Our Privacy Policy

​

Contact

1. Accountability and contact details

K8 Industridesign acts as a data controller when processing your data for its purposes and needs.

​

When carrying out user-insight projects, K8 Industridesign may act as a joint data controller with the client ordering the innovation project or as a data processor. See below section 4 for more information on insight projects.

​

K8 Industridesign AS

Sagveien 23c, 0459 Oslo

+47 934 15 461

k8@k8.com

 

Personal data

2. What personal data do we process and why?

K8 Industridesign is required to process personal data to conduct its business activities, answer inquiries, and maintain or create new business relationships.

​

We process personal data such as name, email, role, and telephone number about prospective clients, to follow up on leads and establish new business connections. This is done under our legitimate commercial interests and in preparation for entering new contracts.

​

We process personal data about existing customers such as contact details to our contact point within the company, to administer our relationship, perform billing, answer inquiries, and provide assistance. This is done under our need to fulfill our contractual and legal obligations, such as those connected to taxes and bookkeeping.

​

We process personal data to obtain insight into specific subjects. These insights are gained by sending questionnaires to a particular target group or interviewing the insight subjects. The personal data and the precise processing activities to be performed are dependent on the scope and subject of the project. We rely on explicit consent from the insight subjects for collecting and processing that data.

​

We process personal data such as CV, professional references, and contact information if you’ve applied for a job with us. This is done in our legitimate interest to assess your competence and fulfill our business needs.

​

In these situations, your personal data is provided to us by you directly.

 

​

Indirectly collected data

3. Personal data that is not collected directly from you

We may receive personal data about you indirectly if:

​

We have contacted your organization, and your organization provides us with your contact in its response. This is done in our legitimate interest to obtain information or establish a relationship with your organization.

​

A company you are a customer, member or employee of provides us with your contact information so that we may contact you within the scope of an insight project we are conducting for them or for a third party they have an agreement or relationship with. Those companies, entities, and organizations are themselves responsible for having a valid lawful basis for collecting your personal data and providing us with your contact information.

 

​

User insight

4. User-insight projects

K8 Industridesign provides its clients with research and insight into certain user groups or subjects, including the health industry. As a result, personal data provided willingly by an insight interviewee will vary according to the particular project and may include so-called "special categories" of data such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sex life history, sexual orientation, trade union membership or criminal history. This specific category data receive additional protection under the law, and K8 Industridesign has implemented a secure process to ensure its proper handling and deletion.

​

While a project is ongoing, we secure your personal data by pseudonymizing it. This means we use an identifier such as "Interviewee #1" to refer to you rather than a personal trait like your name, age or telephone number. Once we have gathered sufficient insights, we aggregate your responses along with other project participants so that no single person may be identified by delivering our results to our customers. Once the project has been completed and the aggregated results produced, the material gathered from your participation (including any photos, audio recordings, or other personal data) is promptly deleted or fully anonymized.

​

In cases where our customers solely determine the purpose, scope, and focus group of a project, K8 Industridesign acts as a data processor. In these cases, our customer provides us with your contact information and remains responsible for the lawfulness of the purpose and legal basis for processing. For more information on how such a customer processes your data and how you may exercise your data subject rights, please contact the customer directly or, if you prefer, contact us as described below and we will notify them.

​

In cases where K8 Industridesign collaborates with a customer to jointly determine the project focus group and/or locates participants themselves, we act as a joint data controller with our customer. In these cases, you will find information in this privacy notice about how your personal data is processed and how to exercise your data subject rights.

 

​

Data sharing

5. Who do we share your personal data with?

In conducting its business activities, K8 Industridesign may share your personal data with the following parties:

​

Other K8 subsidiaries within K8 Industridesign

​

To maintain an overview of which customers and contacts have relationships with various entities within K8 Industridesign.

​

Public Authorities.

​

In the event of legal action involving K8, K8 may be required to provide personal information according to a court order or other statutory requirement.

 

​

Data processing

6. Who processes your personal data on behalf of K8 Industridesign?

To process its data and perform its activities, K8 Industridesign relies on several companies to store and process personal data on our behalf. These companies are referred to as “data processors”, and our relationship with them is defined in a written data processing agreement that states the processors’ obligations and limitations under which they will process personal data. We may transfer the data we collect about you to countries other than the country in which the data was originally collected, including the United States, Canada or other destinations outside the European Economic Area (“EEA”). Those countries may not have the same data protection laws as the EEA. When we transfer your data to other countries, we will protect the data described in this Privacy Policy and comply with applicable legal requirements providing adequate protection for data transfer to countries outside the EEA. For data sent outside EEA we use the Standard Contractual Clauses created by the European Data Protection Board as a part of the agreement with each processor.

​

K8 Industridesign utilizes the following data processors to process your personal data under our specific instructions:

 

Asana

Purpose: Project management

Processing Location: USA

Legal Basis for Transfer Outside of EU/EEA: Standard Contractual Clauses

 

Dropbox

Purpose: Document storage

Processing Location: Western Europe

Legal Basis for Transfer Outside of EU/EEA: N/A

 

Google

Purpose: Site analytics and performance measurement of the k8industridesign.com website

Processing Location: Western Europe, USA

Legal Basis for Transfer Outside of EU/EEA: Standard Contractual Clauses

 

Microsoft

Purpose: Office 365

Processing Location: Western Europe, USA

Legal Basis for Transfer Outside of EU/EEA: Standard Contractual Clauses -

 

Miro

Purpose: Collaborative design tool

Processing Location: USA

Legal Basis for Transfer Outside of EU/EEA: Standard Contractual Clauses

 

Slack

Purpose: Project collaboration

Processing Location: USA

Legal Basis for Transfer Outside of EU/EEA: Standard Contractual Clauses

 

Tripletex

Purpose: Customer billing/ERP

Processing Location: Norway

Legal Basis for Transfer Outside of EU/EEA: N/A

 

​

Retention

7. Retention periods

To the extent permitted by applicable law, K8 Industridesign retains your personal information for as long as it is needed to fulfill the purposes for which we obtained it. We may in some cases keep it beyond that time if we process the same data under another lawful basis, stated in this Privacy Policy or at the point of collection, that permits us that.

​

Contacts of Partners, Vendors and Customers-

We retain contact information of employees of our partners, vendors and customers for 2 years after our commercial relationship terminates unless the employee terminates their employment before, and we are informed to update the data, or we are required to retain it longer due to legal action.

​

Insight Project Data-

We anonymize or delete all information regarding an insight project within 30 days of the project’s completion.

​

Data of Former K8 Industridesign Employees-

K8 Industridesign retains information on its former employees as necessary to comply with other legal obligations such as applicable accounting and tax law. Certain information kept for accounting and tax reasons such as your salary history will be deleted no later than 5 years following the end of your employment, while limited information about your identification as a former employee, your role, dates of employment and information linked to your competence and/or responsibilities shall be retained in our systems.

 

​

Your rights

8. Your data protection rights

You have the right to request us to confirm whether we are processing personal data about you. Also, you have the right to ask us to:

​

Access to your personal data.

​

Rectify, supplement and update your personal information.

​

Delete or restrict the processing of your personal data under certain circumstances.

​

Object to processing activities carried out for marketing purposes, as well as to object to certain activities carried out to fulfil our legitimate purposes, under certain circumstances.

​

Have personal data that you have provided us directly ported to you or another company in a commonly readable file format.

​

Withdraw a consent you have given, at any time.

​

You may exercise your rights by contacting us at k8@k8.com. Requests will typically be answered within 30 days. For more information about your data subject rights, visit the Norwegian Datatilsynet’s website.

 

​

Complaints

9. Complaints

If you have queries or concerns, please contact us at k8@k8.com, and we'll respond. If you remain dissatisfied, you may file a complaint about the way we process your personal information to the Norwegian Datatilsynet, which is the supervisory authority for the processing of personal data by K8 Industridesign.

 

​

Website

10. Visits to our website

Through the analysis tools of our website engine WIX and Google Analytics, we collect data about visitor activity on our website. This data may include your IP address, your cookies, and user setting information, as well as information about the machine you’re using including device attributes like IP address, operating system software, device type, and browser type. The collected data is anonymized and used to perform analysis of general trends on our website. The data cannot be linked to you and is not considered personal data.

 

Furthermore, we may collect information about your interaction with our website, including logs, crash reports, date and time, referrer URL of your request, and other information of relevance to uncover malfunction and ensure the security of our website and IT infrastructure.

​

Cookies: We only use essential cookies on our website. If you do not want to accept our use of cookies, you can withdraw your consent by changing the settings in your browser. Please note that this may result in the services on the websites not functioning optimally.

 

​

Changes

11. Changes to this notice

We periodically update or change this privacy notice as a consequence of changes to our business activities, our processing activities, or changes in the law. We will post a notice on this website when such changes are made, so you may review what is new and inform yourself about our practices.

​

Oslo, Norway

 

08.11.2022