1. Publisher and data controller
The norway-b2b.com website is an EDICTALYS service, SIREN 534 368 899, established in Joinville-le-Pont, France. EDICTALYS is the controller of data it collects directly from visitors, customers and prospects, within the meaning of Regulation (EU) 2016/679 (GDPR).
For each data file or service marketed, EDICTALYS specifies whether it acts as controller, joint controller or processor, in accordance with its traceability obligations.
2. Scope
This policy covers visitors to Norway-b2b.com, professional customers, contacts included in the B2B files marketed and prospects concerned by associated services. It addresses the provision of professional data and the management of enquiries, accounts and orders.
3. Data collected
- Data you provide: first and last name, role, company, professional email and telephone, billing details, account information, correspondence and requests to exercise your rights.
- B2B file data: company name, business identifiers where available, activity, professional contact details and other fields presented during selection. Data comes from public, self-reported or partner sources, subject to traceability and information requirements.
- Browsing data: IP address, browser, pages viewed, visit duration and information from cookies or trackers, depending on the features used and choices made.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account, order and customer relationship management | Contract performance or pre-contractual steps — GDPR Article 6(1)(b) |
| Compiling and supplying B2B files | Legitimate interests, subject to individuals’ rights — Article 6(1)(f) |
| Professional marketing | Legitimate interests where permitted; consent where required by the rules applicable to the channel and recipient’s country |
| Rights requests and accounting obligations | Legal obligation — Article 6(1)(c) |
| Audience measurement and website improvement | Consent for trackers requiring it; legitimate interests for processing lawfully exempt from consent |
The inclusion of contact details in a file does not remove the need to check applicable marketing rules, particularly in Norway. Every marketing message must provide an effective way to unsubscribe or object.
5. Recipients and service providers
To the extent necessary for each purpose, data may be accessed by authorised EDICTALYS staff, professional customers purchasing files under the agreed contractual framework, hosting and technical service providers, and competent authorities upon lawful request.
The website embeds the selection, counting and ordering module supplied through edictalys-digital.eu. Information entered in this module is processed for the services requested. Providers acting as processors are governed by GDPR Article 28.
EDICTALYS does not sell or transfer data outside the contractual framework described and requires appropriate data protection from its partners.
6. International transfers
Where a provider involves a transfer outside the European Economic Area, the transfer must be covered by a mechanism recognised under the GDPR: an adequacy decision, European Commission standard contractual clauses or other appropriate safeguards. Norway is part of the European Economic Area.
7. Retention periods
| Category | Retention period |
|---|---|
| Customer, account and billing data | Duration of the contractual relationship, followed by statutory limitation and accounting retention periods |
| Contacts in B2B files | 3 years from the last contact, unless the person objects or the source is updated |
| Marketing data | 3 years from the last active contact |
| Cookies and trackers | Up to 13 months depending on purpose; a shorter period may apply |
| GDPR requests and related correspondence | Time needed to handle the request, then evidential archiving for the applicable limitation period |
8. Data security
EDICTALYS implements appropriate technical and organisational measures: protection of sensitive data during transmission, access restricted to authorised persons, confidentiality and incident response procedures. These measures aim to prevent unauthorised access, loss, alteration or disclosure, in accordance with GDPR Article 32.
9. Cookies and trackers
Cookies strictly necessary for a requested service may be used without consent. Audience measurement, personalisation and other non-exempt trackers require prior consent. Continuing to browse does not constitute consent.
You can block or delete cookies through your browser. Where a service provides a consent management module, it allows you to express and change your choices for the relevant trackers. Blocking necessary cookies may affect account, counting or ordering features.
10. Your rights
Subject to the conditions in the GDPR, you have rights of access, rectification, erasure, objection, restriction and portability. You may withdraw consent where processing relies on it and give instructions regarding your data after death where applicable law provides for this.
Requests may be sent by post to the address below. A response is provided within one month. This may be extended by a further two months due to the complexity or number of requests; you will be informed within the first month. Proof of identity is requested only where there is reasonable doubt about your identity.
11. Complaints to a supervisory authority
You may complain to the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. You may also contact the competent supervisory authority, including Datatilsynet in Norway, under the conditions provided by the GDPR.
12. Personal data contact
For questions about this policy or to exercise your rights, write to EDICTALYS’s data protection contact:
EDICTALYS — Référent données
3 avenue des Platanes
94340 Joinville-le-Pont
France
13. Changes to this policy
This policy may be updated to reflect changes in legislation, services or practices. The update date appears at the top of this page. We invite you to check it regularly.
English translation of the French version.