# Telenor Software Lab AS Privacy Policy **Last Updated: 2023-12-04** This Privacy Policy ("Policy") explains how Telenor Software Lab AS ("Telenor Software Lab", "TSL", "we", "us", "our") collect and use your information when you use our Services, client software, and websites ("Service", "Services"). We are a company registered in Norway with company registration number 884 640 202. The Privacy Policy applies to any TSL websites or apps that link to this Policy. It also applies when you contact us by telephone, SMS, email, live chat, letters, or any other correspondence. For the purposes of this Policy, the data controller is Telenor Software Lab AS. ## Our Privacy Promise We are committed to protecting your personal information, being transparent about the data we hold, and wherever possible giving you control over how we use it. It's important that you read this Policy to understand the information we may hold about you and how we use it, and how you can access or update your information, modify your preferences, or request deletion of your personal data. This Policy explains: - What information we collect about you - How we collect and uses information about you - Whether we disclose your details to anyone else - The choices available to you regarding the personal information you provide to us - When and how your data may be shared with third-parties - Information regarding the use of cookies on our websites We keep this Policy under regular review to make sure it is up to date and accurate. Amendments and updates to this Policy may be made from time to time. Any revisions will be posted on this page so you will always be aware of the information we collect. Please review this page regularly so that you are aware of any changes. We use your information in line with all applicable Norwegian and European laws and regulations concerning the protection of personal information from time to time in force, including Personopplysningsloven 2018, Ekomloven 2002, and the General Data Protection Regulations (GDPR), and including any amendments or updates to these and any equivalent or successor applicable laws and regulations. ## Your Rights Within each Service, your Privacy settings allows you to control and customise your privacy preferences. Additionally, here you can find information on your rights under GDPR: ### Right To Withdraw Consent Where you have previously given consent for us to process your personal data, you can withdraw that consent any time. You can use the Privacy settings of the Service to control your preferences. ### Right To Access Your Information You can ask for more detail regarding the personal data we collect about you and how we process it. You can use the Privacy settings of the Service to request a report that reflects the personal information we hold about you. ### Right To Rectification You can request that we correct any incorrect personal data which we are processing. For most of our Services, the simplest way of achieving this is through updating your user profile yourself. You may also get in touch with our Customer Support team for assistance. ### Right To Object You have the right to object to certain types of processing such as direct marketing, automated processing, or profiling. You can use the Privacy settings of the Service to control your preferences. ### Right To Erasure You can request that we erase the personal data we hold about you and delete your account. You can use the Privacy settings of the Service to request your account is deleted. This will include the irreversible deletion of all content in your account, so make sure you take a backup before making this request. It may take up to 30 days for us to complete this request. ### Right To Restrict Processing Depending on the processing activity, you can request that we stop or limit processing of your personal data. You can use the Privacy settings of the Service to control your preferences. ### Right To Portability You can request the personal data concerning you, which you have provided us with and that we are processing based on your consent or in order to perform a contract with you, in a structured commonly used and machine-readable format, provided that the data is processed using automated means. You can use the Privacy settings of the Service to request a report that reflects the personal information we hold about you. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. We also will not be able to extend this right in a way that would adversely affect the rights and freedoms of others. You also have the right to lodge a complaint directly with the Norwegian supervisory authority [Datatilsynet](//datatilsynet.no/). ## How Do We Get Information? We obtain personal information in the following ways: - *Direct:* Information users provide us with upon our request when subscribing to or otherwise using our Services, or when getting in touch with us. - *Automatic:* Data generated automatically by the use of our Services. - *Indirect:* Information that we may receive from third-parties. ## How Long Do We Keep Information? Our data retention policies vary based on the purpose of processing. As a general rule, personal data will be kept only as long as is necessary for the purposes outlined in this Policy. Account-related data is kept for the period in which the account is active. If you decide to close your account, personal data is deleted within 30 days, except in cases where there are legal reasons to retain it. Information retained in backups of our systems will be deleted on a rolling 30 day schedule. ## What Legal Basis Do We Use to Process Information? Under data protection laws, we are required to have a legal basis to process your personal information. We have set out below the legal bases we rely on: - *Performance of Contract:* To perform a contract entered into with you and fulfil our contractual obligations to you or to take steps at your request prior to entering into a contract. This processing is necessary for us to provide the Service. - *Legitimate Interests:* Where necessary for our legitimate interests or those of a third-party. Where possible, we may give you the opportunity to opt-out of this processing. - *Legal Obligation:* Where processing is necessary to comply with our legal or statutory obligations. This may include co-operating with Police or Law Enforcement Agencies in relation to their investigations, or to comply with a court order. ## Why and How Do We Process Information? The majority of our data processing is an integral part of our Services and essential to provide the functionality that users request. Such data processing therefore is necessary to deliver the Services that we have committed to in their respective Terms of Service. Some supporting data processing is beneficial to the provision of our Services, while not an integral part of it, such as developing new features or measuring the performance of existing features to further improve our Services. In that case, that data processing serves the legitimate interests - as listed below - of us or other members of Telenor Group. Below you can find further detail on the key ways we process information and the legal basis for each. ### Performance of Contract #### Service Provision To facilitate the upload, download, storage, and sharing of your content, as requested by you in order to provide the Service. You are able withdraw consent for this at any time by closing your account, after which all user data will be deleted within 30 days. ### Legitimate Interests #### Customer Service We will process your data to provide you with effective assistance when you contact us, for quality assurance, and to improve our processes. Once we have resolved any issues you may have, we will retain information relating to it for 90 days, after which it will be deleted. #### Additional Service Features We will process data to provide useful functionality within our Services. For some specific types of data, including facial recognition, object detection, and optical character recognition, you can opt-out of this processing at any time within your Privacy settings, and any data of yours that we hold for this purpose will be deleted. #### Service Improvement We will process data to ensure the smooth operation of our websites and apps, to facilitate troubleshooting and easy accessibility when needed, to understand by which means Services are accessed (such as device types, operating systems, browser type), and to identify where potential issues with the user interface occur. You can opt-out of this processing at any time within your Privacy settings, and any data of yours that we hold for this purpose will be deleted. #### Performance Improvement We will process data to understand how our Services are used across different markets and over time in order to optimise them accordingly. You can opt-out of this processing at any time within your Privacy settings, and any data of yours that we hold for this purpose will be deleted. #### Telenor Group Integration Data will be processed to provide centralised services to other members of Telenor Group. Data may be shared to help with the integration of these services, and to ensure that user rights are allocated. For example, your mobile operator may share data with us so we know that you have one of our Services bundled as part of your subscription. This may also include information on the performance of the Service to improve integration or supporting internal reporting. #### Direct Marketing of Telenor Software Lab Products & Services Data will be processed to provide you with updates and tips on how to use the Service effectively. These will usually take the form of push notifications, emails, and SMS messages. You can opt-out of these communications at any time, and you have granular control over the methods we use to contact you e.g. opting out from email and SMS contact, but allowing push notifications within your Privacy settings. #### Security We will process data to ensure that our Services are free from abuse. This includes, but is not limited to, processing for the purposes of fraud and cybercrime prevention, ensuring the security and integrity of our networks and data, and the detection and reporting of possible criminal acts or threats to public security. ### Cookies and Tracking Technology We use cookies and similar technologies ("cookies") to provide essential functionality, to improve, to secure, and to promote our Services. The cookies we use are classed as *strictly necessary*. This means they're essential to the operating of the Service, and enable core functionality such as security, network management, and accessibility. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org. #### How Can I Control The Data Collected Through Cookies? You can set your web browser to not accept any cookies, but please be aware this may cause the Service not to function. #### Overview of Cookies Used by TSL Following is a list of the cookies we use, and a brief explanation as to why we use these cookies. | Name | Origin | Category | Functionality | | ------------ | ------ | ------------------ | ------------------------------------- | | imbox | ImBox | Strictly Necessary | To provide live chat support | | __stripe_mid | Stripe | Strictly Necessary | To prevent fraud | | __stripe_sid | Stripe | Strictly Necessary | To prevent fraud | ## Data Transfers We transfer some data to third-parties. ### Telenor Group As a service provider in the Telenor Group, we collaborate with other Telenor companies. These activities may require data transfer, for example, to or from your mobile operator. ### External Vendors & Parties We use external vendors to host services and to help improve and maintain our Services. These vendors are data processors for us, which means they are legally and contractually obligated to follow our instructions, maintain the data securely, delete data upon request, and so forth. If we decide to sell, buy, merge, or otherwise re-organise our business, we will need to conduct any data transfers needed to complete such an operation. ### Third-Country Data Transfers TSL transfers some data to countries outside the European Economic Area (EEA)/European Union (EU). Such a transfer occurs when a user's country of residence is outside EU/EEA, the user is a subscriber to the local Telenor mobile services provider and TSL services are offered as a bundle with the subscription, or when we use transfer data to an external vendor, party, or other processor based outside EU/EEA. For all data transfers to a third-country not pre-approved by the EU as having an adequate level of protection, we enter into standard data protection clauses adopted by the European Commission (“EU Model Clauses”). ## Complaints and Contact If you wish to make a complaint about how your personal data is being processed by us (or third-parties as described above), in the first instance please speak with our Customer Support team. If our Customer Support team is unable to assist you in a satisfactory manner, you can email our Data Protection Officer via personvernsenter@telenor.no. You also have the right to lodge a complaint directly with the Norwegian supervisory authority [Datatilsynet](//datatilsynet.no/). If you have any questions regarding the use of your personal data please contact our Customer Support team.