PRIVACY POLICY
Novum Økonomi AS – an authorized accounting office
Last updated: 10.09.2026
We respect your privacy. This notice explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have.
1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
Novum Økonomi AS is the "data controller" for the personal data described in this notice.
Contact details
Novum Økonomi AS
Havnegata 10, 3040 Drammen, Norway
Org. no.: 892 341 052
Email: office@novum.no
Phone: +47 32 22 67 70
Privacy contact point
For privacy questions, please email office@novum.no
2. WHAT PERSONAL DATA WE COLLECT
The data we collect depends on how you interact with us. We may collect:
A. When you contact us (email, phone, forms, meetings)
- name, email address, phone number
- company name (where provided in our contact form)
- your message and any information you choose to share
- meeting notes and follow-up correspondence
B. When we provide services (clients, customer contacts, and where relevant your employees/representatives)
- identification and contact details (name, address, email, phone)
- role/position and employer (where relevant)
- client relationship details (engagement, instructions, correspondence)
- accounting and transaction data needed to perform our services
- invoice and payment information
- information required for compliance checks (see Section 4C)
C. Website and technical data
- IP address, device and browser data, and activity on our website
- server log data generated when you visit the website
- cookie and tracking data — see Section 9. Analytics and session-recording technologies are only used where you have given consent.
D. Newsletter
- email address and, where provided, name
- data on how you interact with our newsletters (whether an email was opened, links clicked)
E. Recruitment
- CV, cover letter, certificates, references (if provided), interview notes
Special categories of data (sensitive data)
We do not ask for sensitive personal data. If you nevertheless provide it, or if it is required in a specific context, we will only process it where there is a lawful basis under GDPR (e.g., explicit consent or where necessary for legal claims or legal obligations, as applicable). See Section 4D.
3. WHERE YOUR DATA COMES FROM
- Directly from you (most commonly)
- From your employer/organisation (if you are a contact person)
- From public sources or third parties where appropriate and lawful (e.g., company registers, banks, or authorities), mainly for service delivery and compliance
- Automatically from our systems and from the third-party tools described in Section 9, when you visit our website
4. WHY WE USE YOUR DATA (PURPOSES), OUR LEGAL BASIS, AND HOW LONG WE KEEP IT
We only use personal data when we have a lawful basis. Below we explain the main purposes, the legal basis and retention.
A. Responding to enquiries and communicating with you
Purpose: to reply to questions, provide information, arrange meetings, and follow up
Legal basis:
- Our legitimate interests in receiving and responding to enquiries, providing information and engaging in normal business communication, GDPR Article 6 (1) (f).
- If the enquiry is clearly a step towards entering into a contract with us, the legal basis is GDPR Article 6 (1) (b).
Retention: If the enquiry does not lead to a contractual relationship, we will retain key information about the enquiry, such as contact information, type of company, type of enquiry and response given, for a period of one year.
You can object to processing based on legitimate interests (see Section 8).
B. Delivering our accounting and related services (contract performance)
Purpose: to enter into and perform our agreement with you, to manage the client relationship and deliver the agreed services
Legal basis: Performance of a contract, GDPR Article 6 (1) (b).
Retention: For the duration of the engagement and then as long as needed to document the services, manage disputes, and comply with legal obligations, and 3 years as a maximum.
C. Legal obligations (e.g., bookkeeping, tax, anti-money laundering)
Purpose: to comply with applicable Norwegian laws (e.g., requirements to keep accounting documentation, and to perform customer due diligence where required)
Legal basis: Compliance with a legal obligation, GDPR Article 6 (1) (c).
Retention: As required by applicable law (retention periods vary by obligation).
D. Establishing, exercising or defending legal claims
Purpose: to handle complaints, disputes, and potential or actual legal claims
Legal basis: Our legitimate interests to establish, exercise and defend legal claims, GDPR Article 6 (1) (f).
Retention: For as long as a claim could be brought, and thereafter as needed to document the outcome.
E. Marketing communications (newsletter and service updates)
Purpose: to send you information about our services, updates, events and useful content.
Legal basis:
- Consent, GDPR Article 6 (1) (a), where required; and/or
- Legitimate interests where permitted by law, for example in accordance with the Norwegian Marketing Control Act § 15 (3) in the case of electronic communications to existing customers.
Our newsletter is operated through MailerLite (see Section 5A). Subscribing requires an explicit, unticked consent, and every newsletter contains an unsubscribe link.
Retention: Until you opt out/withdraw consent, or we decide to stop sending communications.
F. Website operation, security and improvement
Purpose: to operate, secure, and improve our website and IT systems.
Legal basis: Our legitimate interest in securing our website and IT systems, GDPR Article 6 (1) (f).
Retention: Logs and security data are kept for a limited period and as needed for security investigations.
G. Web analytics and session recording (consent)
Purpose: to understand how visitors use our website so we can improve it (Google Analytics), and to see aggregated recordings and heatmaps of how pages are used (Hotjar).
Legal basis: Consent, GDPR Article 6 (1) (a), and consent for the storing of and access to information on your device under the Norwegian Electronic Communications Act § 2-7b.
These technologies are only activated after you have consented. If you do not consent, they are not loaded and no such cookies are set.
Retention: In line with the cookie lifetimes stated in Section 9 and the retention periods of the respective providers.
You can change or withdraw your consent at any time — see Section 9B.
H. Social media interactions (LinkedIn, Facebook, YouTube, etc.)
Purpose: to communicate with you if you contact us via social media, to administer our social media pages and understand engagement
Legal basis:
- Legitimate interests in communication and business visibility, GDPR Article 6 (1) (f).
- Consent where required for certain tracking technologies/platform features, GDPR Article 6 (1) (a).
Retention: As long as needed for the purpose, and subject to platform settings (e.g., you can delete your comments or change your privacy settings).
I. Recruitment
Purpose: to assess your application and manage the recruitment process
Legal basis:
- Steps prior to entering into a contract, GDPR Article 6 (1) (b),
- and/or legitimate interests in recruiting, GDPR Article 6 (1) (f),
- consent for keeping your application for future roles (optional), GDPR Article 6 (1) (a).
Retention: During the recruitment process and for the duration of the subsequent employment. If the recruitment process does not end up in employment, we will delete the information within 2 weeks unless you request us to retain your application and documentation for future opportunities.
5. WHO WE SHARE YOUR DATA WITH (RECIPIENTS)
We share personal data only when necessary and with appropriate safeguards.
A. Service providers (processors)
- IT provider / website development — Emiku sp. z o.o., ul. Sienkiewicza 21a, 84-220 Strzebielino, Poland (VAT ID: PL5862281904) — EEA (Poland) — Development and maintenance of the website
- Hosting — Hetzner Online GmbH — EEA (Germany) — Servers on which the website runs
- Email delivery (SMTP) — Mailtrap (Railsware Products LLC / Railsware Solutions) — EU / USA — Delivery of emails from the website (contact form, notifications)
- Web analytics — Google Ireland Limited / Google LLC (Google Analytics 4) — EEA / USA — Website statistics — only with consent
- Session recording and heatmaps — Hotjar Ltd. (Malta) — EEA — Aggregated recordings and heatmaps of website use — only with consent
- Newsletter — UAB "MailerLite" (Lithuania) — EEA — Distribution of our newsletter — only with consent
- Embedded video — Google Ireland Limited / Google LLC (YouTube) — EEA / USA — Videos embedded on our pages — only with consent
We may also share data with:
- cloud and productivity services
- accounting/finance and invoicing systems
- customer support systems
- professional advisers (lawyers, auditors)
- banks and payment service providers (where relevant)
- authorities where we are legally required to disclose information
We require our service providers to protect personal data and only use it on our instructions, on the basis of data processing agreements pursuant to GDPR Article 28.
B. Transfers outside the EEA
We aim to keep data within the EEA. If a transfer outside the EEA is necessary, we will ensure an appropriate transfer mechanism is in place (e.g., Standard Contractual Clauses) and provide information about the safeguards upon request.
This applies in particular to Google (Google Analytics, YouTube) and Mailtrap, which may process data on servers in the United States. These transfers take place on the basis of the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
6. HOW WE PROTECT YOUR DATA (SECURITY)
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or misuse. This can include access controls, encryption where appropriate (HTTPS/TLS for all traffic to the website), logging, staff training, and supplier due diligence.
No method of transmission or storage is 100% secure, but we continuously work to maintain an appropriate security level.
7. DO YOU HAVE TO PROVIDE YOUR DATA?
- If you contact us, you choose what to share, but we may need certain details to respond (e.g., an email address).
- If you become a client, certain information is necessary to enter into and perform the agreement and to meet legal obligations. If you do not provide it, we may not be able to provide our services.
- Consent to analytics, session recording and the newsletter is entirely voluntary. Refusing does not affect your ability to use the website or our services.
8. YOUR RIGHTS
You have rights under the GDPR. Depending on the circumstances, you can:
- Request access to, and a copy of, your personal data
- Ask us to correct inaccurate or incomplete data
- Ask us to delete your data (where applicable)
- Ask us to restrict our processing
- Object to processing based on our legitimate interests (including marketing)
- Request data portability (where processing is based on contract or consent and is carried out by automated means)
- Withdraw consent at any time (where we rely on consent)
How to exercise your rights
Email us at: office@novum.no
We may need to verify your identity before responding.
Complaints
If you believe we have not handled your personal data properly, you can contact us first. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet):
9. COOKIES AND SIMILAR TRACKING TECHNOLOGIES
We use cookies and similar technologies on our website.
A. What we use and why
Strictly necessary cookies — required for the website to function and for security. They do not require consent.
- _novum_session — novum.no (first-party) — Session cookie — keeps the site working across pages and protects forms against cross-site request forgery — Session (until the browser is closed)
- novum_cookie_consent_v2 — novum.no (first-party) — Stores your cookie choices so we do not ask again on every visit — 180 days
Analytics cookies (optional — consent required) — help us understand how visitors use our website so we can improve it.
- _ga — Google — Distinguishes visitors — 2 years
- _ga_RELKKD26PF — Google — Maintains Google Analytics 4 session state — 2 years
- _hjSessionUser_3746401 — Hotjar — Identifies a returning visitor to Hotjar — 1 year
- _hjSession_3746401 — Hotjar — Identifies the current Hotjar session — 30 minutes
- Further _hj* cookies — Hotjar — Session sampling and recording control — Session – 1 year
Hotjar records how pages are used (mouse movement, scrolling, clicks) and produces heatmaps and recordings. Keystrokes in form fields are suppressed, and we do not use Hotjar to identify individual visitors.
Functional cookies (optional — consent required)
- MailerLite cookies and tracking pixel — UAB "MailerLite" — Operating the newsletter sign-up form and measuring newsletter interaction — Up to 1 year
Embedded content
Our site includes embedded content from YouTube. When you play an embedded video, YouTube may set cookies and collect device data. Embedded videos are only loaded once you have given consent.
External resources without cookies
Our pages load fonts, icons and scripts from cdn.jsdelivr.net and unpkg.com. These providers do not set cookies but do receive your IP address as a technical requirement of delivering the file.
B. Your choices (consent)
We only set optional cookies (analytics, session recording, functional and similar tracking) if you consent. You can:
- accept all optional cookies
- reject all optional cookies
- choose categories in "Cookie settings"
Necessary cookies are always active. Optional categories are switched off by default and are only activated by your active choice.
You can change or withdraw your consent at any time via the "Cookie settings" link in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
You can also block or delete cookies through your browser settings. Please note that blocking necessary cookies may prevent parts of the website from working.
C. Cookie list
The tables in Section 9A above serve as our cookie list. Cookie names and lifetimes set by third parties may change; we review this list regularly and update it when we become aware of changes.
10. SOCIAL MEDIA PLUG-INS AND LINKS
Our website includes links to our social media pages (LinkedIn, Facebook, YouTube). These are ordinary links — the platform provider may collect data about you only once you click through to that platform. We recommend reviewing the provider's privacy information.
Our Polish-language newsletter sign-up refers to a separate service at kurs.novum.no, which has its own privacy policy.
11. CHANGES TO THIS NOTICE
We may update this notice from time to time. The latest version will always be available on our website, with the "last updated" date shown at the top.
12. CONTACT
For questions about this notice or how we use personal data:
Novum Økonomi AS
Email: office@novum.no
Phone: +47 32 22 67 70
Address: Havnegata 10, 3040 Drammen, Norway
