Privacy Policy

We process personal data of you as customer, prospective customer, business partner or third party to establish, perform and terminate a contract pursuant to Art. 6 (1) b GDPR. Prior to a contract, your personal data can be processed to prepare bids or purchase orders or to fulfil other requests of the prospective customer relating to contract conclusion. In this regard, you will need to provide any personal data that we need for preparing and carrying out our business relationship with you. In the absence of this information, we will not be able to process your inquiry and/or to perform the contract. As prospective customers you can be contacted during the contract preparation process using the information that you have provided.

We also process personal data for advertising purposes, if this is consistent with the contractual purpose pursuant Art. 6 (1) f GDPR. If your personal data is collected only for advertising purposes, you can choose whether to provide this data. You shall be informed that providing data for this purpose is voluntary. As part of the communication process, Hexagon Purus ASA and its affiliates will ask for your consent. When giving consent, you will be given a choice among available forms of contact, such as e-mail and phone to withdraw your consent. If you object to the use of your data for advertising purposes, we will no longer use it for these purposes and will restrict or block from use for these purposes. We may use third-party sites and third-party platforms as well as publicly available information to collect and add some information to the information provided by you in order to give you relevant communication (for marketing purposes). Examples of collected information are additional work-related profile information.

Next to advertising purposes, the legitimate interests, which coincide with the particular purpose, include but are not limited to: Ensure the technical operation, responding to inquiries that are not related to the contract, ensure data security, ensure data availability, and rectification of errors and faults. In the event we need to disclose data for these purposes, we will expressly notify you of this circumstance. In the absence of this information, we may not be able to process your inquiry.

We will also process your personal data for the purpose of compliance with statutory requirements that apply to us pursuant to Art. 6 (1) c GDPR. These requirements may exist under the trade, tax, money laundering, financial, or criminal code. The processing purposes are determined by the applicable statutory duty; generally, data processing will only serve the purpose of compliance with monitoring and disclosure duties under national law.

You can use our career portal to apply for jobs advertised there or to submit unsolicited applications. Data processing takes place exclusively for the purpose of initiating employment relationships on the basis of Art. 88 (1) GDPR related with national laws.

Your data will be stored for the duration of the application process; if you enter into an employment relationship with us, your application data will be stored by us for the duration of your employment relationship. If, after completion of the application process, you are not hired, we will retain your data according to national laws. Your data will not be used for any other purpose than retain your data for legal proof. In the case of unsolicited applications or after your consent to store the data for a longer period for possible future employment, we will inform you about the retention time when asking you for consent.

If you use any of your social media profiles as part of your CV, you declare your consent to submit this information to us for the purpose to take the information at your social media profile into account for your application process.

Hexagon Purus ASA may take part on social media platforms to enable you to get information about the company and network with us. Your use of these features may result in the collection or sharing of information about you, depending on the platform. We encourage you to review the privacy policies and settings on the social media websites with which you interact to make sure you understand the information that may be collected, used, and shared by the Social Media Providers.

a. LinkedIn

We use our LinkedIn presence to provide information about our company, products and services, combined with the opportunity for users to interact with us in a targeted manner. We are processing personal data basing on Art. 6 (1) f GDPR. Our legitimate interest is, in particular, our business interest in sharing information with our users and being able to communicate with them.

Before we publish pictures of persons, we ask for your consent (legal basis: Art. 6 (1) a GDPR), or we make a written contractual agreement with your (legal basis: Art. 6 (1) b GDPR). In exceptional cases we may publish pictures based on our legitimate interest for making information about our company available (legal basis: Art. 6 (1) f GDPR).

We entered into a data processing agreement with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland: https://de.linkedin.com/legal/l/dpa.

It is not excluded that data may be processed by systems outside the European Economic Area. LinkedIn has committed itself to comply with the European General Data Protection Regulation. A data transfer to systems outside the EU only takes place if the requirements of Art. 44 ff. GDPR are observed. You can learn more by clicking https://www.linkedin.com/help/linkedin/answer/62533?trk=microsites-frontend_legal_privacy-policy&lang=en.

For information relating to LinkedIn’s privacy policy please check back at: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

Data disclosure to authorities requires the existence of overriding statutory provisions.

Use of Insight Data

We operate online advertisement on LinkedIn and use Insight Data provided by LinkedIn, in order to evaluate the behaviour of our target group resp. users in the context of interaction with our site. The precise target group advertising is a legitimate interest of our company. LinkedIn users are informed; the main responsibility for such data collection lies with LinkedIn. A Joint Controller Addendum (JCA) has been closed. Conflicting interests of users are not overriding (publication of individual target group optimized advertising). Our legal basis is Art. 6 (1) f GDPR in conjunction with the JCA. For information relating to LinkedIn’s Joint Controller Addendum please check back at: https://legal.linkedin.com/pages-joint-controller-addendum. In case you assert your rights against us, we will pass your concerns on to LinkedIn in accordance with the addendum.

b. Facebook

With Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a Joint Control Agreement has been completed, which you have access to on

https://www.facebook.com/legal/terms/dataprocessing

https://www.facebook.com/legal/terms/page_controller_addendum

Meta Platforms Ireland Ltd. assumes the primary responsibility acc. to the European Data Protection Regulation (GDPR).

To learn more about the Facebook privacy statement, please visit https://www.facebook.com/privacy/explanation

The purpose of data processing on our fan page is to provide information on our products and services and simultaneously allowing users a targeted interaction with us. The data processing is legally based on Art. 6 (1) f GDPR. Our legitimate interest is in particular our economic interest, the exchange of information with our users and to communicate with them.

Data disclosure to authorities requires the existence of overriding statutory provisions.

If pictures are published; this is done via consent (legal basis: Art. 6 (1) a GDPR), on basis of a contractual agreement (legal basis: Art. 6 (1) b GDPR) and, in exceptional cases, on basis of legitimate interests. Legal basis: Art. 6 (1) f GDPR.

Use of Facebook-Insights

We operate online advertisement on Facebook and use Facebook Insights in order to evaluate the behavior of our target group resulting from interaction with our website. The precise target group advertising is a legitimate interest of our company. Facebook users are informed; the main responsibility for such data collection lies with Meta Platforms Ireland Ltd. Conflicting interests of users are not overriding (publication of individual target group optimized advertising). Our legal basis is Art. 6 (1) f GDPR.

c. YouTube

We use a YouTube channel of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5. The purpose of data processing on our YouTube channel is to provide information about products, services and news, combined with the possibility for users to interact with us in a targeted manner. The legal basis for the data processing is Art. 6 (1) f GDPR. Our legitimate interest is in particular our business interest to share information with the visitors of the YouTube channel and to be able to communicate with them.

The YouTube service is based on the following data processing agreement with Google Ireland Ltd.: https://www.youtube.com/t/terms_dataprocessing.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for the collection and further processing of personal user data on YouTube channels. Please note that YouTube collects and processes certain information about your visit to our YouTube channel even if you do not have a YouTube user account or are not logged in to YouTube. For us as the provider of this YouTube channel, only your public profile on YouTube is visible. The kind of information visible for us depends on your settings in your profile. For information about the processing of personal data by YouTube, please refer to YouTube's privacy policy at https://policies.google.com/privacy?hl=de&gl=de.

If we publish images of individuals, this is done via consent (legal basis: Art. 6 (1) a GDPR), based on a contractual agreement (legal basis: Art. 6 (1) b GDPR) and in exceptional cases based on legitimate interests (legal basis: Art. 6 (1) f. GDPR.

YouTube Analytics

We also process your activities on our YouTube channel with the help of the statistics service YouTube Analytics. This process helps us to understand our video and channel performance and optimize our channel and our content. This process is consistent with the purpose of data processing described below. Anonymous statistics are created based on your activities. Among other things, we can gain insights into the interactions and activities of our subscribers, the views and the reach of our videos, information about which countries and cities our visitors come from, as well as statistics about the gender ratios, age structures, providers, and interests of our visitors. Neither conclusions about individual users nor access to individual user profiles by the administrator are possible.

Data Transfer to third countries

Due to the affiliation of the provider Google Ireland Limited to the Google group, which has its headquarters in the USA, a data transfer to Google LLC and thus to all states in which Google has data centers cannot be excluded. To ensure an adequate level of data protection, Google Ireland Limited bases such data transfers on the standard contractual clauses of the European Commission.

In this context, we would like to point out that you are using the service provided by Google Ireland Limited (YouTube) and all associated functions such as sharing and rating videos, participation in discussions on your own responsibility. Data that you have voluntarily provided on YouTube will be processed by Google (e.g. name and username, email address, telephone number) and may therefore also be transmitted to third countries. The transfer of personal data to the USA was judged by the ECJ to be fundamentally unsafe without further security measures, as it cannot be ruled out that US security authorities will gain access to this data.

It is possible for you to restrict the processing of your data by Google. To do this, you can open the general settings of your Google account and change your privacy settings. Information on how to individualize your privacy settings can be found here: https://policies.google.com/privacy?hl=de&gl=de#infochoices

You can also change certain settings for your mobile devices (e.g. smartphones, tablets, etc.) so that Google only has limited access to your contact data, location data, calendar data or photos, among other things. These setting options differ depending on the operating system used on your mobile device.

d. X

X is a service provided by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A.If we process data with X, this is done based on the purpose and legal basis outlined below. There is no transfer of data to X, such as IP addresses, due to the embedding of tweets on homepages or similar.

However, we may retweet tweets from you, reply to tweets from you or write tweets that refer to you or your X account. In this respect, your public data on X may be made available to followers of our site.

The purpose of data processing on our X site is to provide information about products, services and news, combined with the possibility for users to interact with us in a targeted manner. The legal basis for the data processing is our legitimate interest (Art. 6 (1) f GDPR) on sharing information with our users and being able to communicate with them.
If we publish images of individuals, this is done via consent (legal basis: Art. 6 (1) a GDPR), based on a contractual agreement (legal basis: Art. 6 (1) b GDPR), and in exceptional cases based on legitimate interests (legal basis: Art. 6 (1) f. GDPR) to publish information about our services and events.

Personal data processed by X

We have no influence on the type and scope of the data processed by X Corp. or the transfer of the data to third parties. Furthermore, there are no control options for us.

In this context, we would like to point out that you use the services provided by X Corp. and all associated functions (e.g., sharing and rating content) takes place on your own responsibility.

Information about the data processing carried out by X Corp. and the corresponding purposes pursued can be found in the data protection guidelines of X Corp. here: https://X.com/en/privacy

It is possible for you to restrict the processing of your data by X. For that purpose, you can open the general settings of your X account and change your privacy settings.
You can control and customize your privacy settings here:
https://X.com/settings/y...

Information and further assistance on this can be found at this link:
https://help.X.com/de/fo...
You can also change certain settings for your mobile devices (e.g., smartphones, tablets, etc.) so that X only has limited access to your contact data, location data, calendar data or photos. These setting options differ depending on the operating system used on your mobile device.

For more information and assistance, please refer to the following links: https://help.x.com/en/personal...
To view the processed data, obtain information about their use and download the corresponding data as an archive, you can follow this link. https://help.x.com/en/managing...

To contact X, you can follow this link: https://help.x.com/en/forms/pr...

Data transfer to third countries

It is not excluded that data from users is processed on systems outside the European Union. Retrieval of public tweets is possible worldwide.

Your right to information, rectification, deletion, object and data portability
You may avail yourself of your right to information, rectification and deletion of data at any time. Simply contact us using one of the methods described above. Should you require data to be deleted, which we are still legally obligated to retain, access to your data will be restricted (blocked). You may avail yourself of your right to data portability if the recipient and ourselves have the technical means.
In case you require to assert your rights towards X Corp., we shall pass your concerns on to X Corp.

e. Instagram

Instagram is a service provided by Meta Platforms Ireland Ltd. With Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland a Joint Control Agreement has been completed, which you have access to on:

https://www.facebook.com/legal/terms/dataprocessing

https://www.facebook.com/legal/terms/page_controller_addendum

Meta Platforms Irland Ltd. assumes the primary responsibility acc. to the European Data Protection Regulation (GDPR).

To learn more about the Meta Platforms Irland Ltd. privacy statement, please visit:

https://help.instagram.com/155833707900388/?locale=en_GB&helpref=hc_fnav&cms_id=155833707900388&published_only=true

Purpose of the data processing of our Instagram presence page is to provide information on our prod-ucts and services and simultaneously allowing users a targeted interaction with us. The data processing is legally based on Art. 6 (1) lit. f GDPR. Our legitimate interest is, in particular, our economic interest, the exchange of information with our users and to communicate with them.

To operate the fan page, we use service providers that have been separately bound to maintain confidentiality and committed to data protection. Data disclosure to authorities requires the existence of overriding statutory provisions.

Before we publish pictures of persons, we ask for your consent (legal basis: Art. 6 (1) a GDPR), or we make a written contractual agreement with your (legal basis: Art. 6 (1) b GDPR). In exceptional cases we may publish pictures based on our legitimate interest for making information about our company available (legal basis: Art. 6 (1) f GDPR).

Use of Instagram-Insights

We operate online advertisement on Instagram and use Instagram Insights in order to evaluate the be-haviour of our target group resulting from interaction with our website. The precise target group

advertising is a legitimate interest of our company. Instagram users are informed; the main responsibility for such data collection lies with Meta Platforms Irland Ltd. Conflicting interests of users are not over-riding (publication of individual target group optimized advertising). Our legal basis is Art. 6 (1) f GDPR.

The information we collect

By providing our Facebook, Instagram, Twitter, YouTube, and LinkedIn Pages (in the following called “Pages”), we may collect the following information:

• Personal information such as name, address, contact details and other information of your profile
• Personal information such as your profession, political affiliation, gender, and other categories of data you post publicly
• Personal information from messages to us
• Other information which could be collect by providing the fan page

How we use the collected information

• to operate online advertisement on Facebook and use Facebook Insights to evaluate the behaviour of our target group resulting from interaction with our website
• to improve our Twitter Page, we use Twitter Analytics
• to provide information on our products and services
• to interact with interested users
• to investigate and respond to customer inquiries and complaints
• to promote, market and sell products, services, and special offers

How we share your information

We may disclose your information to third parties in the following circumstances:

• to third parties who provides services to us
• as required or permitted by law including, but not limited to, complying with a court order, complying with a statute or regulation, and assisting with investigations by law
• in emergency situations that threaten the life, health, or security of an individual, the community, or the environment
• in connection with a change of ownership, sale, merger, liquidation, reorganization, or acquisition of Hexagon Purus ASA
• in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements and when compelled to do so by government authorities or required by law or regulation including, but not limited to, in response to court orders and subpoenas

How we protect your information

We have implemented technical and organizational measures in accordance with the obligations under Art. 32 GDPR. These measures protect the collected information from loss, unauthorized access, and misuse. Furthermore, the measures prevent the disclosure, modification, and destruction of information, considering the risks associated with the processing and the nature of the data.

a. Important notice for California Residents

This Notice for California Residents includes the obligations of the CCPA and of the CPRA. Both Acts apply for personal information, of natural persons who reside in the State of California. California residents have a right to knowledge, access, and deletion of their personal information. Furthermore, they have the right to correct personal information, opt out the use of sensitive personal information, opt out the share of personal information and opt out the use of personal information for profiling. The collection, retention and use of personal information is limited for a reasonably time of the disclosed purpose.

If any conflict of this Notice and any other provision of the Privacy Statement exist, this Notice shall control only with respect to California residents and their personal information. If you are not located in California, please see the rest of our Privacy Statement.

To comply with the above obligations, we establish a list of the categories of personal information which we collect. For each category we also list the categories of third parties with whom we share the personal information for a business or commercial purpose.

We do not sell your data for any reason. This is why we do not offer a request for your opt out of the sale of your personal information.

Your Privacy Rights by the CCPA and CPRA

As a California resident you have the rights listed below.

Right to opt out

The right to opt out of the sale or sharing of your personal information.

The right to opt out the use of your sensitive personal information.

The right to opt out the use of your personal information to run through automated decision-making process to derive insights which is referred to as profiling.

However, even if you opt-out, we are allowed to continue sharing with service providers as permitted by law.

Right to know

California residents have the right to request that we disclose personal information that we have about them. You can request that we disclose to you the categories of personal information, the source from which the personal information is collected and information about the purpose for collecting, selling, or sharing your personal information. You can also request that we disclose to you the specific pieces of personal information and the third parties to whom we disclose personal information.

Right to correct information

California residents have the right to correct inaccurate personal information we have collected from them.

Right to data portability

California residents have the right to request a transfer of personal information to another entity. The personal information have to be transferred in a structured, commonly used and machine readable format.

Right to delete

California residents have the right to request deletion of the personal information we have collected from them. We send that request also to third parties that have received your personal information. To respond to your request, we will need to verify your identity to match with the information we have on file. The personal information that we use to verify your identity will not be used for any other purpose.

Furthermore, we will not collect or use your personal information for another purpose for which we collected the information or longer than reasonably necessary for the disclosed purpose.

Right to non-discrimination

California residents have the right to not receive discriminatory treatment for exercising their CCPA and CPRA privacy rights. We do not discriminate against California residents who exercise their CCPA and CPRA privacy rights.

Submit a request

You or your authorized agent can submit a request for opt out or for another purpose here or by
calling +47 70 30 44 50.

To respond to your request, we will need to verify your identity to match with the information we have on file. The personal information that we use to verify your identity will not be used for any other purpose.

1. Important notice for Virginia Residents

This Notice for Virginia Residents includes the obligations of the VCDPA. This Acts apply for personal information, of natural persons who reside in the State of Virginia. Virginia residents have a right to knowledge, access, and deletion of their personal information. Furthermore, they have the right to correct personal information, opt out the use of sensitive personal information, opt out the share of personal information and opt out the use of personal information for profiling. The collection, retention and use of personal information is limited for a reasonably time of the disclosed purpose.

If any conflict of this Notice and any other provision of the Privacy Statement exist, this Notice shall control only with respect to Virginia residents and their personal information. If you are not located in Virginia, please see the rest of our Privacy Statement.

Right to opt out

The right to opt out of the processing of personal data for targeted advertising purposes.

The right to opt out of the sale of your personal information.

The right to opt out the use of your personal information to run through automated decision-making process to derive insights which is referred to as profiling.

However, even if you opt-out, we are allowed to continue sharing with service providers as permitted by law.

Right to know

Virginia residents have the right to request that we disclose personal information that we have about them. You can request that we disclose to you the categories of personal information, the source from which the personal information is collected and information about the purpose for collecting, selling, or sharing your personal information. You can also request that we disclose to you the specific pieces of personal information and the third parties to whom we disclose personal information.

Right to correct information

Virginia residents have the right to correct inaccurate personal information we have collected from them.

Right to data portability

Virginia residents have the right to request a transfer of personal information to another entity. The personal information have to be transferred in a structured, commonly used and machine readable format.

Right to delete

Virginia residents have the right to request deletion of the personal information we have collected from them. We send that request also to third parties that have received your personal information. To respond to your request, we will need to verify your identity to match with the information we have on file. The personal information that we use to verify your identity will not be used for any other purpose.

Furthermore, we will not collect or use your personal information for another purpose for which we collected the information or longer than reasonably necessary for the disclosed purpose.

Right to non-discrimination

Virginia residents have the right to not receive discriminatory treatment for exercising their VCDPA privacy rights. We do not discriminate against California residents who exercise their VCDPA privacy rights.

Submit a request

You or your authorized agent can submit a request for opt out or for another purpose here or by
calling +47 70 304450.

To respond to your request, we will need to verify your identity to match with the information we have on file. The personal information that we use to verify your identity will not be used for any other purpose.