Why we collect your personal information, and what information we collect

We collect personal data such as your name, email address, phone number and other relevant contact details. Personal data is collected:

• Directly from you
• From your employer or business partner
• Through your interaction with our website or services

We process personal data for the following purposes:

• Performance of contracts and managing business relationships
• Communication, including responding to inquiries and providing information
• Administration, accounting and invoicing
• Sending relevant updates or newsletters (where permitted)
• Maintaining and improving our services and website
• KYC verification when establishing client relationships or onboarding suppliers

We do not process personal data for purposes incompatible with those described above.

Legal basis for processing

Our processing is based on one or more of the following legal grounds:

• Performance of a contract or pre-contractual steps (Article 6(1)(b))
• Legitimate interests, including managing business relationships, communication and service delivery (Article 6(1)(f))
• Compliance with legal obligations (Article 6(1)(c))
• Your consent, where required (Article 6(1)(a))

Where processing is based on legitimate interests, we assess that such interests are not overridden by your fundamental rights and freedoms.

Sharing of personal data

We do not sell your personal data. We may share personal data with:

• Service providers acting as data processors (e.g. IT, hosting and communication providers)
• Group companies for internal administrative purposes
• Public authorities where required by law

All processors are subject to written data processing agreements ensuring appropriate confidentiality and security.

Recruitment

Our processing of personal data
Höegh Evi processes personal data relating to job applicants and other potential candidates, including for permanent positions, internships and similar roles.

In the recruitment process, we typically process personal data such as contact information (including name, email address, postal address, telephone number and current role or affiliation), as well as information relating to qualifications and experience, including CVs, applications, transcripts, certifications, references and any other information provided by you during the recruitment process or in interviews.

Where relevant, we may also process internal assessments and evaluations carried out as part of the recruitment process, including in connection with trainee or internship programmes.

Purpose and legal basis for processing
Personal data is processed for the purpose of assessing candidates and conducting recruitment processes, including selecting and onboarding suitably qualified individuals.

The processing is based on the necessity to take steps prior to entering into an employment contract with you (Article 6(1)(b) GDPR), as well as our legitimate interests in ensuring that we recruit appropriately qualified candidates and manage our recruitment processes effectively (Article 6(1)(f) GDPR).

Sharing of personal data
Access to personal data in the recruitment process is limited to relevant personnel involved in recruitment activities, including HR and hiring managers, on a need-to-know basis.

We may use third-party service providers for IT, recruitment systems or communication tools, who process personal data on our behalf as data processors. All such providers are subject to appropriate data processing agreements ensuring confidentiality, security and compliance with applicable data protection requirements.

Social media

Our processing of personal data
Höegh Evi uses social media platforms such as LinkedIn. In connection with our company pages on LinkedIn, Höegh Evi and the platform provider may act as joint data controllers for certain processing activities. This includes the collection of personal data relating to visitors to our pages, processing carried out to generate aggregated insights and statistics regarding use of our pages, and the delivery of content and communications to users of the platforms.

Data subjects include individuals who visit or interact with our social media pages, whether logged in to a user account or accessing the platforms without such an account.

Through these channels, we typically process personal data such as:

• Name, username and profile information made available by the user
• Information relating to your interaction with us, including likes, comments and messages
• Information relating to usage and engagement with our content, as provided by the platform operators

Please note that the relevant platform providers also process personal data for their own independent purposes. Höegh Evi is not responsible for such processing. You can manage how your personal data is collected and used by these platforms through the privacy settings in your user account on the relevant platform. For further information, please refer to the privacy policies of the respective platform providers.

Use of sub-processors
In some cases, suppliers; for example, IT vendors, marketing companies, banks, customer satisfaction survey providers, etc., will process personal data on behalf of Höegh Evi. We always enter into necessary data processing agreements in these cases.

International transfers
Where necessary in the context of our business operations, we may transfer your personal data to countries outside the EU/EEA, including to other Höegh Evi group entities or offices located in such jurisdictions.

As a general principle, access to personal data is restricted to the relevant jurisdiction in which the processing activity takes place. Personal data originating from the EU/EEA will not be made available outside the EU/EEA unless this is necessary for the relevant purpose.

Where personal data is transferred to third countries, we ensure that such transfers are subject to appropriate safeguards to ensure a level of protection essentially equivalent to that guaranteed within the EU/EEA. This includes, where applicable, entering into agreements based on the European Commission’s standard contractual clauses and implementing supplementary technical and organisational measures as required.

Use of cookies and website data
When you visit our website, we may collect technical data such as IP address, device information and usage data through cookies or similar technologies.

Cookies are used to:

• Ensure functionality of the website
• Analyse usage and improve performance
• Support communication and services

Further information is available in our Cookie Policy.

Security measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, taking into account the risks associated with processing.

Retention of personal data
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet contractual, legal, accounting and reporting obligations.

The applicable retention period depends on the nature of the personal data and the context in which it was collected. In particular:

• Personal data processed for marketing purposes, including invitations to events, seminars and newsletters, is retained until it is no longer necessary for those purposes or until you opt out or withdraw your consent
• Personal data processed in connection with customer or business relationships is retained for the duration of the relationship and for a reasonable period thereafter to comply with legal obligations and manage potential claims
• Where processing is based on consent, the personal data is deleted when consent is withdrawn, unless further retention is required by law

Personal data is reviewed on a regular basis and deleted or anonymised when it is no longer necessary for the purposes for which it was collected.

Your rights as a data subject

You have the right to:

• Access your personal data
• Request rectification of inaccurate data
• Request erasure of personal data
• Request restriction of processing
• Object to processing based on legitimate interests
• Request data portability
• Withdraw consent at any time (where applicable)

Your rights may be subject to limitations where required by law or overriding legitimate interests.

Requests can be submitted using the contact details below. We will respond without undue delay and no later than one month.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Changes to our Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities or legal requirements. The latest version will always be available on our website.

Contact information

If you have questions regarding this Privacy Policy or our processing of personal data, please contact:

Email: info@hoeghevi.com
Subject: Privacy Policy inquiry