Privacy Policy – Norwegian Space Cluster

Legal owner: Kupa AS

1. Introduction

Kupa AS processes personal data as part of its business operations. We act as the data

controller for all processing of personal data described in this privacy policy.

Below, we explain what types of personal data we collect, how the data is used and

safeguarded, and what rights you have under applicable data protection legislation.

2. Who is the data controller?

Kupa AS

Organisation number: 986 954 848

Address: Margrethe Jørgensens vei 13

Email: post@kupa.no

Telephone: +47 90 97 22 16

Kupa AS is the data controller for the processing of personal data unless otherwise

specifically stated.

3. Contacting Kupa AS

You may exercise your rights or ask questions about this privacy policy by sending an

email to post@kupa.no.

If you have questions regarding this privacy policy or our role as data controller, you are

entitled to receive a response without undue delay and no later than one month. A more

detailed explanation of your rights is provided in a separate section of this privacy

policy.

4. When does Kupa AS collect personal data about you?

We collect personal data in connection with our business activities and service delivery.

This occurs, among other things, in the following situations:

• when you contact us via email, telephone, or website contact forms

• when you register for newsletters, courses, seminars, workshops, and events

organised by us

• when you order services or courses from us

• when you apply for incubator services, advisory services, or advisory

programmes

• when you participate in our business and innovation processes as a customer,

partner, or participant

• when you enter into an agreement with us as a customer, supplier, or partner

• when you register to use our digital services or customer systems

• when you apply for a job or submit a CV or other recruitment information

• when you visit our website and we use cookies to analyse traffic and improve

user experience

• when we receive information about you from third parties (such as partners,

networks, or public registers) where necessary and lawful

• when you are affiliated with a cluster we have been granted funding for, for

example as a contact person, project manager, participant, or board member

• when you apply for admission, funding, or participation in a cluster we

administer

• when we receive information about you from third parties where lawful

We use external service providers to operate and maintain our IT services. All

infrastructure and data are located within the EU/EEA or in countries approved by the

European Commission.

5. What personal data do we process?

Kupa AS processes the following personal data:

• name

• email address

• telephone number

• postal address

• job title and role

• employer/business affiliation

• contractual and customer relationship information

• payment and invoicing information

• participation in events, courses, and programmes

• application information

• CVs, applications, and references in recruitment

• IP address and website usage behaviour

• communication with us

• information related to participation in clusters

• other information you voluntarily provide, where we have a lawful basis for

processing

6. Purpose of processing

Personal data is processed for the following purposes:

• responding to enquiries

• delivering our services

• managing customer relationships

• organising courses, seminars, and events

• administering programmes and incubator services

• operating and following up clusters

• reporting to funding bodies

• conducting recruitment processes

• sending relevant information and marketing

• improving our website

• fulfilling legal obligations

7. Legal basis

Processing is based on the following legal grounds:

• consent (GDPR Article 6(1)(a))

• contract (GDPR Article 6(1)(b))

• legal obligation (GDPR Article 6(1)(c))

• legitimate interests (GDPR Article 6(1)(f))

Where processing is based on legitimate interests, Kupa AS has conducted the

necessary balancing of interests.

8. Processing of personal data related to clusters

When Kupa AS has been granted responsibility to administer, operate, or follow up

clusters, we process personal data relating to individuals affiliated with these clusters.

This includes:

• contact persons at member companies

• project managers

• board members

• participants in activities, programmes, and projects

• representatives of partner organisations

• invoicing information

Personal data processed in this context includes name, contact details, role, employer,

participation in activities, and application and reporting information.

The purpose of the processing is to:

• administer membership

• follow up projects

• organise activities

• document activities

• report to funding bodies

• fulfil contractual obligations

Kupa AS acts as the data controller when we determine the purposes and means of

processing. Where we process personal data on behalf of a contracting party, we act as

a data processor and the processing is regulated by a separate data processing

agreement.

This applies to Betongklyngen, Energiklyngen, HIA-gruppen, and Verftsringen, where we

act as data processor.

9. Disclosure of personal data

Personal data is shared with:

• IT service providers

• accounting service providers

• public authorities where legally required

• partners where necessary and where there is a lawful basis

Data processing agreements are entered into where required. Our employees are also

bound by confidentiality agreements and may not disclose personal data.

10. Transfer to third countries

Personal data is not transferred outside the EU/EEA unless there is a lawful transfer

mechanism in accordance with GDPR.

11. Retention period

Personal data is stored for as long as necessary to fulfil the purposes of processing or as

required by law.

12.Your rights

You have the right to:

• access

• rectification

• erasure

• restriction of processing

• data portability

• object

• withdraw consent

Requests are answered without undue delay and no later than one month.

You also have the right to lodge a complaint with the Norwegian Data Protection

Authority (Datatilsynet).

13.Cookies

We use cookies on our website. Cookies are a standard technology used by most

websites today. They are small text files stored on your device and are mainly used to

improve user experience. Some cookies are strictly necessary for the website to

function.

When you visit our website for the first time, you will be given the opportunity to choose

which types of cookies you want to allow. You may change your preferences at any time

in the lower left corner of the website.

14.Amendments

This privacy policy is updated when necessary. The current version is published on our

website.