Processing of personal data at Carucel Eiendom

2. General information on personal data

Personal data are any information or assessment that can be linked to an individual person or a smaller group of people (the “Data Subject”). Names, telephone numbers, addresses, and e-mail addresses are examples of what may be considered personal data.

3. Carucel’s role as Data Controller

Our processing of your personal data is described in further detail in section 4 below. Carucel is the Data Controller for this processing of your personal data.

Note however that Carucel also handles the assets of other companies and third parties. In these cases, the owner of the asset will be the Data Controller and Carucel will act as the Data Processor. We recommend that you get in touch with the owner of the asset if you have any questions about the owner’s processing of your personal data or Carucel’s processing of your personal data on behalf of the owner.

4. Our processing of personal data

4.1 Our processing of personal data and the purpose of the processing

Below is information on what personal data we process, as well as a description of the purposes of each processing activity:

Rental - commercial properties. We process the personal data of contact persons representing tenants/customers to lease commercial property and administrate the lease/customer agreement. To this end, we will collect and process the contact person’s name, national ID number, telephone number, e-mail address, a copy of their identification card, account number, information on solvency, as well as information on employment/education. We will also process data about the company renting the commercial property, including company name, organisation number, and information about the company’s solvency. In connection with our administration of the lease agreement, we will collect and process statistics and data pertaining to the lease agreement, performance data, information on the duration of the lease, and VAT information.

Rental – private tenants. We will collect personal data about private tenants to enter and administrate the lease agreement. To this end, we will collect the tenant’s name, e-mail address, telephone number, a copy of their identification card, account number, information on solvency, education, employment, and contact information for next of kin. We will also process data on the duration of the lease and the tenant’s use of the property, including whether the tenant is a smoker/non-smoker, the number of people who reside at the property (e.g., the tenant’s marital status), and disciplinary measures.

Purchase and sale of real estate. If we purchase or sell real estate, we will process personal data regarding the buyer/seller, tenants, and third parties (e.g., estate agents) in order to enter an agreement concerning the purchase/sale of real estate. If we purchase real estate, we will also process this data in order to comply with our duty of investigation. If we sell information, we will also process this data in order to comply with our duty of notification. To this end, we will process the contact information of the buyer/seller, tenants, and other third parties. We will also process data on tenants’ residential addresses and the terms of their lease.

Administration of business connections. We process personal data about the contact persons of our suppliers and business connections in order to administrate the cooperation and agreements we have with these parties. To this end, we process the contact person’s name, position, contact information, and workplace.

Depending on the circumstances, it may be necessary for Carucel to also process other categories of personal data and/or the above personal data for other purposes. For example, this will apply if you submit questions to us via e-mail or if you contact us by other means. You may at any time contact us to be informed of what personal data about you we have stored (see the contact information at the bottom of this Privacy Statement).

4.2 Sources – where was the personal data collected from?

We collect the personal data described in section 4.1 from the following sources:

Rental - commercial properties. The personal data we process in connection with our leasing of commercial properties is primarily collected from our tenants/customers, as well as their contact persons. Assessments of a company’s solvency is collected from a credit bureau.

Rental – private tenants. The personal data we process in connection with our leasing of properties to private tenants is primarily collected from our tenants. Assessments of a tenant’s solvency is collected from a credit bureau.

Purchase and sale of real estate. The personal data we process when selling real estate is primarily collected from the Data Subject. When we purchase real estate, the personal data we process will be collected from the seller of the property.

Administration of business connections. Personal data we process concerning the contact persons of our suppliers and business connections are primarily collected from these contact persons.

5. What is the lawful basis for our processing of personal data?

We apply the following basis in connection with our processing of personal data:

Rental - commercial properties. In the event that the tenant of a commercial property is a physical person or a sole proprietorship, we will process the tenant’s personal data in order to satisfy and administrate the lease we have entered with the tenant. If the tenant is a legal person, we will process the above personal data on the based on our legitimate interest in entering and administrating the lease agreement.

Rental – private tenants. We process personal data about our private tenants (as well as others who reside at the property with the tenant) in order to fulfil and administrate the lease agreement we have with the tenant, and with a basis in our legitimate interest in managing the use of the property.

Purchase and sale of real estate. We collect and process data on the buyer/seller of the property to fulfil the agreement we enter with the buyer/seller. We process personal data about tenants and other conditions related to the real estate in question in order to fulfil our duty to investigate (if we are purchasing the property) or to fulfil our duty to notify (if we are selling the property).

Administration of business connections. We process personal data about our contact persons for our suppliers and business connections based on our legitimate interest in administrating the supplier and business partnerships we have with these parties.

6. Disclosure of personal data and use of data processors

We use Carucel Management AS (“Carucel Management”) as a property manager. This entails that Carucel Management will assist us in development, operations, leasing, and the purchase and sale of residential and commercial real estate. Carucel Management also assists us in communicating with tenants and other business partners. For the purposes of this management, Carucel Management will process your personal data on our behalf, acting as our Data Processor. We furthermore make use of other service providers who provide us with IT services and other administrative services. These service providers will also act as our Data Processors. We have entered Data Processing Agreements with Carucel Management and the above-mentioned service providers requiring them to ensure that the personal data they process on our behalf is stored securely, that it does not come into the possession of unauthorised parties, and that it is not used for other purposes. In connection with real estate sales, we will enter confidentiality agreements with the persons and companies to whom we disclose data and personal data. These confidentiality agreements impose a duty of confidentiality on the recipient and contain scope limitations concerning the use of the data. In the event that any of the service providers are located in countries outside of the EU/EEA, we will ensure that your personal data is secured in a satisfactory manner by, e.g., entering Standard Contractual Clauses (“SCC”) drafted by the European Commission. We will not disclose your personal data to parties other than those mentioned above unless we are required by law to do so, or if disclosure is needed to stipulate, pursue, or defend a legal claim.

7. For how long will we store your personal data?

We will erase or anonymise the personal data we have collected about you when it is no longer needed for the purpose for which it was collected (and where continued storage will not be in compliance with the Personal Data Act). In the event that we store personal data in order to comply with statutory obligations (e.g., the Bookkeeping Act), then we will erase or anonymise this personal data when continued storage is no longer needed to comply with these statutory obligations.

8. Your rights

You hold the following rights in connection with our processing of your personal data:

Access: You can get in touch if you wish to know more about what personal data about you that we process. You can also request a copy of the personal data about you that we process. Note that we are subject to a duty of confidentiality for processes concerning the purchase and sale of real estate in which we are involved. This duty of confidentiality may in certain cases limit our ability to provide you with access to the personal data about you that we process.

Rectification: If the personal data about you that we process is inaccurate, then you can demand that we rectify this.

Erasure: You can submit a request that we erase your personal data, which we will respect and with which we will comply unless we, e.g., are required to store your personal data, or if the relevant personal data is needed to stipulate, assert, or defend a legal claim.

Restrict processing: In accordance with data protection legislation, you can also demand that we restrict our processing of your personal data if the conditions for this are met pursuant to the data protection legislation. If processing is restricted, your personal data will only be stored. However, this does not apply if you, despite the restriction, have consented to another form of processing, or if such further processing can take place with other grounds for processing (e.g., to pursue a legal claim).

Object to processing: If personal data is being processed for the purpose of marketing, then you have the right to object to the processing of your personal data. In the event that your inquiry is based on your specific situation (e.g., an extraordinary need to protect your identity), then you may, in accordance with data protection legislation, object to the processing activities we perform in order to fulfil legitimate interests that are not overridden by the interests of the Data Subject or basic rights and freedoms. However, this does not apply if there are compelling and legitimate grounds for the processing that takes precedence over your interests, or if the processing is needed to stipulate, assert, or defend a legal claim.

Data portability: If we process personal data about you on the basis of your consent or in order to fulfil an agreement, and this personal data is processed automatically, then you can request that we disclose the personal data to you or to a third party in a structured, commonly used, and machine-readable format.

We note that the rights above are not absolute, and there may be exceptions to or limitations of your ability to exercise these rights. Please contact us in the event that you have any questions, or if you wish to exercise your rights. Our contact information can be found in section 12 below.

9. What do we do to ensure that your personal data is secure?

As the Data Controller for your personal data, we hold the general responsibility to ensure that your personal data is securely processed and stored. This entails that we must implement technical and organisational measures that are suited to ensure satisfactory information security.

For security reasons, there are limits to how much we can disclose regarding the security measures we have established and implemented. However, we can state that all our employees are subject to a duty of confidentiality with regard to your personal data where this is necessary, and that we have enacted measures to ensure the integrity and accessibility of your personal data.

10. The Norwegian Data Protection Authority and current personal data legislation

The Data Protection Authority was established in order to supervise the processing of personal data conducted by enterprises. You can contact us or submit a complaint to the Data Protection Authority in the event that you are dissatisfied with our processing of your personal data. You can also submit complaints to equivalent data protection authorities in EU/EEA states that are your regular place of residence, workplace, or that are the location where the alleged violation has taken place. The contact information of the Norwegian Data Protection Agency is available on their website http://www.datatilsynet.no. On this website, you can also find further information on our duties and your rights pursuant to the current Personal Data Act.

The current applicable personal data legislation is available at http://www.lovdata.no.

11. Amendments

We make revisions to this Privacy Statement at any time as a result of changes to our processing of personal data or as a result of new personal data legislation. An updated version of the Privacy Statement will be published on our website whenever it is amended.

12. Contact information

If you would like further information on what personal data about you we process, or if you wish to exercise one of your rights, please submit an inquiry to:

Carucel Management AS Fridtjof Nansens Plass 4, 0160 Oslo post@carucel.no