Privacy Notice

Author:         Hans Philip Eide, Data Protection Officer (personvernombud)
Document Owner: Odda Digital System AS
Audience:       Website visitors, prospects, customer contacts, job applicants
Effective date: 25 May 2026
Version:        001

1. Who we are

Odda Digital System AS ("Odda Digital System", "we", "us", "our") is a Norwegian limited liability company (aksjeselskap), organisation number 918 167 803, with registered office at Holmavegen 29, 5750 Odda, Ullensvang kommune, Norway.

We develop and operate Visual Tracking ("the Service"), a Microsoft Dynamics 365 Business Central extension for shop-floor coordination, document management, and quality reporting.

For matters relating to this notice or to personal data processed by us, contact our Data Protection Officer (personvernombud under GDPR Article 37):

• Name: Hans Philip Eide
• Email: hans@oddadigitalsystem.no
• Postal: Odda Digital System AS, attn. DPO, Holmavegen 29, 5750 Odda, Norway

2. Scope of this notice

This notice describes processing where Odda Digital System acts as the Controller of your personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") and the Norwegian Personal Data Act (personopplysningsloven, lov om behandling av personopplysninger).

It covers personal data we process when you:

• Visit visualtracking.no or related domains we publish content on for the Visual Tracking Service
• Contact us through the website, by email, or by phone
• Subscribe to our newsletter or product updates
• Take part in a discovery call, demo, or pilot for the Service
• Become a named contact under a Customer's Order Form (sponsor, Business Central administrator, billing contact, Data Protection Contact, or legal contact)
• Apply for a position at Odda Digital System

This notice does not cover the personal data Odda Digital System processes inside Customers' Business Central tenants on behalf of those Customers. That processing is governed by the Data Processing Addendum (DPA) that forms part of each Customer's contract with Odda Digital System, where the Customer is the Controller and Odda Digital System is the Processor.

3. What personal data we collect and why

3.1 Website visitors

When you visit our website we collect:

For full detail on cookies and how to manage consent, see our Cookie Policy.

3.2 Contact and enquiry data

When you contact us via the website, by email, or by phone we collect:

If your enquiry leads to a contract, the retention is extended for as long as we maintain the customer relationship plus the limitation periods set out in Norwegian law.

3.3 Newsletter and product updates

If you subscribe to our newsletter or product update list we collect your name, email, and (optionally) your employer. We use this only to send the subscriptions you have requested.

We do not use personal data collected through these subscriptions for unrelated marketing without separate consent.

3.4 Discovery calls, demos, and pilots

During pre-sales conversations and pilot engagements we collect contact details, role information, and notes about the conversation (pain points, fit, technical context). We use this to assess whether Visual Tracking is suitable for your organisation and to plan a possible contract.

3.5 Customer contact data on Order Forms

When your employer signs an Order Form for the Service, the Order Form names individuals in five contact roles: Sponsor, Business Central administrator, Billing contact, Data Protection Contact, and Legal contact. For each named individual we collect name, job title (where given), work email, and work phone.

If you are named as a Customer contact and you leave your employer or change role, you can ask us (or your employer) to update the Order Form contact list.

3.6 Job applicants

When you apply for a position at Odda Digital System we collect the application materials you send us (CV, cover letter, references, interview notes).

4. Who we share personal data with

We share personal data with the following categories of recipients:

• Sub-processors who process personal data on our behalf — see our Sub-processor list for the current catalogue. Each sub-processor is bound by a Data Processing Agreement with us. The same list governs Customer Personal Data under the DPA.
• Professional advisors (lawyers, accountants, auditors) — bound by professional confidentiality.
• Public authorities — where legally required (e.g. tax authorities, Datatilsynet, court orders).
• Acquirers in case of a corporate transaction — subject to confidentiality undertakings.

We do not sell personal data and we do not use it for advertising-network targeting.

5. International transfers

Most processing takes place within the European Economic Area (EEA). Some processing takes place outside the EEA:

• United States: GitHub Inc., Sentry (Functional Software Inc.), Google LLC for analytics processing. Transfers are governed by the EU-US Data Privacy Framework where the recipient is certified, with EU Standard Contractual Clauses as a backup mechanism.
• India: Softices Consultancy Private Limited (Surat, Gujarat) provides engineering, debugging, and support to us under EU Standard Contractual Clauses (Module Three, processor-to-processor) with supplementary measures (encrypted remote sessions to Azure with data remaining at rest in the EEA, no local download, MFA + RBAC, access logging).
• CRM and customer communications: our CRM and support platform (HubSpot Ireland Limited) stores data in the EEA (Frankfurt) under HubSpot's EU data residency. Its parent, HubSpot, Inc. (United States), may access this data to provide support; such access is governed by the EU-US Data Privacy Framework with EU Standard Contractual Clauses as a backup.

A documented transfer impact assessment for the India transfer is reviewed at least annually. The full transfer mechanism and supplementary measures are described in the DPA Section 3.6.

6. Your rights

Under the GDPR and Norwegian personal-data law, you have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify inaccurate or incomplete personal data (Article 16)
• Erase personal data ("right to be forgotten") in the circumstances set out in Article 17
• Restrict our processing in the circumstances set out in Article 18
• Object to processing based on our legitimate interest (Article 21)
• Receive the personal data you provided to us in a portable, machine-readable format (Article 20)
• Withdraw consent where processing is based on consent, without affecting the lawfulness of past processing (Article 7(3))
• Not be subject to a decision based solely on automated processing (Article 22) — note: Odda Digital System does not currently perform automated decision-making

To exercise any of these rights, contact us at hans@oddadigitalsystem.no or by post (see Section 1). We will respond within one month under Article 12(3); the period may be extended by a further two months for complex requests, in which case we will tell you within the first month.

We may need to verify your identity before responding, to avoid disclosing personal data to the wrong person.

7. Complaints

If you believe our processing of your personal data does not comply with the GDPR or Norwegian personal-data law, you can complain to Datatilsynet (the Norwegian Data Protection Authority):

• Website: datatilsynet.no
• Email: postkasse@datatilsynet.no
• Phone: +47 22 39 69 00
• Post: Datatilsynet, Postboks 458 Sentrum, 0105 Oslo

We hope you will contact us first so we have an opportunity to address your concern directly.

8. Changes to this notice

We may update this notice from time to time to reflect changes to our processing, legal requirements, or sub-processor arrangements. The effective date at the top of this notice shows when the current version took effect. Material changes will be announced on our website at least thirty days before they take effect.

Past versions of this notice are retained internally and available on request.

9. Contact

For all questions relating to this notice or to personal data processed by Odda Digital System: