data.

In the event of a data breach, we will notify the relevant supervisory authorities. If the data breach entails any risk for you, we will notify you immediately.

6.4. Our Data Retention Policy

Your personal data is stored only for as long as it is necessary for to fulfil the purpose for which the personal data was obtained.

In cases where it is not possible for us to specify in advance the specific data retention periods, we will determine the period of retention based on an individual evaluation of the necessity and relevance for the purposes specified in Section 4.1

If you wish to have your personal data erased, please refer to section 7.1 below on your right to erasure.

Legal obligations: Notwithstanding the other provisions of this Section 6, we may retain your personal data where such it is necessary for compliance with a legal obligation, or in order to protect your vital interests or the vital interests of another natural person.

In the interest of full disclosure and transparency we have summarized your rights under GDPR Chapter 3 in this section. However, some these rights are complex, and you are therefore encouraged to read the relevant laws and/or guidance from your local supervisory authority.

7.1. Your rights under the GDPR

The Right of Access

You have the right to know whether we process your personal data. If we do, you have also the right to access this personal data, providing the rights and freedoms of others are not affected.

We will provide a transcript of your data. The first copy will be provided free of charge, but additional copies may be subject to a fee of 10 euros per copy to cover administrative costs.

Rectification

Should any of your personal data prove to be inaccurate or incomplete, you have the right to have this corrected/rectified.

Erasure

The right to erasure is also known as the “right to be forgotten”. If any of the conditions in Article 17 apply, you have the right to have your personal data deleted from our records.

Please be aware that there can be certain exceptions to the right to erasure, such as exercising the right of freedom of expression and information, for compliance with a legal obligation, or for the establishment, exercise or defense of legal claims.

Restrict Processing

In some circumstances you have the right to restrict the processing of your personal data, for example if: 

• you contest the accuracy of the personal data; 
• we no longer need the personal data for the purposes of our processing, but you require personal data for the establishment, exercise or defense of legal claims; and
• you have objected to processing, pending the verification of that objection. 

This list is not exhaustive, and we would like to refer you to Article 18 of the GDPR for the full list

 

Notification

As a general rule, you have a right to be notified of:

• Rectification of your personal data
• Erasure or your personal data
• Restriction of processing of your personal data.

Data Portability

You have the right to receive your personal data from us in a structured, commonly used and machine-readable format. However, this right does not apply where it would adversely affect the rights and freedoms of others.

The Right to object

You have the right to object to our processing of your personal data on grounds relating to your particular situation, but only to the extent that the legal basis for the processing is that the processing is necessary for: 

• the performance of a task carried out in the public interest or;
• in the exercise of any official authority vested in us or;
• the purposes of the legitimate interests pursued by us or by a third party.

If you object to us processing your personal data we will cease to process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.

7.2. Exercising your rights

You may exercise any of these rights by submitting a "Subject Access Request”(SAR).This can be done by forwarding a request in writing to our Data Protection Officer with a clear description of the information you seek. We will respond to your request within 10 working days.

7.3. Your right to lodge a complaint with a supervisory authority

We take a service-oriented approach to facilitating your rights. However, should you experience that we have sufficiently answered your request, or that our processing of your personal data infringes data protection laws, please do not hesitate to submit a complaint to our DPO.

Submitting a complaint to our DPO does not prevent you from submitting a complaint to the relevant supervisory authority in parallel. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.