Privacy policy

ON IT AS (org. no. 996 825 396, Sigden 6, 6518 Kristiansund N, Norway) is the controller of the data described here. Questions and requests go to post@on-it.no.

The data in Visma Business

The software runs on the customer’s own server, and ON IT normally has no access to the data it reads and writes. The customer is the controller of that data. If we nevertheless process such data to help the customer, for example when troubleshooting, the data processing agreement applies.

The license service

The server regularly contacts ON IT’s license service to obtain and renew its license. It sends the Visma customer’s customer number, name and organisation number, the number and name of the companies in the installation, the machine name and the software version, and the request comes from the server’s IP address. Nothing from the company databases is sent.

We store the license, what the server last reported, and our own notes about the customer relationship, which may include the names and e-mail addresses of contact persons at the customer or partner. The license service notifies us by e-mail of events in the license relationship.

The data comes from the software and from the customer or partner ordering the license. It mostly concerns businesses, but a machine name or a contact person may point to you as an employee. Without the data we cannot issue a license, and the software stops.

The license service decides automatically, from the license status and dates, whether the software answers for a company. If you believe a stop is wrong, you can ask for a person at ON IT to look at it.

This site

The site uses no cookies for analytics or marketing. Cloudflare, which delivers the site, may set technical cookies to stop attacks and bots. They are necessary and need no consent. A visit sends your IP address and browser information, and downloads are logged.

E-mail

If you write to us, we use the information to answer you and follow up the matter.

Purposes and legal basis

• The license, the site and enquiries: issuing, checking and notifying about the license, delivering and protecting the services, and answering enquiries are based on legitimate interest (GDPR Article 6(1)(f)). The interest is to deliver the license the customer has agreed to, make sure it is followed, and keep the services secure. Where the customer is a sole proprietorship, the legal basis for the owner’s data is the contract (Article 6(1)(b)).
• Invoicing and accounting: legal obligation under the Norwegian Bookkeeping Act (Article 6(1)(c)).

How long

• License data and notes are deleted twelve months after the license has ended.
• Invoicing records are kept for five years after the end of the financial year, as the Bookkeeping Act requires.
• Technical logs and sent notifications are deleted automatically by our suppliers, normally within a few weeks.
• E-mail is deleted when the matter is closed and we no longer need it.

Recipients

The data is processed for us by Cloudflare (the license service and this site), Postmark/ActiveCampaign (e-mail notifications), Google Workspace (e-mail) and our accounting system and accountant. Cloudflare also uses some technical data, such as IP addresses linked to attacks, on its own responsibility (Cloudflare’s privacy policy).

Cloudflare, ActiveCampaign and Google are US companies, and data may be processed outside the EEA. Transfers are based on the EU–US Data Privacy Framework and, for other countries, the EU Standard Contractual Clauses. You can get a copy by writing to us.

Your rights

You can ask for access, rectification, erasure and restriction of processing, and, where it applies, to receive data you have given us in a machine-readable format (data portability).

You can object at any time to processing based on legitimate interest.

Write to post@on-it.no. We answer within one month. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).