Privacy policy

Controller

Overit Norway is operated by a Norwegian company that is currently being incorporated. As soon as it is entered in the Register of Legal Entities, its registered name, organisation number and business address will be published here. Until then you can reach us at post@overit.no.

Privacy questions and requests for access, rectification, erasure or objection go to personvern@overit.no. We answer within one month, as GDPR Art. 12(3) requires.

Company role data

Overit Norway publishes data from Brønnøysundregistrene on the roles entities hold in other entities — which audit firm and which accounting firm the register records for a company, and the reverse. It comes from the Central Coordinating Register for Legal Entities and is made available under the Norsk lisens for offentlige data (NLOD 2.0).

We do not publish roles held by natural persons. Only roles held by organisations are loaded. A role holder is therefore identified by its own organisation number, and this part of the site contains no personal data at all.

One exception is worth naming, because it is easy to miss: a sole proprietorship is usually called the same thing as its proprietor. The name of such an entity is therefore personal data, even though the register carries it as a business name. We publish it as the register writes it, on the same legal basis as the rest — legitimate interest under Art. 6(1)(f) — and you can object to it in the way described below.

If we begin publishing roles held by natural persons, this notice is updated in the same change that makes it — what we would then publish about a person, what we would not, and on what basis.

Objection and removal of role data

You may object to our publishing data about you at any time under Art. 21. Write to personvern@overit.no naming the person and the entity. We will weigh your interest against the transparency interest in your particular case and give you a reasoned answer.

We cannot correct the register entry itself. If it is wrong in the register, the correction has to be made at the Brønnøysund Register Centre and reaches us at the next update. If it is wrong only here, we fix it.

Accounts and contact

If you create an account we process your email address and whatever you enter yourself, in order to give you access. The legal basis is performance of a contract, Art. 6(1)(b). If you write to us we process your message in order to answer it, on the basis of legitimate interest.

Account data is deleted when the account is deleted. Correspondence is deleted once the matter is closed, normally within a year.

Cookies and analytics

The site sets no analytics cookies before you consent. Before consent no analytics script is loaded at all — they are not added to the page in a disabled state, they are not added.

• overit_session — the strictly necessary sign-in cookie, set only when you log in. HttpOnly, Secure, SameSite=Lax.
• overit-cookies — your analytics choice, held in the browser's localStorage rather than in a cookie. Without it we would have to ask you again on every page.
• _ga and _ga_* — Google Analytics, set only after you press Accept. Withdraw consent in the footer and they are deleted.

The legal basis for analytics is consent, Art. 6(1)(a) and § 2-7 b of the Norwegian Electronic Communications Act. The sign-in cookie needs no consent because the service cannot be delivered without it.

Who the data is shared with

We do not sell personal data and do not share it for marketing. We use these processors to run the service:

• Cloudflare, Inc. — site hosting and page caching.
• Neon, Inc. — the database the register data sits in.
• Google Ireland Limited — Google Analytics, on consent only.

Transfers outside the EEA rely on the European Commission's standard contractual clauses. Google Analytics runs with IP anonymisation, and analytics data is not linked to your account.

Your rights

You have the right to:

• access the data we hold about you, and a copy of it,
• rectification of inaccurate data,
• erasure,
• restriction of processing,
• object to processing based on legitimate interest,
• data portability where processing rests on a contract or consent,
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Requests go to personvern@overit.no. If you believe we process data unlawfully, you may complain to Datatilsynet.