1. Who are we?
2. Roles in processing personal data
When the Customer determines the purpose of processing personal data in the System, the Customer is the controller and Easypeasy is the processor.
When Easypeasy processes personal data for its own purposes, Easypeasy is the controller. This includes information about contact persons, users, billing, product analytics, security logs, abuse prevention, support administration and compliance with legal obligations.
Processing on behalf of the Customer is governed by the data processing agreement .
3. What data we process
- Contact information such as name, email address, telephone number and role.
- User and authentication information, including organisational affiliation and login metadata.
- Billing and subscription information.
- Support history, feedback and communication.
- Technical logs, security data, request metadata and usage patterns.
- Product analytics and event data relating to use of the website and service.
4. Purposes and legal bases
- Providing the service and managing the customer relationship on the basis of a contract.
- Handling payment, subscriptions and statutory obligations on the basis of a contract and legal obligation.
- Ensuring security, preventing abuse, logging and troubleshooting on the basis of legitimate interests and legal obligations.
- Support, follow-up and quality improvement on the basis of a contract and legitimate interests.
- Product analytics and statistics on the basis of legitimate interests and, where required, consent.
5. Sharing data
Easypeasy uses processors and other key service providers for authentication, hosting, analytics, payments, email, file handling and technical operations, among other things.
An up-to-date overview of key subprocessors is available on the subprocessors page .
We may also disclose information where required by law, a valid order from a public authority, or where necessary to establish, exercise or defend legal claims.
6. Transfers to third countries
Easypeasy shall not transfer personal data to countries outside the EU/EEA without a valid transfer basis under applicable data protection law.
If such a transfer takes place, necessary safeguards shall be used, such as standard contractual clauses or another valid basis.
7. Retention and deletion
Because the System handles accounting records and traceability, deletion of individual items may be restricted.
When a user or business is deleted, data may first be logically deleted and then physically deleted later. Backups may be retained for up to three months after logical deletion, and security logs for up to three years where necessary for security, incident handling and traceability.
Data may be retained longer where required by law, a valid instruction, an ongoing dispute or the necessary protection of legal claims.
8. Security
Easypeasy works with technical and organisational measures to protect personal data, including access control, logging, secure transfer, secure storage, backup, recovery, vulnerability management and internal security follow-up.
No digital system can be guaranteed entirely risk-free, but we work systematically to reduce risk and manage incidents responsibly.
9. Your rights
- The right to access personal data we process about you.
- The right to rectify inaccurate or incomplete information.
- The right to erasure or restriction where the conditions are met.
- The right to object to processing based on legitimate interests.
- The right to data portability where processing is based on consent or a contract and carried out by automated means.
- The right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Slik ber du om sletting av kontoen din eller personopplysninger.
10. Contact
Questions about privacy can be sent to support@easypeasy.no .