Privacy Policy
This privacy policy explains the processing of personal data conducted by 21st Company AS (“21st”) as a controller, and helps you understand your rights as a data subject in that regard. The privacy policy may be changed from time to time, and will always be available in its current version on 21st’s website.
21st does also process personal data as a processor, on behalf of entities that have an account on 21st’s software platform. Such processing is subject to the Data Processing Agreement.
1. DATA PROCESSED, PURPOSES AND LEGAL BASIS
Personal data for purposes of providing 21st’s services
21st collects personal data related to entities from publicly available sources, directly or via third parties, for the purpose of providing the services on 21st’s public website and on the 21st software platform offered via the website. The personal data may include e.g. names, birth dates, addresses, roles, gender, PEP and sanction statuses, etc. of shareholders, board members, management and other persons relevant in relation to entities. The legal basis for this processing is 21st’s legitimate interest in providing its services, cf. GDPR Article 6(1)(f).
As detailed in section 6 and 7 of the Terms of Service, 21st reserves the right to the sharing of some limited personal data, including personal data as mentioned above, with the company Legal Plant AS. When such sharing takes place, 21st is the controller of all personal data shared, including personal data for which 21st was originally a processor pursuant to the Data Processing Agreement. The legal basis for this processing is 21st’s legitimate interest in providing its services and actively contributing to the availability of current and accurate information for entities, such as law firms, that have obligations related to anti-money laundering checks and beneficial ownership control, etc., cf. GDPR Article 6(1)(f).
When someone registers a user on the 21st software platform, to use the platform individually or with an entity, 21st collects personal data of the user for the purpose of providing its services. The personal data may include e.g. name, birth date, email address, address, roles, login metadata (IP address, browser, date and time, geolocation, etc.), as well as any personal data connected to or stored in the individual account of the user. If a user chooses to sign up and log in to the 21st software platform via third parties, e.g. Google, some of the personal data may be gathered from those third parties. For users verifying their identity, role, authority, etc. with BankID or similar identity verifications methods, the personal data processed may also include national identity number and phone number. The legal basis for this processing is 21st’s performance of a contract with the user, cf. GDPR Article 6(1)(b), or 21st’s legitimate interest in performance of a contract with an entity the user has a relation to.
Personal data for marketing and sales purposes
If you subscribe to newsletters or marketing material, 21st will use your registered personal data to keep you updated on new product launches, software updates, customer arrangements or similar marketing related communications related to the business of 21st. The personal data may include e.g. name, email address, phone number, roles, login metadata (IP address, browser, date and time, geolocation, etc.). The legal basis for this processing is your consent, cf. GDPR Article 6(1)(a), or, if you are a user of the 21st software platform, 21st’s legitimate interest in keeping users informed about its services, cf. GDPR Article 6(1)(f).
21st may use personal data of willing customers and users to share testimonials, etc. on 21st’s website and in other material for the purpose of marketing 21st’s business and services. The personal data may include e.g. name and roles. The legal basis for this processing is your consent, cf. GDPR Article 6(1)(a).
21st may process personal data of potential customers or customer representatives for the purpose of sales and marketing. The personal data may include e.g. name, email address, phone number and roles. The legal basis for this processing is 21st’s legitimate interest in marketing its business and services to potential customers, cf. GDPR Article 6(1)(f).
Personal data for operational and communication purposes
21st will collect and process personal data necessary to uphold normal operations and communication regarding 21st's business and services, e.g. in case of support, contact with vendors, contact with potential candidates for employment, etc. The personal data may include name, email address, address, phone number, roles and other personal data relevant to the communication in question. Depending on the person 21st is communicating with, and the nature of the communication, the legal basis for the processing will be 21st’s performance of a contract, cf. GDPR Article 6(1)(b), or 21st’s legitimate interest in replying to inquiries and conducting business related communication, cf. GDPR Article 6(1)(f).
2. THIRD PARTIES AND DATA SHARING
21st utilizes third-party service providers for the provision of the Service and will share personal data with those third parties. The third parties utilized at any given time are listed here. Other than this, and the above-mentioned sharing of personal data with Legal Plant AS, 21st will not share personal data with third parties, unless specifically stated or necessary for 21st’s compliance with legal obligations, cf. GDPR Article 6(1)(c).
3. INFORMATION SECURITY AND STORAGE PERIOD
21st will implement appropriate technical and organizational measures to ensure an appropriate level of security with respect to the confidentiality, integrity and accessibility of the of personal data processed, cf. GDPR Article 32. The personal data processed subject to this privacy policy are stored as long as necessary for the purposes of processing.
4. YOUR RIGHTS
The processing of personal data by 21st is done in accordance with applicable law, such as the Norwegian Personal Data Act and GDPR, under which data subjects have certain rights.
As a data subject you may request information on, as well as access to, any personal data 21st processes about you. You may also request rectification and erasure of your personal data, restriction of the processing and transfer of the personal data to you in a machine-readable format.
When 21st’s processing of personal data is based on your consent, you may withdraw your consent at any time. Withdrawal of the consent will not affect the lawfulness of the processing conducted prior to the withdrawal.
If you believe that 21st has not complied with your rights under data protection law, you may file a complaint with the relevant data protection authority.
Any questions regarding your rights or this privacy policy can be directed to [email protected].