Privacy notice - AKVA group

INTRODUCTION

This privacy notice applies to AKVA group ASA (business registration number 931 693 670) and the group companies listed at the bottom of this privacy notice (hereinafter referred to individually and collectively as AKVA group).

AKVA group is committed to safeguarding your privacy and is dedicated to processing personal data in compliance with applicable data protection legislation.

AKVA group operates in several countries, and the data protection legislation applicable to you depends on which entity in the group you interact with and where that entity is established. Your rights also depend on the country in which you reside. This privacy notice sets out the group's common standards for the processing of personal data and is based on the EU General Data Protection Regulation (GDPR) as a common minimum standard. Where local adaptations are necessary to comply with data protection legislation in a particular country, these are included as separate addenda. This privacy notice applies to the group companies listed at the bottom of this privacy notice.

AKVA group processes personal data relating to persons visiting our premises, visitors to our websites or social media pages, contact persons at potential and existing customers, service providers and business partners, potential job candidates, visitors to our stand at trade fairs and conferences, participants in our webinars and events and others who contact us.

This privacy notice provides you with information about how AKVA group processes personal data relating to individuals outside our organisation, including which personal data we collect, why we process your personal data and your rights in connection with the processing of personal data.

The data controller for the processing of your personal data is the AKVA group entity with which you interact and which is established in the country where you are located. For the processing of personal data in connection with AKVA group's websites, AKVA group ASA is the data controller.

If you have any questions or requests regarding our processing of personal data or about this privacy notice, you may use the contact form at the bottom of this privacy notice.

PERSONAL DATA WE COLLECT ABOUT YOU

The table below lists the personal data that AKVA group collects about you, and the typical sources for such personal data.


Personal data category	Description	Source
Basic data.	Name, birth year, gender, address, e-mail address and phone number.	From you or your employer.
Contractual and business relationship data.	Employer, title, personal data contained in contracts and commercial documents, ongoing commercial correspondence, invoices and minutes of meetings.	From you, your employer or our employees.
Login data.	Username, login time, IP address, device information and organisational affiliation.	From you and AKVA group's IT systems.
Applicant data.	CV, application, certificates, diplomas/school reports, references, interview and reference notes, results from qualification tests and internal assessments.	From you, our employees, references, recruitment agencies and public sources.
Admission and access data.	Information on access, including time and place of access.	From you and AKVA group's IT systems.
Camera surveillance recordings.	Video and images of you captured on our premises.	From you and AKVA group's IT systems.
Social media interaction data.	Name, work experience, education, username, likes and comments.	From you and social media platforms used by AKVA group.

HOW WE PROCESS YOUR PERSONAL DATA

AKVA group will only process personal data about you where we have at least one of the following legal bases for the processing:

(i) You have given your consent to the processing, cf. GDPR article 6(1)(a).

(ii) The processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract, cf. GDPR article 6(1)(b).

(iii) The processing is necessary for compliance with a legal obligation to which AKVA group is subject, cf. GDPR article 6(1)(c).

(iv) The processing is necessary for the purposes of a legitimate interest pursued by AKVA group or a third party, and such interests are not overridden by your interests or fundamental rights and freedoms which require protection of personal data, cf. GDPR article 6(1)(f).

For group entities established outside the EEA, equivalent legal bases will follow from applicable local data protection legislation. The references to the GDPR provisions below apply correspondingly where local legislation contains equivalent categories of legal bases.

The table below sets out the purposes for which AKVA group processes your personal data, the categories of personal data processed for each purpose and the legal bases AKVA group relies on:


Purpose	Personal data categories	Legal basis	Retention period
To administer login and authentication on our services.	Basic data and login data.	iv) AKVA group's legitimate interest in ensuring that only authorised users have access to the services and in safeguarding the security of our systems.	To be retained for as long as you have an active user account. Login logs are deleted within 12 months.
To safeguard cybersecurity and protect our IT infrastructure.	Login data and admission and access data.	iv) AKVA group's legitimate interest in protecting its IT systems, data and infrastructure against cyber threats and security incidents, and in ensuring operational continuity.	To be retained for 13 months. If a specific security incident is being investigated, relevant logs may be retained for longer until the matter is concluded.
To ensure security at our premises and offices.	Basic data and admission and access data.	iv) AKVA group's legitimate interest in ensuring security at our premises and offices.	To be deleted within 90 days from the date of access.
To prevent dangerous situations from arising and safeguard the safety of employees or others.	Camera surveillance recordings.	iv) AKVA group's legitimate interest in preventing dangerous situations from arising and safeguarding the safety of employees or others.	To be deleted within applicable statutory deadlines, which is 7 days in Norway, unless the recording is required for follow-up in connection with a specific incident.
To manage our business operations and safeguard our contractual rights and obligations.	Basic data and contractual and business relationship data.	iv) AKVA group's legitimate interest in managing our business operations and safeguarding our contractual rights and obligations.	To be retained for a minimum of ten years after the contractual relationship has ended, or longer where necessary to manage our business operations and safeguard our contractual rights and obligations.
To conduct audits of our supply chain and other business partners.	Basic data and information on wages and working conditions.	iii) Processing is necessary to fulfil AKVA group's legal obligations under applicable legislation on due diligence relating to fundamental human rights and decent working conditions, minimum wage requirements and sustainability reporting, including the Norwegian Transparency Act, the provisions of the Working Environment Act on the duty to monitor, the EU Taxonomy and the CSRD. iv) AKVA group's legitimate interest in ensuring responsible and ethically sound conditions in its supply chain and among its business partners.	To be retained for as long as the business relationship with the relevant supplier or business partner subsists, or longer where necessary to manage our business operations and safeguard our contractual rights and obligations. Data subject to statutory retention deadlines shall be deleted within such deadlines.
To market and promote AKVA group.	Basic data and contractual and business relationship data.	i) Your consent to digital marketing. iv) AKVA group's legitimate interest in promoting our company by phone, SMS or by e-mail to existing customers to achieve sales.	To be retained until you withdraw your consent. To be retained until the customer relationship ceases.
To administer registration for our webinars/events.	Basic data and employer.	ii) Processing is necessary to fulfil the agreement regarding registration for the event/webinar.	To be retained until the event has been completed and any necessary follow-up has been finalised.
For payment purposes.	Basic data and contractual and business relationship data.	iv) AKVA group's legitimate interest in paying for, and receiving payment for, services and products.	To be retained for a minimum of six years after the end of the financial year, or until the statutory limitation period for the payment claim has expired.
For bookkeeping purposes.	Basic data and contractual and business relationship data.	iii) Processing is necessary to fulfil AKVA group's legal obligations pursuant to applicable accounting and bookkeeping legislation.	To be retained for five years after the end of the financial year.
To have and administer a social media account.	Social media interaction data.	iv) AKVA group's legitimate interest in providing information about and promoting our products and services to reach out to a bigger audience.	To be retained until the personal data are no longer relevant to our followers.
To administer and respond to inquiries.	Basic data and other personal data included in the inquiry.	iv) AKVA group's legitimate interest in providing good support and clarifying questions by answering and managing inquiries and other communication.	To be retained for up to one year from the date your inquiry was closed.
To receive, process and follow up on whistleblowing reports	Basic data and other personal data included in the report, including information about the whistleblower and any persons referred to in the report.	iii) Processing is necessary to fulfil AKVA group's legal obligations pursuant to applicable whistleblowing legislation, including the Working Environment Act Chapter 2 A (which implements EU Directive 2019/1937 on whistleblowing). iv) AKVA group's legitimate interest in receiving and managing whistleblowing reports to detect and prevent misconduct in the business.	To be retained in accordance with AKVA group's retention policy for whistleblowing cases. If the matter develops into a legal dispute or further investigation, the data may be retained for longer until the matter is concluded.
To assess your job application and recruit employees.	Basic data and applicant data.	ii) Processing is necessary to enter into an employment agreement with you (if relevant). iv) AKVA group's legitimate interest in finding a qualified person for the position.	To be retained for up to six months from the date the position was filled, unless you have consented to a longer retention period for your applicant data or it is necessary to retain the applicant data to establish, exercise, or defend legal claims. For open positions, applicant data is automatically deleted after six months.
Cookies (strictly necessary): To make the website navigable by enabling basic functions such as page navigation and access to secure areas of the website, including identifying device type and browser so that content can be adapted correctly (PC, mobile, tablet, etc.), maintaining user sessions, supporting the website's technical functions and managing consent preferences, and supporting integration of third-party platforms. Without these cookies, the website will not function properly.	Technical identifiers (device type, browser type, IP address) and session identifiers.	ii) Processing is necessary to enable you to use and navigate AKVA group's websites. iv) AKVA group's legitimate interest in having websites and promoting its business.	Varies per cookie; see the cookie consent banner on our website for an overview of deletion times.
Cookies (functional): To remember your preferences and settings on our websites.	Technical identifiers (IP address, device type, browser type), login status and preferences, browsing history and user behaviour on the website, and user profile and interest profile.	i) Your consent to the use of functional cookies.	Varies per cookie. You may at any time change or withdraw your consent to cookies via the consent banner on the website.
Cookies (statistical): To collect statistics on the use of our websites and analyse traffic, including via Google Analytics.	Technical identifiers (IP address, device type, browser type), login status and preferences, browsing history and user behaviour on the website, and user profile and interest profile.	i) Your consent to the use of statistical cookies.	Varies per cookie. You may at any time change or withdraw your consent to cookies via the consent banner on the website.
Cookies (marketing): To target advertisements and marketing towards you on other websites and social media based on your interests and previous visits to our websites.	Technical identifiers (IP address, device type, browser type), login status and preferences, browsing history and user behaviour on the website, and user profile and interest profile.	i) Your consent to the use of marketing cookies.	Varies per cookie. You may at any time change or withdraw your consent to cookies via the consent banner on the website.

AKVA group may also collect or receive other types of personal data if required to fulfil the purposes listed above.

In certain cases, AKVA group may also use your personal data for purposes that are not incompatible with the purpose for which the data was originally collected or received, such as audits, analytics, reporting, innovation, dispute resolution and mergers and acquisitions.

Please note that AKVA group may not be able to fulfil the relevant contract, assess your job application or fulfil AKVA group's or your legal rights and obligations if you object to AKVA group's processing where ii) and iii) are the legal bases for the processing.

ABOUT THE USE OF CONSENT-BASED COOKIES

AKVA group uses cookies and similar technologies on its websites (akvagroup.com and akvagroup.no) to improve website functionality and for analytical purposes. Strictly necessary cookies, which are required for basic website functionality (such as maintaining a session or remembering consent preferences), may be placed without your consent.

Your consent is required for AKVA group's use of cookies for functional, statistical and marketing purposes. We use a consent management solution to administer such consents.

Consent preferences can be set via the consent banner displayed upon your first visit to the website. Consent may be changed at any time by (a) clicking the "Update consent" link on our website, or (b) deleting cookies via your browser settings.

Further information about which cookies AKVA group's websites use is available in our cookie-consent banner linked at the bottom of the website.

WHO WE SHARE YOUR PERSONAL DATA WITH

AKVA group may disclose your personal data to the following categories of recipients, to the extent necessary for the purposes set out above:

(i) To other companies in our group to the extent necessary for internal administrative, operational or commercial purposes, including shared group functions and services such as finance, IT, HR, marketing and legal, operational activities across legal entities and where group companies act as subcontractors to each other or under other commercial agreements;

(ii) To AKVA group's suppliers (such as IT suppliers) acting as processors for the purposes mentioned above. AKVA group will enter into data processing agreements with relevant suppliers to ensure that they do not process the data for purposes other than as described in this privacy notice;

(iii) To authorities and third parties if required by law, such as AKVA group's statutory auditor, financial institutions or the Financial Supervisory Authority of Norway;

(iv) To AKVA group's advisors, owners and other business partners to the extent necessary to operate AKVA group's business in a manner common in our industry to ensure efficient and commercially favourable operations (GDPR article 6 (1)(f)), which may also include third parties in connection with possible mergers or acquisitions of AKVA group's business.

When you "like" or join our LinkedIn, Facebook or Instagram pages or other social media accounts, this will be shared with the relevant platform. The same applies to any activities on our social media accounts, such as content posted by you or posts that you like. The relevant social media platform has its own privacy notices, in which you can find more information about the processing of personal data by such social media platforms.

TRANSFER OF PERSONAL DATA ABROAD

AKVA group may transfer your personal data to other companies in our group, as well as to some of AKVA group's suppliers and business partners located abroad. In such cases, AKVA group will ensure that your privacy is safeguarded by implementing appropriate safeguards, known as transfer mechanisms, in accordance with the following principles:

(i) Transfers between two countries within the EEA/EU do not require a separate transfer mechanism, as these countries are subject to the same data protection framework (GDPR).

(ii) For transfers from the EEA/EU to third countries, we will primarily rely on EU adequacy decisions where such decisions exist for the recipient country. Where no adequacy decision has been adopted, we will principally use the EU Standard Contractual Clauses (SCCs) as the transfer mechanism.

(iii) For transfers from a country outside the EEA/EU to another country, we use the transfer mechanisms required under the applicable local data protection legislation in the country where the relevant group entity is established.

You may contact us via the contact form at the bottom of this privacy notice if you wish to receive further information about such international transfers or a copy of the transfer mechanism.

HOW LONG AKVA GROUP STORES YOUR PERSONAL DATA

AKVA group retains your personal data for as long as necessary for the purposes for which AKVA group has collected it. The specific retention period or the criteria used to determine this period are set out for each processing activity in the table above.

YOUR PRIVACY RIGHTS

You have several rights in relation to AKVA group's processing of your personal data. Such rights include:


Right	Description
Information	To receive further information on how AKVA group processes your personal data.
Access	To receive a copy of the personal data AKVA group processes about you.
Rectification	To request rectification and completion of the personal data AKVA group has about you.
Erasure	To request erasure of personal data, unless there is a legal basis for us to retain them.
Restriction	To request that AKVA group restricts the processing of your personal data.
Data portability	To ask that your personal data is transferred to you in a structured, commonly used, and machine-readable format and have the right to transmit those personal data to another controller without hindrance from AKVA group.
Objection	To object to AKVA group's processing of your personal data. You also have the right to object to being subject to a decision based solely on automated processing (if relevant).
Withdraw your consent	Where the processing of your personal data is based on consent, you have the right to withdraw your consent at any time.

Please note that these rights are subject to conditions and limitations pursuant to applicable data protection legislation. If you would like to exercise your rights or would like more information about the conditions and limitations, you may use the contact form at the bottom of this privacy notice.

If you believe that AKVA group processes your personal data in violation of applicable data protection legislation, you may file a complaint with the data protection authority in the country where you reside. AKVA group encourages you to contact us prior to filing such a complaint, so that we may consider your objection and clarify any misunderstandings.

CHANGES TO THE PRIVACY NOTICE

AKVA group may change this privacy notice from time to time when deemed necessary or appropriate to ensure compliance with applicable data protection legislation. AKVA group will notify you of such changes where required under applicable data protection legislation.

CONTACT FORM FOR PRIVACY INQUIRIES

If you have questions about our processing of personal data or wish to exercise your privacy rights, you may use our contact form.