Privacy Policy

1. Introduction

Jelpify AS ("Jelpify", "we", "our", "us") respects your privacy and is committed to protecting personal data in accordance with:

• The EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR")
• The Norwegian Personal Data Act
• Applicable Norwegian and EEA data protection legislation

This Privacy Policy explains how we collect, use, store, and protect personal data when you:

• Visit our website
• Use our SaaS platform
• Communicate with us
• Enter into a business relationship with us

2. Data Controller

Unless otherwise specified, Jelpify acts as the Data Controller for personal data collected through our website and for business-related interactions.

When we provide our SaaS platform to customers, Jelpify typically acts as Data Processor on behalf of the customer (see Section 14).

3. What Is Personal Data?

"Personal data" means any information relating to an identified or identifiable natural person. This may include:

• Name
• Email address
• Phone number
• Company name and role
• IP address
• Login credentials
• Usage data
• Billing information
• Communication history

4. Categories of Personal Data We Collect

We may collect and process the following categories of personal data:

4.1 Website Usage Data

• IP address (possibly anonymized)
• Browser type and device information
• Pages visited
• Referral source
• Interaction data

4.2 Contact and Communication Data

• Name
• Email address
• Phone number
• Company information
• Message content

4.3 Customer Account Data

• Login ID
• Username
• Password (stored securely in encrypted/hashed form)
• Role within the organization
• Account configuration data

4.4 Financial and Billing Data

• Invoice details
• Billing address
• Payment-related information (processed via payment providers)

4.5 Marketing Data

• Newsletter subscriptions
• Webinar registrations
• Email engagement data (opens/clicks, where applicable and consented to)

5. Legal Basis for Processing

We process personal data under one or more of the following legal bases (GDPR Art. 6):

• Performance of a contract (Art. 6(1)(b))
• Legitimate interests (Art. 6(1)(f))
• Consent (Art. 6(1)(a))
• Compliance with legal obligations (Art. 6(1)(c))

Where processing is based on legitimate interests, we ensure that such interests are not overridden by your fundamental rights and freedoms.

6. Purposes of Processing

We process personal data for the following purposes:

6.1 Website Analytics and Improvement

To understand how visitors use our website and improve user experience, content, and performance.

Legal basis: Legitimate interest or consent (where required).

6.2 Marketing and Communication

To send newsletters, event invitations, product updates, and marketing materials.

Legal basis: Consent.

You can withdraw your consent at any time using the unsubscribe link or by contacting us.

6.3 Customer and Sales Management

To respond to inquiries, manage customer relationships, and administer contracts.

Legal basis: Legitimate interest and/or performance of a contract.

6.4 Delivery of Our SaaS Platform

To provide access to and operate our software services.

Legal basis: Performance of a contract.

6.5 Security and Fraud Prevention

To protect our systems, prevent unauthorized access, and ensure system integrity.

Legal basis: Legitimate interest.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable website functionality
• Analyze traffic
• Improve performance
• Support marketing activities (where consented to)

Cookies that are not strictly necessary require your consent. You can manage or withdraw your consent via the cookie settings available on our website.

For more detailed information, a separate Cookie Policy may apply.

8. Sharing of Personal Data

We may share personal data with:

8.1 Service Providers (Sub-processors)

Including providers of:

• Cloud-based hosting
• Analytics services
• CRM systems
• Email distribution tools
• Payment processors
• Customer support systems

All such providers are bound by Data Processing Agreements (DPAs).

8.2 Authorities

Where required by law, court order, or regulatory obligation.

8.3 Business Transfers

In the event of a merger, acquisition, or restructuring, subject to confidentiality safeguards.

We do not sell personal data.

9. International Data Transfers

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs)
• Adequacy decisions
• Other legally approved transfer mechanisms

10. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, including:

• The duration of the contractual relationship
• Legal and accounting obligations
• Statutory limitation periods for claims

After this period, the data is securely deleted or anonymized.

11. Security Measures

We implement appropriate technical and organizational measures, including:

• Encryption in transit (TLS)
• Access control and role-based permissions
• Secure authentication mechanisms
• Logging and monitoring systems
• Regular security reviews

We aim to ensure the confidentiality, integrity, and availability of personal data.

12. Your Rights Under GDPR

You have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right not to be subject to automated decision-making (Art. 22)

You can exercise your rights by contacting us at post@jelpify.no.

13. Right to Lodge a Complaint

If you believe your privacy rights have been violated, you have the right to lodge a complaint with:

The Norwegian Data Protection Authority (Datatilsynet)
Website: https://www.datatilsynet.no

You may also contact us first so that we can try to resolve the issue.

14. Jelpify as Data Processor

When customers use Jelpify's SaaS platform to process personal data relating to their own employees, customers, or partners:

• The customer acts as Data Controller
• Jelpify acts as Data Processor

The processing is governed by a Data Processing Agreement (DPA) between Jelpify and the customer.

We process personal data only on the customer's documented instructions and in accordance with GDPR Art. 28.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be published on our website with a revised "Last updated" date.

16. Contact

If you have any questions regarding this Privacy Policy or data protection in general, please contact:

Jelpify AS
Vossegtata 22, 0475 Oslo, Norway
Email: post@jelpify.no