E-mail exchange information notice

B2 Impact ASA ensures the lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability of the information received in the scope of exchanging e-mails processing activity.

Data subjects

Who is considered data subjects in the e-mail exchange process?

• Clients
• Potential clients
• Partners/Investors
• Providers/Advisors
• Employees
• Candidates
• Legal Authorities
• Other stakeholders

Data controller

Who is responsible for your data?

B2 Impact ASA
PO Box 1726 Vika
0121 Oslo
Norway

For general information about B2 Impact ASA, see the B2 Impact website.

Purposes and legal basis

Why does B2 Impact process your data?

In the context of the exchange e-mails, B2 Impact ASA processes your personal data to communicate with you.

The legal basis for processing your data are:

• GDPR art. 6(1)b - performance of a contract or to take steps prior to entering into a contract,
• GDPR art. 6(1)c - the processing required for compliance with a legal obligation,
• GDPR art. 6(1)f - execution of the controller's legitimate interests to enable information exchange.

How does B2 Impact ASA collect your data? 

B2 Impact ASA process different category of data, directly provided by you in the context of an e-mail exchange. B2 Impact ASA may process the following categories of personal data.

In addition, B2 Impact ASA may collect your contact data from publicly accessible sources with the purpose of communicating with you.

What type of data is processed?

Categories of data:

• Clients
• Potential clients 
• Partners/Investors
• Providers/Advisors
• Employees
• Candidates
• Legal Authorities
• Other stakeholders

Type of data:

• Name and surnames
• Phone number
• Company name and address
• E-mail
• Fax
• Labour contact data
• Profession/workstation
• Any other data that you provide in the e-mail exchange

Recipients

Who will process your data? 

In the context of the e-mail exchange activity, B2 Impact ASA may disclose personal data to the following third parties on the basis of a legal obligation and/or its legitimate interest:

• B2 Impact group entities
• IT service providers
• External advisors
• Legal authorities, public bodies, and institutions

Notwithstanding the foregoing, B2 Impact ASA will adopt the necessary measures to preserve the confidentiality of data and will apply the principle of minimisation to the disclosed data.

Transfer of personal data outside the European Economic Area (EEA)

During the processing activity, personal data could be transferred outside the European Economic Area (EEA) to the third countries, which are not subject to the European Commission adequacy decision. Additionally, under certain conditions, processors, acting on behalf of B2 Impact ASA may transfer personal data outside the EEA, as well. In such cases, the personal data will be transferred in compliance with the General Data Protection Regulation articles 46, 47, or 49(1), especially, Standard Contractual Clauses with further security measures applied. 

Retention policy

How long will B2 Impact keep your personal data? 

Your personal data will be processed:

• for the time necessary for the establishment and management of a business relation,
• as long as required by the law, and
• to secure the legitimate interest of B2 Impact ASA.

Data subject rights

The GDPR provides you the following rights:

• Right to be informed about how B2 Impact ASA process your data.
• Right of access to personal data – you may access a copy of your personal information.
• Right to rectification – you have the right to rectify information you think is inaccurate or supplement information which is incomplete.
• Right of objection- you may object to the processing of your personal data based on B2 Impact ASA legitimate interest.
• Right to restriction- you may request a processing limitation in the following situations:
  • You contest the accuracy of your personal data process by B2 Impact ASA and therefore, during the period required to verify the accuracy of your data;
  • the processing of your personal data is unlawful, and you oppose the erasure of the personal data and requests the restriction of their use instead of restricted data processing.
  • B2 Impact ASA no longer needs your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims.
  • the data subject has objected to processing pursuant to Article 21(1) pending the verification of whether the legitimate grounds of the controller override those of the data subject.
• Right to erasure (“right to be forgotten”) – you may request the erasure of your data when
  • Your personal data are no longer necessary in the context of the Whistleblowing procedure.
  • You object to the processing activity based on B2 Impact ASA legitimate interest.
  • Your data have been unlawfully processed.
  • Your data have to be erased for compliance with a legal obligation affecting the Data Controller.
• Right to data portability – you have the right that B2 Impact ASA transmits the personal data that you have provided to another controller.
• Right to file a complaint - you also have the right to file a claim to the Norwegian Data Protection Authority (Datatilsynet) in case of issues related to the processing of their data.

You may exercise your rights by sending a written notification to B2 Impact ASA to the following e-mail address: dpo@B2 Impact.no.

Upon the receipt of your data subject right demand, B2 Impact ASA will respond within one (1) month, or this deadline may be extended by a further two (2) months, in which case you will be informed about the reasons for such extension.  

Automated decision-making, including profiling

B2 Impact ASA does not carry out profiling and does not apply automated decision-making for the purposes presented in the information notice.