Privacy Policy

This Privacy Policy explains how Disrupting IT AS ("Disrupting IT", "we", "us") processes personal data collected through this website (disruptingit.no and disruptingit.com). Data processing in client engagements is governed by the data processing terms in our standard agreements, not by this policy.

1. Data controller

Disrupting IT AS, organisation number 822 356 222, Engene 16, 3015 Drammen, Norway, is the data controller for personal data collected via this website. Contact: info@disruptingit.no.

2. What we collect

• Contact information you provide — name, email address, company and the contents of any message you send us via email or contact form.
• Technical data — IP address, user agent, referrer and timestamp, collected in standard server logs for security, abuse prevention and operational troubleshooting.
• Cookies — only strictly necessary cookies are used to keep the site functional. We do not use advertising or cross-site tracking cookies.

3. Why we process it (legal basis)

• Responding to inquiries and managing pre-contractual communication — legal basis: our legitimate interest (GDPR art. 6(1)(f)) and, where applicable, steps to enter into a contract (art. 6(1)(b)).
• Operating, securing and improving the website — legal basis: legitimate interest (art. 6(1)(f)).
• Complying with statutory obligations, including bookkeeping (Bokføringsloven) — legal basis: legal obligation (art. 6(1)(c)).

4. Sharing and transfers

We share personal data only with data processors that help us operate the website and our business — for example hosting, email and analytics providers. Data processors are bound by written data processing agreements. Where data is transferred outside the EEA, we rely on the EU Standard Contractual Clauses or other approved transfer mechanisms.

5. Retention

We retain personal data only as long as necessary for the purposes above. Inquiry emails are normally deleted within 24 months unless they form part of an active engagement. Server logs are kept for a maximum of 12 months. Accounting records are retained for the period required by Norwegian law.

6. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and object to our processing of your personal data, as well as the right to data portability. Requests can be sent to info@disruptingit.no. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

7. Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, in line with recognised industry practice.

8. Changes

We may update this policy from time to time. The "last updated" date above reflects the current version. Material changes will be highlighted on this page.