PRIVACY POLICY

Introduction

Your privacy is important to us, and so is being transparent about how and why we collect, use, and share information about you. This privacy policy explains what information we collect about you and why, what we do with that information, and how we handle that information. In addition, we explain what data protection rights you are entitled to. Throughout this policy, when we write “Smartoptics”, “we” or “us,” we’re referring to Smartoptics AS and our subsidiaries and other affiliates. Smartoptics AS is the responsible data controller unless otherwise stated in a privacy policy specific to a product or service or situation. Processing of personal data takes place in accordance with current personal data legislation, which is the European Parliament's Data Protection Regulation - General Data Protection Regulation “GDPR” (EU) 2016/679. Please note that information regarding the use of cookies and similar tracking technologies are provided in the Cookie policy.

Who is covered by this Privacy Policy?

When we write “you” or “your” we are referring to you as an employee, contractor or temporary worker of our existing or prospective customer, a website visitor, or an on-site visitor (when visiting one of our offices).

Why are we processing your personal data?

Processing personal data when you provide consent is a cornerstone of our privacy policy. Your consent signifies your voluntary agreement to allow us to collect, store, and utilize your personal information for specific purposes outlined in our policies. We view consent as a vital component of our commitment to transparency, trust, and respect for your privacy rights. By obtaining your consent, we ensure that you are fully informed about how your data will be used and have the autonomy to make decisions regarding its processing. Our adherence to this principle not only ensures legal compliance but also fosters a relationship based on mutual understanding and accountability between you and Smartoptics.

We will process your personal data only when it is necessary to:

Deliver our products and services,
Provide you support when using our products and services,
Improve the quality and develop existing and new products and services,
Fulfill our contractual obligations,
Provide you with information on our products and services as well as upcoming events,
Uphold appropriate security and incident management,
Fulfill legal obligations and legitimate requests from law enforcement and other authorities.

Do we share your personal data with third parties?

We may share your personal data within the company and its subsidiaries within the framework of the purposes stated above. Smartoptics and its subsidiaries may also share your personal data with suppliers and partners to perform tasks on behalf of Smartoptics and its subsidiaries. We may also share your personal information with authorities where we are obliged to do so. However, we will never sell your personal data.

Do we transfer your personal data outside the EU/EEA?

We normally don’t transfer your personal data outside the EU/EEA. In some situations where personal data is transferred to a country outside the UE/EEA, we will ensure that your personal data is protected and that the transfer is carried out in accordance with applicable law.

This is done using appropriate transfer mechanisms including the relevant prior assessments and appropriate safeguards, e.g., safeguards used are standard contractual clauses (SCC) if no adequacy decision by the European Commission is applicable.

How do we protect your personal data?

We are committed to protect your personal data by implementing appropriate and reasonable safety measures (technical and organizational measures). Those measures are continuously improved as to follow the security development.

We may collect your personal data from the following sources:

When you contact us by e-mail or phone;
When you contact us through any of our contact forms on our websites;
Smartoptics’ website(s), e.g. when you subscribe to our newsletter or submit a job application;
By way of agreement, invoice or other business contact, if you are a customer or a contact person for any of our business partners;
When you visit us on any of our marketing exhibitions or sign up for any of our seminars; and/or
From third parties in the form of group companies, public records, or any of our business partners.

How long do we keep your personal data?

As each processing operation of your personal data have their own purpose and legal basis the retention may vary accordingly. We minimize or delete your personal data as soon it is no longer necessary for the purpose it was collected, a legal obligation or any contractual obligations we may have.

What data protection rights do you have?

Right to access your personal data. You have the right to obtain confirmation on whether Smartoptics processes personal data about you and receive a copy of such data as well as information on how we process your personal data.
Right to rectification. You have the right to rectify any inaccurate personal data we process about you or have any incomplete personal data about you completed.
Right to erasure. You have the right to have your personal data deleted, if (i) the personal data has been unlawfully processed; (ii) we no longer need such data for the purposes of the processing; or (iii) the processing is based on consent and you withdraw your consent, and we have no other legal basis for processing the data. However, Smartoptics will not delete your personal data if Smartoptics has a legal obligation to retain the data, the personal data is still necessary for the purposes of processing, or if Smartoptics’ legitimate interests override your interests.
Right to data portability. You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you may have that data ported directly to another controller, where such personal data is processed based on your consent or to perform a contract with you.
Right to restriction. You have the right to restrict our processing of your personal data where you believe that the personal data we process is inaccurate or our processing is in unlawful. You may also restrict our processing if Smartoptics no longer needs the personal data, but you want us to store the data for the establishment, exercise, or defense of legal claims. You may also require us to restrict the processing of your personal data for the period when we assess your right to object to the processing of your personal data.
Right to object. You have the right to object to our processing of your personal data when we rely on our legitimate interests or those of a third party or if we in an exceptional case perform tasks in public interest. If you object to our processing, we will cease processing your personal data end erase the data, unless we can demonstrate compelling legitimate grounds for the processing overriding your interests, or if the data is needed for the establishment, exercise, or defense of legal claims. You always have the right to opt out of receiving direct marketing from us.
Right to information. You have the right to receive transparent information about how we process your personal data.
Right to withdraw your consent. You have the right to withdraw any consent for processing you provided at any given time. You can withdraw your consent for cookies here. You can withdraw your consent for direct marketing by unsubscribing from receiving our direct marketing. For any other cases, please contact us using the contact details set out in section 10 below. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Your request for any of the rights above will be assessed on case-by-case scenario as the applicability will depend upon the circumstances.

If you wish to exercise your rights or have any questions regarding the processing of your personal data, please contact us using the contact details provided below.

We will not discriminate against you based on your exercise of any of the rights described above.

Do you want to lodge a complaint?

If you consider that Smartoptics or some of its subsidiaries processing your personal data unfair or unlawfully, you should contact the supervisory authority in the country where you are residing, the country you work or in the country where you believe an infringement was made.

Changes to the privacy policy

Please note that the terms of the privacy policy may be changed or amended. Any new version will be published on Smartoptics’ website. Consequently, you should review these terms on a regular basis to make sure that you are satisfied with the changes.

This version: 1.2
Version: 1.0

Contact us

If you have any questions related to this privacy policy, if you suspect that a breach of this privacy policy has occurred, or if you would like to contact us for any reason stated in this privacy policy, please contact us using the contact details provided below.

Smartoptics AS
Org number: 502075-4106
Address: Brynsalléen 2, NO-0667 Oslo, Norway
Email: gdpr[at]smartoptics.com

The Personal Data we process

When you as an employee, contractor or temporary worker, represent your company, we may process your personal data for the purposes listed below (if you are a sole trader, then all information relating to your firm will be personal data).

Purpose	Categories of personal data	Legal ground and retention
To create and maintain a database of our prospective customers (may be collected from third parties).	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address)	Legitimate interest Retention: 1 year for prospective customers or last interaction
Provide you with newsletter via email	Contact information (name and email address)	Consent Retention: until consent withdrawn or newsletter cancellation
Provide you with information on our products and services as well as upcoming events	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address)	Legitimate interest to sell and market our products and services. Retention: As long as the contacts company is a customer or contact has left company or is no longer a contact person for the company.
Improve the quality and develop existing and new products and services (customer satisfaction surveys)	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address) Product and service information (what products used)	Legitimate interest Retention: As long as the contacts company is a customer or contact has left company or is no longer a contact person for the company. Survey results are anonymized and kept as statistics.
To provide services and support	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address) Contact preferences (communication form) Product/service information (serial number) Free text (message or content provided)	Legitimate interest to provide support according to agreement. Retention: As long as the contacts company is a customer or contact has left company or is no longer a contact person for the company.
To provide quotations	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address) Contact preferences (communication form) Product/service information (serial number) NB if you are a sole trader, then financial data could be processed, i.e., credit rating.	Legitimate interest to conduct business. Contract if a sole trader
To fulfill our contractual obligations with the customer	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address) Contact preferences (communication form) Product/service information (serial number)	Legitimate interest to conduct business Contract if a sole trader Retention: During the customer relationship
Uphold appropriate security and incident management	Technical information generated by interacting with our services. Application information (unit, geolocation etc.)	Legitimate interest to uphold an appropriate level of security. Retention: During your time interacting with our services
Compile bookkeeping and accounting in accordance with accounting laws and maintain this in accordance with applicable law	Contact information (name, telephone number, email address, role) Organizational information (company name, country, company address) Financial data	Legal obligation (accounting law) Retention: according to accounting law, the information will be removed after the end of the year which the information was registered.