Privacy Policy

How Mynder AS processes personal data about visitors, customers, partners and users of the Mynder platform.

This privacy policy covers our processing of personal data regardless of how you come into contact with us – as a visitor to our website, as a partner, as an end customer through a partner, or as a direct customer.

Mynder AS processes personal data as part of our business. Where Mynder is the data controller, we determine why and how personal data is processed. Below you will find information about which personal data we process, why we process it, the legal basis we rely on, how long we store it and who the data may be shared with.

If you have questions or would like to know more about how we process personal data, please contact us. Contact details are provided below.

Mynder's situation: why this policy has an extra layer

Mynder is used by several types of actors: visitors to mynder.io, partners and their employees, end customers who use the platform through a partner, and direct customers who use the platform without a partner. Users may also enter content into the platform on behalf of their organisation.

We therefore always need to clarify two things: (i) whether Mynder is the data controller or the data processor for the information, and (ii) who is the controller when Mynder is the processor.

This policy applies only where Mynder itself is the data controller. That covers, for example, information about you as a visitor, contact person, partner or customer. Content that you or your organisation enters into the platform as a customer is instead governed by the data processing agreement between Mynder and your organisation. In that case your organisation is the controller and Mynder is the processor.

Situation

Data controller

Applicable document

You visit mynder.io

Mynder

This policy

You contact us

You are a contact person at a partner or customer

Content you/your organisation enters into the platform as a customer

Your employer or principal

The data processing agreement

1. Who is responsible for the processing?

Mynder AS is the data controller for the processing described in this policy that is not covered by a data processing agreement. This means that Mynder determines the purpose of the processing and the means used.

Address: Edvard Griegs vei 3C, 5059 Bergen, Norway

Email: personvern@mynder.no

Company reg. no.: 831 377 372

Privacy contact: Sue Janne Alsaker, phone +47 932 45 800, email personvern@mynder.no

2. Why do we collect personal data, and what data do we process?

We collect and use personal data for various purposes depending on who you are and how you come into contact with us.

All processing of personal data is carried out in accordance with applicable privacy legislation, including the Norwegian Personal Data Act and the General Data Protection Regulation (GDPR).

By “personal data” we mean any information that can be linked to a natural person.

By “processing” we mean anything done with personal data, such as collection, registration, storage, use, sharing, alteration, combination, deletion or other handling.

Whenever we process personal data, we must have a lawful reason. This is called the “legal basis” in privacy legislation. In short, it means why we are allowed to use your data.

At Mynder we process in particular the following data, depending on how you contact us or use the service:

Website visits:

technical logs such as IP address, timestamp, browser/device information and other technical information necessary for operation, security, troubleshooting and prevention of misuse.

Waitlist, demo and enquiries:

first name, last name, email address, company, message and any other information you provide. In further dialogue we may also process communication logs and follow-up history.

Job applications:

name, email address, CV, application text, LinkedIn URL, motivation, attachments, interview notes, references and any assessments related to the recruitment process.

Users at direct customers:

name, email address, company name, role, access rights, account information and other information necessary to create and administer the user relationship.

Users through a partner:

name, email address, company name, role, access rights, account information, partner relationship and information about which modules or features the partner has activated on the organisation's behalf.

login data such as timestamp, IP address, device/browser information where relevant, login attempts and changes to authentication settings.

Activity log in the platform:

key actions in the account or workspace, such as settings, access changes, administrative actions and security-relevant events. The log is limited to who did what and when, plus relevant system references.

Agent services and content in the platform:

text input, uploaded or entered content, usage metadata and any information in systems, policies, assessments or other material the organisation enters into the platform. For content the organisation enters as a customer, Mynder is normally the processor and the organisation the controller.

Contact persons at customers and partners:

name, position/role, employer, email address, phone number, agreement references, meeting notes, communication and follow-up history.

Invoicing and finance:

contact details, invoicing information, agreement details, payment information, transaction history and accounting documentation.

Who it concerns

Data

Purpose

Legal basis

Source

Retention

Processors/recipients where needed

The partner may be granted access to your organisation's workspace in the platform

You can see in the platform what the partner has activated on your organisation's behalf

Your organisation owns its own Trust Profile and its own data

If the relationship with the partner ends, your organisation keeps the data and the activated modules

The partner is an independent business. Mynder is not responsible for the partner's own processing of personal data outside Mynder's platform delivery.

For use of Mynder through a partner, Mynder assumes that the customer is the controller for content and personal data that the customer or the customer's users enter into the platform. Mynder is the processor for the customer for the platform delivery itself. The partner is not a sub-processor for Mynder, but acts as an independent processor for the customer for the services the partner delivers to the customer. The customer therefore has two parallel processors: Mynder for the platform and the partner for the partner's services.

At the same time, the partner may be the controller for its own operational and business data related to its customer relationship, for example CRM, sales, support and financial data. This processing takes place outside Mynder's instructions and is covered by the partner's own privacy policy.

3. How long do we store personal data?

We keep personal data for as long as necessary for the purpose for which it was collected, and delete it in accordance with legal requirements. How long we process each type of data is stated above where the individual processing activities are described.

This means, for example, that personal data we process on the basis of consent is deleted if you withdraw your consent. Data we process to fulfil an agreement is deleted when the agreement has been fulfilled and we no longer have obligations requiring further storage. Such obligations may relate to accounting or follow-up of customer relationships. Data we must process due to a legal obligation is deleted when we are no longer required to keep it.

4. When do we share personal data with others?

We do not pass on your personal data to others unless there is a lawful basis for doing so. Examples of such a basis would typically be an agreement with you or a legal obligation requiring us to disclose the information.

We use data processors that collect, store or otherwise process personal data on our behalf. A complete and up-to-date overview of our sub-processors — who they are, what they do and where they process data — is available in Annex B — Sub-processors, which is the only source for this. When we use processors, we enter into data processing agreements to ensure information security and correct processing at every stage.

The partner is not a processor for Mynder and is therefore not included in the list of Mynder's processors above. When the partner processes personal data in the customer's workspace or as part of the partner's services, this takes place on the customer's instructions and under the agreement between the customer and the partner, see section 2.

All processing of personal data that Mynder carries out as data controller, and which is described in this policy, currently takes place within the EU/EEA. For this processing, Mynder does not use providers or support functions that involve transfer of personal data to countries outside the EU/EEA.

If Mynder later adopts providers or solutions that involve transfer of personal data to countries outside the EU/EEA, this will only take place in accordance with GDPR Chapter V. This means that the transfer must either be to a country approved by the European Commission or based on another valid transfer mechanism, such as the EU Standard Contractual Clauses. The privacy policy will then be updated with information about the recipient, categories of personal data, purpose and transfer basis.

5. How do we secure personal data?

We secure personal data with the necessary technical and organisational measures.

We handle information so that it is accurate, available and protected in line with how sensitive it is. We use security technology and information security procedures to protect personal data against unauthorised access, use and disclosure. We also carry out risk assessments of our processing.

We have entered into data processing agreements with all our providers that process personal data, under which they commit to the same level of security as we apply to our own processing. We limit access to personal data to the personnel and third parties that need to process the data on our behalf. These are subject to a duty of confidentiality.

Procedures are established for handling information security breaches (personal data breaches). If a personal data breach concerns processing where Mynder is the controller, and the breach entails a risk to the rights and freedoms of data subjects, we will notify the Norwegian Data Protection Authority without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach. If the breach is likely to result in a high risk to the rights and freedoms of data subjects, we will also notify those affected without undue delay.

The Mynder platform is operated in Microsoft Azure, with application, databases and document storage in Norway East (Norway) and the identity service in North Europe (Ireland), within the EU/EEA. Data is encrypted at rest and in transit, and secrets and access keys are handled in secure key stores, not in code or plain text.

Access to personal data is role-based and limited to people and providers that need access in order to deliver, operate, secure or support the service. Customer data is logically separated between customers, and key actions and security-relevant events are logged for traceability, troubleshooting and incident handling.

Mynder has procedures for handling security incidents and personal data breaches. Incidents are registered and assessed by severity. For processing where Mynder is the controller, Mynder notifies the Norwegian Data Protection Authority and, where relevant, affected data subjects in accordance with GDPR Articles 33 and 34.

6. What rights do you have?

Below is an overview of your rights. If you wish to exercise your rights, please contact us. Contact details are provided in section 1.

We respond as quickly as possible, and no later than within one month. If we need more time, we will let you know.

We may ask you to confirm your identity or provide further information before we process the request. We do this to ensure that we only give access to personal data to the right person.

Information

You have the right to receive information about the personal data we process about you. Through this policy we inform you about our processing of personal data. You may also contact us if you would like more information.

Access

You have the right to request access to the personal data processed about you. Please contact us if you would like access.

Rectification and erasure

You may also ask us to correct inaccurate data we hold about you, or ask us to delete personal data. We will accommodate a request for erasure as far as possible, but we cannot do so if we still need the data.

If the request concerns content that your employer, principal or organisation has entered into the Mynder platform, that organisation is the controller for the content. Mynder is then the processor and processes the data on behalf of the organisation. You may still contact Mynder, and we will help forward the request or assist the controller where required under the data processing agreement.

Processing based on consent

Where we process personal data on the basis of your consent, you may withdraw your consent at any time. The easiest way to do this is to use the method stated when you gave your consent, or to contact us.

Right to restriction of processing

You have the right to have processing restricted in certain cases, see GDPR Article 18. This applies, among other things, if:

You contest the accuracy of the personal data – processing is restricted for a period enabling us to verify the accuracy of the data.

The processing is unlawful and you oppose erasure of the personal data and instead request that its use be restricted.

We no longer need the personal data for the purpose of the processing, but you need the data to establish, exercise or defend legal claims.

Right to object

Where we process personal data on the basis of legitimate interest, you may object to the processing under GDPR Article 21. We will then assess whether there are compelling legitimate grounds for continuing the processing that override your interests, rights and freedoms.

Right to data portability

For data you have provided to us that is necessary to perform an agreement with us, and which is processed automatically, you may ask to receive the personal data about you or have it transferred to another provider in a structured, commonly used and machine-readable format (data portability).

Automated processing, including profiling

No automated processing, including profiling, will be carried out on the basis of your personal data that has legal effects or significantly affects the data subjects, see GDPR Article 22 (1) and (4).

7. Complaints

If you believe that our processing of personal data is not in accordance with what we have described here, or that we otherwise breach privacy legislation, you may lodge a complaint with the Norwegian Data Protection Authority.

You will find information about your rights and how to contact the Norwegian Data Protection Authority on its website: www.datatilsynet.no.

8. Changes

Changes to our services or to privacy legislation may lead to changes in the information provided here. If we have your contact details, we will make you aware of such changes. Otherwise, updated information will always be easily available at mynder.io. All versions are archived.