Clear information about
your information.

Who is responsible?

Portalen Gruppen AS, org. no. 899 551 222 MVA, is the controller for our own processing in ordinary register services, customer accounts, payment, operations, and follow-up. For new contact assignments carried out on the customer’s documented instructions, the customer is the controller and we are the processor, as described below. Our address is Tjuvholmen allé 3, 0252 Oslo. Contact us at post@portalengruppen.no.

This notice applies both to you as a website user or someone who contacts us, and to you if you are described in our source data, for example as a general manager or sole proprietor.

What information do we use?

• Inquiries and orders: name, place of work, contact information, selected criteria, and the contents of the conversation.
• Direct purchase: order and payment references, product, selection criteria, quantity, price, tax, payment status, and access to the delivery. Stripe receives card and billing information to process the payment. We do not store the full card number.
• Company and contact data: business information, registered roles, names, and contact details associated with businesses. Some of this information may be linked to an individual.
• Technical information: IP address, events related to operations and security, browser information, and choices in the consent tool.
• Audience builder selections: criteria and drafts saved in the browser, as well as criteria sent to count a selection or handle an inquiry.

Business data may come from public registers, such as Brønnøysundregistrene and submitted annual financial statements, companies' own websites, and other data sources included in the specific deliverable. You can ask us where specific personal data about you came from.

Purpose and legal basis

We use contact and order information to respond, prepare quotes, provide the agreed data extract, and manage the customer relationship. When you are the contracting party, processing may be necessary for the contract or steps taken before entering into it (Article 6(1)(b)). Contact with employees representing a business customer is generally based on legitimate interests in managing the customer relationship (paragraph f).

Financial records are retained to meet legal obligations (paragraph c). Operations, security, and abuse prevention are based on legitimate interests in protecting the service (paragraph f).

In our own register-based services, we use business and contact data to help users find relevant businesses for B2B sales. For necessary work-related personal data in these services, the applicable basis is legitimate interest in offering relevant business selections (Article 6(1)(f)). This is separate from new contact assignments carried out on a customer’s instructions, where the customer determines the purposes and legal basis for processing. A specific balancing against the person’s interests and rights is required for collection, use, and disclosure. Public availability is not in itself a legal basis for processing. You can object to the processing and request information about the basis for data concerning you.

Consent is used where required, including for optional cookies. You can withdraw consent. A quote request does not in itself mean you consent to a newsletter.

Who may receive the information?

Providers of hosting, storage, forms, email, chat, and analytics may process information needed to provide their services. The website uses, among other services, WordPress and Formidable for forms, Crisp for chat, and Complianz for consent. Google services for analytics and advertising are described in the consent tool.

For direct purchases, Stripe is used for payment and tax calculation. Stripe also processes information for its own purposes, including security and legal obligations, as described in Stripe privacy policy. Supabase is used for order data and private delivery files, with a database in Stockholm. The browser stores a necessary access key linking the receipt to the buyer’s browser. It is used for protected delivery, not advertising.

For ordered contact research, we check relevant APIs and other sources on the customer’s instructions. The actual providers, functions, processing locations, retention limits, and transfer basis are stated in the recipient overview attached to the assignment. Technical email and mobile checks document channel status, not the person’s identity or current role. Contact findings and source evidence are access-protected and are not reused between customers.

When the customer orders email verification, we use MillionVerifier to technically check the addresses. Only unique email addresses are sent for this check; business rows, selection criteria, and payment information are not included. The verification result and date are linked to the delivery by us. The provider states that uploaded files and results are retained for up to 30 days. Private delivery files follow the download and deletion procedures described below. Checking an address is not sending a marketing message. See also MillionVerifier privacy information.

When a business list is delivered, the customer may receive the agreed business and contact information. The customer's own inquiries and order details are not for that reason included in lists sold to others.

Portalen Gruppen AS is responsible for its own processing. A customer who decides how received personal data will be used is responsible for their further processing and contact with recipients. The allocation of responsibility depends on the actual processing.

If a provider processes personal data outside the EEA, a valid transfer mechanism and required safeguards under data protection law are necessary. Contact us for information about providers, processing locations, and the basis that applies to your data.

Contact research on the customer’s instructions

For a newly ordered contact assignment, we check relevant APIs and other sources for a person’s name, current role, company affiliation, work email, and person-linked mobile number relevant to their professional role. We make new inquiries for each order. This does not mean all information in the sources has been updated recently. Source data, relevance, check time, and technical status are distinguished in the result. We do not reuse contact findings from earlier assignments for a new delivery, including between customers. Date of birth, private home address, and special categories of personal data are not included in the offer.

For such an assignment, the customer is the controller for collection and use. Portalen Gruppen AS processes the information as a processor on the customer’s documented instructions. The customer’s purposes, legal basis, contact point, retention criteria, and choice of information handling are tied to the order together with the data processing addendum and recipient overview. The customer must have a lawful basis; public availability or a positive technical check alone is not sufficient. This is separate from our own processing for public register services, accounts, payment, security, and legal obligations. Earlier orders retain the agreement and allocation of responsibilities under which they were made.

The customer chooses whether to provide the required privacy information itself or have us assist with sending it on the customer’s behalf. This choice does not change the customer’s controller responsibilities, individuals’ rights, or the deadlines. Information must be provided within a reasonable period and no later than one month after collection on the customer’s behalf; earlier at first contact or the first onward disclosure to another recipient. Returning information to the same customer does not restart the deadline. A plan for self-notification is not evidence that the information has already been provided.

When we assist with sending, the information identifies the customer and explains the purposes, legal basis, data categories, sources, recipients, retention, and rights. It contains no sales message or request for a reply. We do not use privacy notices for marketing or individual behavioural profiling. Necessary delivery and error information may be recorded; actual transmission measurements must be limited and accurately described. A confirmed delivery event does not mean the message was read. Lack of a suitable email address or a delivery error must be followed up with the customer; it does not count as notification or an automatic exemption from the duty to provide information. We do not send SMS as part of this assistance.

The research log and source evidence are retained for the agreed short period, up to 30 days. The contact file is available for up to seven days from completion, and never beyond the assignment’s agreed research deadline. Contact information stored in the customer’s private workspace/CRM follows the customer’s instructions and retention criteria; it is not a shared contact database for other customers. Limited documentation about the agreement, delivery, information, rights requests, and suppression may be retained longer when necessary. Deleted or suppressed findings must not be reintroduced by a late API response. Supplier copies and backups follow the specific terms in the assignment addendum and recipient overview.

You can request sources, access, rectification, erasure, or restriction, or object through the customer identified in the information. You can also contact us at andreas@markedsdata.no or use the privacy request form. We help route the request to the appropriate controller and verify identity and authority proportionately. We distinguish an objection to a particular customer’s use from an objection to processing for which Markedsdata itself is responsible. Requests are handled without undue delay, normally within one month at the latest.

How long do we retain information?

Automated list deliveries: For new orders from October 13, 2026 at 15:40 (Norwegian time), the base list is available for seven days after payment. When email verification is included, the completed verified file is available for seven days from completion. Earlier orders retain their previously agreed deadline. After expiry, downloading is blocked and private delivery files are automatically removed in scheduled deletion runs. Order and accounting records, register source data, supplier copies, and backups are not automatically covered by this file deadline and are handled according to their own purposes and obligations.

New deliveries require a one-time code sent to the email address provided at payment before downloading. The code is valid for up to ten minutes, has a limited number of attempts, and opens a short browser-bound download session. We store a protected verification value, not the code itself, in our access database. The buyer’s email address is used for necessary delivery messages, the code, and any reminder. The customer must store the downloaded file securely.

We do not have one retention period for all inquiries. We assess what is needed based on the purpose:

• Quote requests: whether the conversation is still relevant, whether the quote should be followed up, and whether clarifications need to be documented.
• Customer deliveries: whether the information is needed to fulfill the agreement, handle errors, or document what was ordered and delivered.
• Unpaid and blocked delivery files: Unpaid files are cleared no earlier than three days after the order has expired, and any Stripe payment must also have expired. Access may be blocked earlier in the event of a refund or dispute. The deadlines for paid delivery files are stated above; earlier orders retain their agreed deadline. Order and accounting records are stored separately.
• Financial statements and legal claims: legally required retention and specific needs to establish, exercise, or defend legal claims.
• Company and contact data: whether the information is still relevant, current, and necessary for the purpose, and whether a correction or objection has been received.

Information must be deleted or anonymized when there is no longer a necessary and lawful basis to retain it. Browser storage has its own durations, described on the page about cookies.

Your rights

You can request access and correction, and deletion or restriction when the conditions are met. You can object to processing based on legitimate interests. For direct marketing, you have an unconditional right to object to that use. Data portability may apply to information you provided when processing is based on consent or a contract and is automated.

Use the privacy request form or the contact address above. We usually reply within one month at the latest. If an extension is needed, we will explain this within the first month.

You can complain to Datatilsynet if you believe the processing violates the rules.

Cookies and changes

We count page views of My Account and the annual access page together by date and page type. The counter does not store IP addresses, email addresses, cookies, or browser IDs, and totals are retained for up to 90 days. We also use existing account, payment, and usage information for dated operational reports with aggregate figures. The reports do not contain customer notes or activity content and are available only to the administrator.

See the overview of cookies and local storage for choices and more information. We update this notice when the service changes. The date at the top shows the latest content review.