Privacy Policy for Use of CoOper8 Digital Services
CoOper8 (“we”) is a company providing digital information sharing services to the companies and suppliers in the Energy industry, within the areas of equipment documentation, virtual and digital warehouses, as well as digital exchange of planning data between stakeholders and systems (“Digital Services”). For more information about the various Digital Services we provide, please visit cooper8.no.
This Privacy Policy provides information on how we process personal data common to all Digital Services we provide within the CoOper8 service portfolio.
Words in this document with capitalized initial are defined in the Definitions and Abbreviations section of the General Terms document available at cooper8.no.
This Privacy Policy explains how we may collect, process, share, transfer and retain your personal data when you are acting as:
- A User of one or more of our Digital Services
and/or - A company representative towards us, fulfilling certain duties and responsibilities in relation to Digital Services in use by your company (Customer).
1. Why do we collect personal data?
When you use our Digital Services, we process personal data about you to be able to provide the Digital Services to the Customers and to manage and follow-up the Agreement. When you are acting as a company representative, we process your personal data to communicate with you and the company you are representing. Our legal basis for such processing is our legitimate interest in communicating with you. In addition, we may process personal data for security purposes. Our legal basis for such processing is our legitimate interest in ensuring the security of our Digital Services.
2. Which personal data do we collect?
We do not collect any special categories of personal data pursuant to article 9 of the GDPR and will only collect limited personal data required to be able to fulfil our role as a provider of Digital Services. Our collection and use of personal data are in accordance with applicable data protection legislation (including the GDPR) and embedded into our internal processes and procedures.
Our processing of personal data on behalf of the Customer only covers categories of personal data which are implied under the Agreement for the purpose of entering into the Agreement, management and/or follow-up of the Agreement and providing the Digital Services, and only to the extent and as long as necessary to fulfil such purposes.
We will use system event information for enabling secure and efficient delivery and operation of the Digital Services and/or to identify and correct security Incidents. Such information is not stored longer than necessary to reach the goal of secure operation and is not shared with the Customer or third parties (sharing with subcontractors on a need-to-know basis will be necessary). The Customer acknowledges under our General Terms that we are not obliged to disclose information to the Customer in respect of individual Users’ use of the Digital Services.
When you are a User of a Digital Service
Our focus is to only collect data required to provide you secure access to the Digital Service, as well as fulfilling our obligations to your company according to the user agreement framework between CoOper8 and your company.
Your personal data may be provided to us by your employer or the Customer that has instructed you to use the Digital Service.
The terms of such agreement are available on cooper8.no. The limited personal information that we process in each Digital Service is described below.
When you use our Digital Services, CoOper8 acts as data processor, and your company, the Customer, having instructed you to use the given Digital Service, acts as data controller.
As integrity of the information stored within the Digital Service is of importance, the Digital Service will store certain user activity information, such as by whom and when objects were created, updated, moved, deleted, downloaded, and distributed. We use server logs and other tools to record technical information about your device, connection to our services and cross-device usage.
This information typically includes operating systems, web browser versions, IP addresses and session-based authentication cookies, and unique identifiers.
Depending on which Digital Service you are using, we will also collect the following data:
- For Virtual Inventory, EqHub, Loop, and Critical we will collect your name, the organisation you represent (your employer), your e-mail and phone number.
- For Schedule Exchange & Schedule Analytics we will collect your name, the organisation you represent (your employer) and your e-mail.
Administrative users in your organization will manage your access to theDigital Service. Such assignments and changes to your roles and access groups are stored. This is due to requirements that the Digital Service shall support transparency about who can access what.
When you communicate with us, contact our customer support teams, or respond to a survey, you will provide information to us.
When you are a company representative
Our governance and provisioning of Digital Services require us to maintain various contact points towards our Customers, subcontractors and other external organisations.
When you have been instructed by your company to fulfil certain duties and responsibilities towards CoOper8, we may collect limited personal information about you that typically include your name, email, the organisation you represent, your title/role and your phone number. Such personal data may be provided to us by your employer or the organisation you represent. The personal information is typically stored in our CRM system and other supportive systems used for efficient management of our external stakeholders. In this context, CoOper8 acts as a data controller as we define the purpose of the processing of the personal data.
3. Do we use cookies and automatic data collection tools?
Our Digital Services may store and retrieve information, such as cookies, on your devices. In most cases, this storage and retrieval is technically necessary to deliver the Digital Service and requires no further actions from you.
When you use CoOper8 Digital Services, we use different technologies to recognize you as a User and provide a seamless access to the Digital Services. If a Digital Service uses cookies or similar devices that are not strictly necessary (e.g., for analytics, personalization, or marketing), we will request your explicit consent before activating those cookies.
For more information about cookies and the applicable legal framework, please refer to the European Commission’s guidance on cookies.
4. How do we process your personal data?
When you are a User of a Digital Service
The personal data collected when you are a user of our Digital Services is processed as described below.
We process your personal data to provide you support and guidance, including to:
- Provide you with efficient Digital Service support via service desks.
- Help diagnose problems reported by you to the service desk.
- Inform you about possible compatibility issues with the browser you use.
- Improve your web experience.
- Send you important information, e.g. in case of service unavailability.
We process your personal data to manage security in the Digital Services by:
- Verifying your identity as part of the log-in process.
- Monitor your log-in activities and account modifications to help detect and prevent
fraud and abuse of the Digital Services.
We process your personal data to improve the Digital Services by:
- Aggregation to analyse and improve the performance of the Digital Services, but where data is then anonymized.
We process your personal data for our and the Customer’s legitimate interests, including to:
- Be in compliance with requirements between CoOper8 and your organisation as available on cooper8.no.
When you are a company representative
When you are acting as a company representative, we may process your personal data to:
- Send your relevant information concerning aspects of where you are appointed as
contact point in your organisation. - Grant you access to any supportive systems we use for dialogue with external staff,
including but not limited to document sharing systems and contract portal. - Process orders, invoicing, payments and other financial follow up.
We do not use your personal data for automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.
5. Do we share your personal data?
We do not sell or market any personal information we collect about you to any third party. We may only share your personal data as follows:
With our subcontractors
We may share your personal data with our subcontractors directly involved in the delivery of a Digital Service, e.g. subcontractors delivering user authentication services and providing service desk functions. We will in all such matters have a data processor agreement towards the subcontractor, preventing use of your personal data for other purposes than defined by the privacy terms.
Within a Digital Service
Each individual Digital Service may be designed to share limited information about you with other Users of the Digital Service, as the Digital Services are typically used to collaborate across organisational boundaries.
6. Transfer of personal data to third countries
As a principle, we host all our Services and supportive solutions within the European Economic Area (EEA).
If the processing requires transfer of data for processing outside of the EEA or involvement of subcontractors outside of the EEA, we will inform your Customer and only initiate such transfer based on your Customer’s consent. In such case, we will make sure that a valid legal basis for such a transfer is established before any transfer activities are initiated.
7. Do we retain your personal data?
When you are a User of a Digital Service
When you no longer have a need or legal right to have a user account, the user account is deleted by an administrative user in your company.
No personal data is retained except that for integrity purposes, all data transactions in the Digital Service must be traceable and will therefore include a link to the actual user who uploaded the material data. This information will not be deleted but stored throughout the lifetime of the Digital Service.
When you are a company representative
When you no longer represent your company towards us, we primarily delete your accounts from our CRM and other support solutions.
The information systems might still have traces of your historic activities from when acting as a representative for your organization as we need to store limited information to document the Customer´s involvement and representation in our governance activities.
Examples could be document metadata (“created by”), approval history on documents and other information we need to have documented historically to document our Customers’ involvement in the governance of the Digital Services we provide to our Customers.
8. What are your rights?
When you are a User of a Digital Service
For personal data processing within a Digital Service, we act as a data processor, only processing data according to the data processor agreement we have in place with your company, acting as the data controller. You should contact your company if you have questions about privacy within a given Service not being answered by this privacy policy. Similarly, you should contact your company if you want to exercise any of your other rights regarding protection of personal data.
When you are a company representative
- Right to opt-out of communications from us
You have the right to opt-out of receiving newsletter communications from us and can do so by either following the instructions for opt-out in any newsletter communication or contacting us via e-mail on hello@cooper8.no. Please note that even if you opt-out from receiving communications, you may still receive administrative communications from us, such as order confirmations and notifications about your account activities (e.g. account confirmations and personal profile changes). - Access and rectification
You have the right to request a copy of what personal data we have stored about you.
You may send us a request for this to hello@cooper8.no. You also have the right to request that we correct any inaccuracies in your personal data, unless we have enabled you to do such updates yourself via appropriate “My account” functionality within the supportive solutions we use in the collaboration with representatives from our external stakeholders. - Right to be “forgotten”, object to processing, data portability
Unlike providers of consumer services, we only store information about you as a representative of your company. The availability and scope of these rights may be limited where the personal data is processed in the context of an individual’s role as a representative of a Customer and where retention is required for legitimate business, governance, legal or contractual purposes. - File a complaint with a data protection authority
If you believe that our processing of personal data relating to you infringes applicable laws, you may file a complaint with relevant data protection authority.
We will respond to your request without undue delay and in any event within one (1) month of receipt of the request. This deadline may, if necessary, be extended by a further two (2) months, taking into account the number of requests and the complexity of the requests.
9. How do we protect your personal data?
We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your personal data against loss, misuse, unauthorised access, disclosure, and alteration. While we are dedicated to securing our Digital Services and supportive solutions, you are responsible for securing and maintaining the privacy of your password(s) and account/profile registration information and verifying that the personal data we maintain about you is accurate and current.
10. Changes to this Privacy Policy
We may revise this policy on cooper8.no from time to time to reflect changes to our business, the Digital Services, or applicable laws.
The policy on cooper8.no will be effective as of the date stated at the top of the policy.
11. Contact us
We value your opinion. If you have any comments or questions about our privacy framework, any unresolved privacy or data use concerns that we have not addressed satisfactorily, or concerning a possible breach of your privacy, please send them to hello@cooper8.no.
We will handle your requests or complaints confidentially. Our representative will contact you to address your concerns and outline the options regarding how these may be resolved. We aim to ensure that complaints are resolved in a timely and appropriate manner.