Axaz Privacy Policy

1. Introduction

This privacy policy provides you with information about Axaz AS' ("Axaz") processing of personal data in connection with employment, including which personal data we collect, why we process your personal data and your rights connected to the processing of the personal data.

If you have questions related to Axaz' processing of your personal data or to this privacy policy, please contact us by using the contact information as set out below.

3. Data controller

Axaz will act as the data controller of your personal data in relation to the employment relationship between you and Axaz.

3. Which personal data we process, purpose and legal basis for the processing

3.1 Relevant legal basis for processing

Relevant legal basis for processing your personal data is normally:

• GDPR Article 6 (1) (a), which allows us to process personal data when you have consent,
• GDPR Article 6 (1) (b), which allows us to process personal data when it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
• GDPR Article 6 (1) (c), which allows us to process personal data when it is necessary for compliance with a legal obligation to which the controller is subject, or
• GDPR Article (1) (f), which allows us to process personal data when it is necessary for the purposes of the legitimate interests pursued by us where such interests are not overridden by your interests or fundamental rights and freedoms.

For processing of special categories of personal data, such as health data and union membership, the relevant legal basis may rely on GDPR and local personal data legislation:

• GDPR Article 9 (2) (f) which allows us to process personal data when it is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
• The Norwegian Personal Data Act Section 6 which allows Axaz to process personal data when the processing is necessary for carrying out obligations and rights in the field of employment law

Axaz may, on a case-by-case basis, process personal data based on other legal grounds as set forth in an applicable privacy notice.

3.2 Personal data about the employees

We collect and use your personal data for different purposes in relation to your employment relationship. Such purposes, personal data and legal basis may include inter alia:

• Personnel administration: Axaz process e.g. contact information, application for position, CV, certificates for education/work practice, courses and training, letter of employment, employment agreement, documents on pension and salary level, special agreements, minutes and notes from employee reviews, performance review, sex, social security number and other ID (employee number), marital status, job title, date of employment and leave date, cause of dismissal, date of absence and duration, lent assets, loans to employees or gurantees for loans, grievance and diciplinary actions and other information related to the employment relationship and the administration of the employment relationship. The legal basis for processing is to fulfil the employment agreement or other agreements with you, our rights and obligations as an employer and Axaz' legitimate interest in managing the employment relationship.
• Payroll, pension, insurance and reimbursement administration: Axaz process e.g. salary information, social security number, account information, information about absence, leave, business expenses, pension and insurance information etc. The legal basis for processing is to fulfill the employment contract with you, our legal rights and obligations as an employer, such as administration of sick pay etc.
• Registration of working time, which includes information about when you started and ended the workday, if you have had sick leave or other leave etc. The legal basis is Axaz' legal obligations to have an overview of working hours, and our legitimate interests in knowing when you have been absent in order to be able to calculate the correct salary, sickness benefits, etc.
• Visa and work permits, where our legal basis is legal obligations to ensure that employees hold necessary permits to work in the relevant jurisdiction.
• Managing business relationships, where employees personal data may be disclosed to such business partners, such as your contact information and position.

• Security logs from IT systems, which may encompass information about employees' use of the IT systems. The legal basis is Axaz' legitimate interests in managing and maintaining the security of Axaz' business, preventing unauthorised access and disclosure of personal data and to protect the IT structure against security breaches etc.

• Access control system, which registers entries/exits at the workplace. The legal basis is Axaz' legitimate interests in securing the premises, and to safeguard the security of employees in case of an accident/crisis.

• Profile pictures of employees on the intranet and web page where the legal basis is the employee's consent, and on access cards, where the legal basis is Axaz' legitimate interests in workplace safety and to protect against security breaches.
• Compliance with statutory requirements, or other legal obligations imposed by public authorities or in a collective bargaining agreement, e.g. statutory requirements relating to health, environment and safety, reporting, tax, follow-up of sick leave, or trade union membership information to fulfil rights and obligations in a collective bargaining agreement and to carry out deduction for trade union membership fees etc. The legal basis is Axaz' legal obligations.  
• Ensure Axaz' or third parties' rights in the establishment, exercise and defence of legal claims that Axaz believes to have, or directed against Axaz from employees, third parties or public authorities. The legal basis is Axaz' legitimate interests in exercise and defending potential claims from employees and others, and GDPR Article 9 (2) (f) in case of processing of special categories of personal data.  
• Ensure Axaz' interests in potential changes of the company, such as sale of shares or transfer of employment in relation to a merger, demerger or an asset transfer, where the legal basis for processing may be Axaz' legal obligation in case of a transfer of undertaking or Axaz' legitimate interests in completing such change.

The personal data is normally collected directly from you. We can also collect personal data from others, such as references in connection with recruitment and from public authorities (e.g. tax authorities). Axaz may also receive information from a trade union to which you are a member.

Please note that we, in order to be able to fulfil our obligations according to the employment contract and other agreements entered into with you, depend on receiving a variety of information, such as account information to pay salary. The consequences of not providing such information are that Axaz cannot fulfil the contract entered into with you.

3.3 Processing of personal data about next of kin/family members

Axaz processes contact information about our employee's next of kin. The legal basis is legitimate interests to contact your next of kin in case of a crisis or other critical situation. The information is obtained from you upon employment.

We may also be obliged to process certain personal data relating to your family members due to legal obligations, e.g. for the assessment of right to leave of absence in connection with a child's illness etc., or to fulfil our obligations towards you, e.g. in connection with insurance.

We ask that you make your next of kin aware of this privacy policy. If your next of kin have questions relating to such processing, they may contact Axaz.

4. Disclosure of personal data

Axaz may disclose your personal to third parties for the purposes set out in this privacy policy, if we have a legal basis for such disclosure. Axaz may, for example, disclose personal data to the following unaffiliated third parties and as described above in section 3.2:

i) Professional Advisors: Accountants, auditors, lawyers, pension providers, insurers and other outside professional advisors.

ii) Public and Governmental Authorities: Entities that regulate or have jurisdiction over Axaz such as regulatory authorities, public bodies, and judicial bodies, including to meet national security or law enforcement requirements;

iii) To trade unions if this a requirement pursuant to applicable local law or collective bargaining agreement; and

iv) Service Providers: Companies that provide products and services to Axaz such as IT systems suppliers and support, claims handlers and loss adjusters and hosting service providers.

v) Technology Partners: Companies that provide products and services Axaz utilize in delivery of managed service to customers.

When Axaz uses data processors to collect, store or otherwise process personal data on our behalf, e.g. in connection with payroll administration, IT operations etc. the relationship to such service suppliers is governed by data processing agreements, which among other things ensures information security for your personal data.

5. Transfer of personal data outside the eea/EU

Your personal data may be subject to processing or storage outside the EU/EEA. In such cases, Axaz will ensure that the personal data is subject to appropriate safeguards, by means of transferring personal data to countries approved by the EU Commission, entering into the EU Standard Contractual Clauses and additional measures (if required) for such transfers, or ensuring other appropriate safeguards.

6. Retention of personal data

Axaz store your personal data for as long as it is necessary to achieve the purposes for which the personal data were collected for. This entails that Axaz as a main rule will process your personal data during the employment relationship, and for a period after the conclusion of the employment relationship, to the extent this is necessary to;

• fulfil Axaz' obligations pursuant to the employment contract or other agreements with you, including payment of holiday allowance;
• establish, exercise and defend a legal claim;
• safeguard Axaz' legitimate interests, e.g. in relation to potential future disputes relating to the parties rights and obligations in relation to the employment relationship; and
• fulfil statutory obligations to which Axaz is subject, such as continued storage pursuant to  accounting legislation.

Axaz will also retain information about name, position, employment number, duration of the employment and background for termination of the employment relationship after termination for historical purposes. Such continued storage is based on Axaz' legitimate interests.

If the processing is based on consent, the processing will cease when you withdraw your consent. You can withdraw your consent at any time.

Axaz has established a retention procedure, which can be found at Axaz’s HR-system.

7. Protection of personal data

Axaz will take appropriate technical and organisational measures to protect personal data that are consistent with applicable privacy and data security laws and regulations, including requiring service providers to use appropriate measures to protect the confidentiality and security of personal data.

8. Automated Decisions

Axaz does not envisage that you will be subject to decisions that will have a significant impact on you based solely on automated decision-making. Axaz will notify you in writing if this position changes.

9. Your rights

You have under some circumstances the right to access personal data, to correct inaccurate personal data, to have personal data erased, to restrict the processing of your personal data, to receive personal data you have provided to Axaz in a structured, commonly used and machine-readable format for onward transmission (data portability), and to object to the processing.

If the processing is based on your consent, you may at any time withdraw your consent.

You also can file a complaint with your local data protection supervisory authority. However, we encourage you to address any objections against Axaz' processing of personal data to us first.

10. Contact information

If you have questions related to Axaz' processing of your personal data, this privacy policy or want to exercise any of your rights, please contact Kim Jarno-Kristiansen CEO at kim.jarno-kristiansen@axaz.com or +47 952 92 652.

11. Changes to this privacy policy

This privacy policy will be available on Axaz’s intranet. If we make changes in our processing of personal data, the policy will be updated, and the change will be notified on the Axaz’s intranet.

***

Last updated: 15.06.2021

‍