Personal data is information that can be linked to you as a person. It can be your name and contact information, but also other information that can be linked to you more indirectly. In this privacy policy you can read about which personal data Bulk is responsible for processing. In the following we will inform you what data is involved, how the data is processed and what rights you have in this regard.
Bulk values your privacy. We comply with the Norwegian Personal Data Act including the EUs General Data Protection Regulation (GDPR).
Data Controller
Bulk is the data controller and determines the purposes for which and the means by which personal data is processed.
If you have questions about this privacy policy, you may contact us at legal@bulk.no
We mainly process information about you in the following cases:
- Customer Relations Management
- You have sent us an inquiry or complaint
- You have signed up for an event
- You subscribe to our newsletter
- You visit our stand at an industry event
- You have applied for a job
- You have visited our website, www bulkinfrastructure.com
- You have visited our premises
- You are an employee
We may also receive information about you from others in the following cases:
- We receive information about you from a government agency
- A job-applicant has provided you as a reference
- We collect information when you have given other organizations permission to share it
Bulk mainly processes the following personal data: basic contact information, addresses, email, purchase history, information related to employment, information concerning your interest in Bulk and bank information. Bulk retains the personal data only as long as necessary according to the purpose of processing. In general, we retain the personal information for the duration of the relevant agreement.
Bulk has an ICT operating model where we use external suppliers for the operation and maintenance of our internal IT services, including case management / archive and video conferencing solutions. All infrastructure and data are located within the EU/EEA or countries that achieve an adequate level of protection according to the European Commission's decision.
Processing of personal data in connection with administration of our business relations
We process personal data for the administration of relationships with our customers, suppliers, partners, and others, in order to provide our services and fulfil our contractual obligations. The legal basis for such processing is performance of a contract to which you are a party, GDPR Article 6 (1) (b).
Customer surveys
We process personal data when providing customer satisfaction surveys. The purpose is to verify whether Bulk can meet and/or improve customer expectations and needs. The legal basis for such processing is GDPR Article 6(1)(f)
Bulk’s customer portal
After signing a contract with Bulk, you may get access to Bulk’s customer portal and by signing on to this you may register a profile with us for the purpose of getting access to information about your data and the services provided by Bulk. The legal basis for this processing is performance of a contract to which you are a party, GDPR 6 (1) (b). The processing of any additional personal data that you freely choose to register in our portal is based on you consent, GDPR Article 6(1) (a).
By registering a Customer Profile, you may access an overview of information related to service requests, incidents or other requests done solely through the customer portal. You may also make new orders by entering details using your profile to communicate with Bulk.
We use email to communicate with our business relations. Emails we have received will be deleted when it is no longer needed. We ask that special categories of personal data are not sent unencrypted by e-mail. The legal basis is GDPR Article 6(1)(b) or 6(1)(f)
The information we process may also be used to provide information about Bulk’s services. Bulk will only communicate with persons who act in their role as professionals and on behalf of their company. The legal basis for such processing is consent, GDPR Article 6 (1) (a), or legitimate interest, GDPR Article 6(1) (f).
We only communicate for marketing purposes when we have the legal right to such communication, in accordance with the Norwegian Marketing Control Act (Marketing Act).
Newsletters
Bulk will from time to time send out newsletters about our services. In order to send you our newsletters you have to register an e-mail address. The e-mail address will only be used to send out newsletters and user surveys about the newsletter to get feedback on what readers need and what they find interesting. When you sign up for the newsletter, you consent to our processing of information about you.
You can unsubscribe by clicking on the link in the newsletter or by contacting us.
The legal basis for processing your e-mail address in connection with our newsletter is consent, GDPR Article 6 (1) (a). You can withdraw your consent at any time by unsubscribing from the newsletter. Withdrawing your consent will not affect the lawfulness of the processing of personal data that occurred before you withdrew your consent.
We collect information when you have given other organizations permission to share it
Your information may be provided to use by other organizations if you have given them your permission. This might for example be a business working with us or when you buy a product or service from a third-party organization. The information we receive from other organizations depends on your settings or the option responses you have given them.
Also, we may receive contact lists from third parties with whom we have contracted to receive such lists. We use your contact details for marketing purposes and to send out information about Bulk’s offerings. The legal basis for such processing is legitimate interest, GDPR Article 6 (1) f. You will always receive the opportunity to opt-out of such lists.
Attending events
We process personal data when you sign up for- and attend events.
When registering for an event, we will ask for information such as name, contact information and place of work. The purpose of the information is to provide information to participants, administer and organize events and prepare participant lists for participants. The information is stored until the event has ended.
The legal basis for processing this information is legitimate interest, GDPR Article 6 (1) (f), which allows Bulk to process information that is necessary to wind up events in a good way and this interest weighs heavier than the consideration of the individual's privacy.
Visit our stand at industry events
We process personal data when you provide us with information when visiting our stand at industry events. When you provide you contact details for the purpose of receiving information about Bulk, we use this information to send such information to you. The legal basis for the processing is legitimate interest, GDPR Article 6(1) (f).
Cookies
Cookies are small text files that are placed on your computer when you load a website. You can read more about our use of cookies in our cookie policy.
Website security
Bulk use cookies to ensure efficient and secure use of our website. Information processed may encompass IP address, browser and device identificators and time zone settings.
The legal basis is legitimate interest, GDPR Article 6(1)(f). The interest pursued is to ensure that our networks and information is secure.
Website analytics and statistics
Bulk uses Matomo Analytics to analyze how visitors interact with our website and to aggregate statistics on our website performance and traffic. Information processed include device and browser identificators, IP address, country you connect from and website interactions.
The legal basis for utilizing web analytics and aggregate statistics is legitimate interest, GDPR Article 6(1)(f). The interest pursued is to develop our business.
Using our “Contact Us” form
You may provide your details when you ask us for information or contact us for any other reason. When you provide you contact details for the purpose of receiving information about Bulk, we use this information to send such information to you.
The legal basis for the processing is legitimate interest, GDPR Article 6(1) (f).
Closed circuit television (CCTV)
Closed-circuit television (CCTV) operates outside and within the perimeters of our data center facilities. The footage is viewed by us and our security personnel and may be stored for a period of 7 days up to 30 days depending on the site’s security posture and contractual requirements.
In cases where the footage can provide valuable information for criminal investigations, the storage period may be extended as necessary to resolve the incident, file a police report, or pursue a legal claim. This extension must be documented and the footage used strictly according to the purpose limitation and established routines.
The legal basis for operating CCTV is legitimate interest, GDPR Article 6(1)(f). The legitimate interest pursued is to maintain an appropriate security level at our facilities and log evidence for criminal investigations in case of attempted breach of security.
Access control
All visitors to Bulk’s premises are required to register at the front desk. Depending on the premise you visit we may process your name, address, phone number, email, title and company affiliation. At our datacenters we may also process a copy of your ID. This information is automatically deleted after 90 days or after 1 year depending on the site’s security posture and contractual requirements.
In cases where visitor information can provide valuable information for criminal investigations, the storage period may be extended as necessary to resolve the incident, file a police report, or pursue a legal claim. This extension must be documented and the information used strictly according to the purpose limitation and established routines.
The legal basis for access control is legitimate interest, GDPR Article 6(1)(f). The legitimate interest pursued is to maintain an appropriate security level at our facilities and ensure that no unauthorized visitors are granted access to our premises.
Guest network
Visitors to our premises may request access to our guest network. Upon connecting to the guest network, we will log some device identificators, which access point and office location you’re connecting from, when you last connected to the guest network and the e-mail address of the employee you’ve requested access from. The log is deleted automatically after 30 days.
The legal basis for logging your connection to the guest network is legitimate interest, GDPR Article 6(1)(f). The legitimate interest pursued is network management. This allows us to provide you network access, oversee network performance and troubleshoot network issues.
Job applicants
If you apply for a job at Bulk, we need to process personal data about you to evaluate your application. The hiring process involves processing the personal data you’ve provided to us in your application documents, such as from your CV, diplomas and certificates of employment. For candidates moving ahead in the process, we may request permission to call your references.
The legal basis for reviewing your application and any submitted documents, perform interviews and check references is necessity to perform a contract, GDPR Article 6(1)(b). This means that we consider your action of applying as a request for us to evaluate your submissions with the goal of entering into a contract of employment.
For successful candidates, relevant application documents are stored in our HR system for the duration of your employment. For candidates that does not move forward to employment, application documents are stored for 2 months. We will ask you for permission in cases where we would like to store your CV for a longer time frame, in relation to other potential job opportunities in the company. This information will be stored in our HR system.
You can exercise your rights by emailing us at legal@bulk.no
Right of access to your personal data
You may request a copy of all personal data we process about you.
Right to rectification of your personal data
You may request that we correct or supplement personal data about you that are inaccurate or incomplete.
Right to erasure of your personal data
You may request that we erase your personal data. We will erase data when the conditions for erasure in GDPR Article 17 are met.
Right to restrict the processing of your personal data
In some situations, you may request us to restrict the processing of your personal data. See GDPR Article 18 for situations in which you may obtain such restriction.
Right to object to the processing of your personal data
If we process personal data about you on the basis of a legitimate interest, GDPR Article 6(1)(f), you have the right to protest our processing of your personal data.
Right to data portability
If we process personal data about you on the basis of consent of contractual obligation, GDPR Article 6(1)(a) or (b), you may request us to transfer your personal data to you or to another data controller.
Submit a complaint about our processing of your personal data
If you disagree with our processing of your personal data or argue that we do not comply with applicable data protection laws, you have the right to file a complaint with your relevant supervisory authority. We do however hope that you inform us via your point of contact in Bulk or send us an email at legal@bulk.no first so that we may investigate the matter together.