Privacy Policy for customers, website visitors, and other external contacts, including applicants for jobs and internships.

We at Extend AS (org. no. 977 049 318) – referred to as “Extend,” “we,” “us,” or “our” – are committed to protecting your privacy and ensuring that your personal data is processed in a secure, accurate, and lawful manner. Extend has therefore prepared this privacy policy to inform you about how we process your personal data as part of our business operations when you interact with us in various ways.

This privacy policy applies to:

individuals who serve as contact persons for a potential or existing customer or business partner;
individuals who visit our website, engage with our content, and/or contact us via the communication channels provided on the website;
individuals who contact us regarding customer support matters;
individual users of our quality management system, EQS, which is offered to our customers;
recipients of our newsletters;
individuals applying for employment or an internship with us via our website.

For those applying for a position with us via our website or through finn.no, the information provided will be treated as strictly confidential and shared only with those involved in our recruitment process. This information will be retained for the duration of the application process and will be deleted from our internal records once the process has concluded. Furthermore, finn.no maintains a policy whereby applications stored within their portal are automatically deleted after 12 months.

HOW WE COLLECT YOUR PERSONAL DATA

If you are a contact person for a potential or existing customer or partner of ours, we collect the personal data we process about you either directly from you or from the company you represent. Personal data concerning you as a contact person for a prospective customer or partner may also have been collected from one of our group companies—an entity with which you, or the company you represent, are already a customer or partner, or have previously been in contact.

If you visit our website, we process information about you that is generated by cookies (small text files) placed on your device when you access our site. To learn more about how we handle cookies on our website, please refer to our Cookie Policy. We also process personal data that you have provided to us directly via one of the contact channels available on our website.

If you are a recipient of our newsletter, we collect the personal data we process about you directly from you—either because you signed up for the newsletter yourself, or because you are a contact person for one of our customers or partners. Alternatively, this data may be collected from one of our group companies with which you, or the company you represent, are already a customer or partner, or have previously been in contact.

If you are applying for a job or an internship, we collect the personal data we process about you directly from you or from individuals you have provided as references. We may also collect information from public sources, such as LinkedIn. For certain recruitment processes, we engage an external recruitment partner; in such cases, we also collect personal data about you from that external partner.

DETAILS REGARDING OUR PROCESSING OF PERSONAL DATA

The tables below provide further details regarding the categories of personal data we process, the purposes for which your data is processed, the legal bases for such processing, the duration for which your data is stored, and the recipients with whom your data is shared.

To make it easier for you to read this privacy policy and understand how we process your personal data, we have organized the detailed information below into subheadings based on the category of data subject to which you belong.

Contact persons for potential or existing customers or partners

TO ENTER INTO OR FULLFILL AGREEMENTS
Purpose	Category of personal information
We process your personal data in order to enter into and fulfill agreements with you, or with the company you represent, regarding our services.	Name Contact details, e.g., phone number, address, and email address Title and role National identity number (applies only if you are a sole proprietorship) Correspondence between you and us during contract negotiations and in connection with the drafting and conclusion of an agreement Contractual documents, including physical or electronic signatures
Legal basis
Performance of a contract: If you intend to enter into, or have entered into, an agreement with us as a sole proprietorship, the processing of your personal data is necessary for us to fulfill our obligations under the agreement with you and to provide our services, or to take steps at your request prior to entering into the agreement. Legitimate interest: If you are a representative of a company, and it is that company that intends to enter into—or has already entered into—an agreement with us, we process your personal data based on our legitimate interest in entering into and fulfilling the agreement with, and providing our services to, the company you represent.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement and for two years after the agreement has ended. However, we may store your contact information for a longer period in order to maintain our business relationship, follow up on previous collaborations, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you—or the company you represent—inform us that you will no longer serve as the contact person for the company, we will immediately deactivate your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group—the Nordic group of which Extend is a part. The company that is our client or business partner (if you are a contact person).

TO ADMINISTER AND MANAGE THE CONTRACTUAL RELATIONSHIP
Purpose	Categories of personal data
We process your personal data in order to administer and manage our business relationship with you or the company you represent, as well as to communicate with you on an ongoing basis regarding the services provided under the agreement.	Name Contact details, e.g., phone number, address, and email address Title and role Correspondence between you and us Other personal data that may be necessary depending on the purpose of our interaction in each specific case—for example, dietary preferences, allergies, or professional choices when you attend conferences organized by us. Collection of customer satisfaction data via various customer surveys—you may choose to respond anonymously.
Legal basis
Performance of a contract: If you have entered into an agreement with us as a sole proprietorship, our processing of your personal data is necessary for us to fulfill our obligations under the agreement with you. Legitimate interest: If you are a representative of a company, and it is the company that has entered into an agreement with us, we process your personal data based on our legitimate interest in fulfilling the agreement with the company you represent.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement and for two years after the agreement has ended. We delete personal data that is no longer required for the administration of the contractual relationship on an ongoing basis during the term of the agreement. However, we may store your contact information for a longer period in order to maintain our business relationship, follow up on previous collaborations, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you—or the company you represent—inform us that you will no longer serve as the contact person for the company, we will immediately deactivate your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group. The company that is our client or business partner (if you are a contact person). Hotels hosting events organized by us.

TO CHARGE FOR OUR SERVICES AND/OR PRODUCTS
Purpose	Categories for personal data
We process your personal data in order to invoice for our services/products and to manage transactions that take place between us and our customer or business partner.	Name Contact details, e.g., phone number, address, and email address Title and role National identity number (if you are a sole proprietorship) Billing details and payment information, including payment history and transactions (personal data only to the extent that you are a customer or partner of ours in the capacity of a sole proprietorship)
Legal basis
Performance of a contract: If you have entered into an agreement with us as a sole proprietorship, our processing of your personal data is necessary for us to fulfill our obligations under the agreement with you. Legitimate interest: If you are a representative of a company, and it is the company that has entered into an agreement with us, we process your personal data based on our legitimate interest in fulfilling the agreement with the company you represent. Legal obligation: Furthermore, our processing of personal data in connection with the invoicing and accounting of our services is necessary for us to fulfill our obligations under the Norwegian Accounting Act.
Rentention period
As a general rule, your personal data is stored throughout the term of the agreement and for two years after the agreement has ended. Data required for invoicing and accounting purposes, in accordance with the Bookkeeping Act, is retained for five (5) years. However, we may store your contact information for a longer period in order to maintain our business relationship, follow up on previous collaborations, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as the contact person for the company, we will immediately deactivate your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Our ERP system provider. Other companies within the Confirma Group. The company that is our client or business partner (if you are a contact person).

TO RECORD MEETINGS
Purpose	Categories of personal data
We process your personal data—where relevant, by recording meetings in which you participate—in order to follow up on agreed-upon plans and ensure the quality of our deliverables to our potential and/or existing clients and partners. Such recordings shall take place based on prior agreement.	Name Title and role Contact details, e.g., phone number, address, and email address Images and/or recordings of you Opinions expressed or comments made by you during meetings
Legal basis
Legitimate interest: Our processing of your personal data is based on our legitimate interest in following up on agreed-upon measures and obligations decided during meetings, as well as ensuring the quality of our delivery of products and services to the customers and partners with whom we are in dialogue.
Rentention period
Your personal data will be stored until the subject of the meeting has been definitively clarified and/or until relevant documentation has been transferred in a written, anonymized format, at which point any recordings are no longer required to be kept.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Providers of digital meeting platforms.

FOR GROUP-WIDE ADMINISTRATION
Purpose	Categories of personal data
We process your personal data in a group-wide customer portal to facilitate unified and efficient administration within the group, as well as to monitor, analyze, and develop our collective operations.	Name Contact details, e.g., telephone number, address, and email address Title and role National identity number (if you are a sole proprietorship) Billing details and payment information, including payment history and transactions (personal data only insofar as you are a customer or partner of ours in the capacity of a sole proprietorship) Contractual documents, including physical or electronic signatures Correspondence between you and us
Legal basis
Legitimate interest: Our processing of your personal data within a group-wide customer portal is based on our legitimate interest in enabling efficient, consistent, and secure administrative management of customer relationships across the group, as well as in monitoring, analyzing, and developing the group’s collective operations.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement and for two (2) years after the agreement has ended. Data required for invoicing and accounting purposes, in accordance with the Bookkeeping Act, is retained for five (5) years. However, we may store your contact information for a longer period in order to maintain our business relationship, follow up on previous collaborations, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as the contact person for the company, we will immediately deactivate your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group.

FOR GROUP CROSS-SELLING
Purpose	Categories of personal data
We process your personal data in order to share your contact details with relevant companies within the Confirma Group, in cases where we assess that you, or the company you represent, may be interested in additional services from another company within the Confirma Group.	Name Contact details, e.g., telephone number, address, and email address Title and role National identity number (if you are a sole proprietorship) The subject of the agreement between you—or the company you represent—and us Correspondence between you and us (if necessary in the specific case)
Legal basis
Legitimate interest: Our processing of your personal data is based on our legitimate interest in coordinating marketing activities within the group and strengthening our shared brand as a provider of comprehensive solutions.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement and for two (2) years after the agreement has ended. Data required for invoicing and accounting purposes, in accordance with the Bookkeeping Act, is retained for five (5) years. However, we may store your contact information for a longer period in order to maintain our business relationship, follow up on previous collaborations, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as the contact person for the company, we will immediately delete your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group.

TO MARKET OUR PRODUCTS AND SERVICES
Purpose	Categories of personal data
We process your personal data in order to contact you and offer you—or the company you represent—our services and products. When we direct marketing toward you, you always have the right to object to this, in which case we can no longer continue to process your personal data for this purpose.	Name Contact details, e.g., phone number, address, and email address Title and role National identity number (if you are a sole proprietorship) Information about the business activity conducted by you or the company you represent
Legal basis
Legitimate interest: Our processing of your personal data is based on our legitimate interest in marketing our products and services to potential customers and partners.
Retention period
We store your personal data for as long as we consider you, or the company you represent, to be a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as the contact person for the company, we will immediately delete your contact information. If you object to our processing of your personal data for direct marketing purposes, we will immediately cease such processing.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group.

Website visitors and those seeking contact via our website

TO PROVIDE A FUNCTIONING WEBSITE
Purpose	Categories of personal data
We process your personal data to provide a functional website for you as a visitor and to remember your choices.	Technical information collected when visiting our website, derived from online identifiers other than IP addresses Information about how you use our website Information about your choices (e.g., language settings)
Legal basis
Legitimate interest: Our processing of your personal data collected through the use of strictly necessary cookies is based on our legitimate interest in providing a well-functioning website for visitors.
Retention period
The duration for which we process your personal data varies depending on the specific cookie placed in your browser, including those you have consented to (where such consent is required). Persistent cookies remain on your device until you delete them yourself or until their specified expiration date passes. Session cookies do not have an expiration date and are stored only temporarily while you visit our website; these are automatically deleted when you close your browser. You can read more about our various cookies and how long they are stored in our Cookie Policy.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers of systems and tools that we use to operate our business. Our providers (so-called issuers) of third-party cookies.

TO ANALYZE HOW OUR WEBSITE IS USED
Purpose	Categories of Personal data
If you have provided your consent, we process your personal data to analyze how you use our website, with the aim of improving the user experience as well as analyzing and enhancing our digital marketing activities.	Technical information collected when visiting our website, derived from online identifiers other than your IP address Information regarding your choices (e.g., language settings) Consent ID (if you have consented to the use of cookies that are not strictly necessary) Information about your user behavior (e.g., whether you are a returning visitor, what you click on, how you navigate the site, how long you stay, and how you otherwise interact with our website)
Legal basis
Consent: Our processing of your personal data collected through the use of cookies that are not strictly necessary is based on your consent. You may withdraw or change your consent at any time. Read more about how we use cookies and how you can manage your consent in our Cookie Policy.
Retention period
The duration for which we process your personal data varies depending on the specific cookie placed in your browser, including those you have consented to (where such consent is required). Persistent cookies remain on your device until you delete them yourself or until their specified expiration date passes. Session-based cookies do not have an expiration date and are stored only temporarily while you visit our website; these are automatically deleted when you close your browser. You can read more about our various cookies and how long they are stored in our cookie policy.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our providers (so-called issuers) of third-party cookies and analytics tools.

TO ENABLE YOU TO CONTACT US VIA SPECIFIC CONTACT FORMS ON OUR WEBSITE
Purpose	Categories of personal data
We process your personal data in order to communicate with you when you have contacted us via one of our contact forms, which can be found under the tabs “Book a demo,” “Contact,” or “User Forum Registration” on our website.	Name Contact details, e.g., phone number, address, and email address Company name National identity number (applies only if you contact us in your capacity as a sole proprietorship) Information regarding your areas of interest concerning our services Other information you provide to us
Legal purpose
Performance of a contract: If you contact us as a sole proprietorship with the intention of entering into an agreement with us regarding our services, the processing of your personal data is necessary for us to take steps at your request prior to the conclusion of the agreement. Legitimate interest: If you contact us as a representative of a company that wishes to enter into an agreement with us, we process your personal data based on our legitimate interest in entering into an agreement to provide our services to the company you represent.
Retention period
Your personal data will be stored for as long as communication between you and us is ongoing. If the contact leads to the conclusion of an agreement, we will, as a general rule, store your personal data throughout the term of the agreement, as well as for two (2) years after the agreement has ended. However, we may store your contact information for a longer period in order to maintain and facilitate a future business relationship, follow up on previous communication between you and us, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as a contact person for the company, we will immediately delete your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group. The company that is our client or business partner (if you are a contact person). Partner hotels, in connection with registration for the User Forum.

TO ENABLE YOU TO CONTACT US VIA OTHER CONTACT CHANNELS
Purpose	Categories of Personal data
We process your personal data in order to communicate with you when you have contacted us via our email addresses, firmapost@extend.no or marked@extend.no, or our phone number, +47 73 54 61 00—all of which are available on our website.	Name Contact details, e.g., phone number, address, and email address Company name National identity number (applies only if you contact us in your capacity as a sole proprietorship) Other information you provide to us
Legal purpose
Performance of a contract: If you contact us as a sole proprietorship with the intention of entering into an agreement with us regarding our services, the processing of your personal data is necessary for us to take steps at your request prior to entering into the agreement. Legitimate interest: Depending on the reason for your contact, we process your personal data based on our legitimate interest: If you contact us as a representative of a company that wishes to enter into an agreement with us, we process your personal data based on our legitimate interest in entering into an agreement to provide our services to the company you represent. If you contact us as a sole proprietorship or as a representative of a company regarding other questions or inquiries concerning our services or our business, we process your personal data based on our legitimate interest in providing channels for contacting us, in order to ensure efficient service and communication with potential customers, partners, and/or other external contacts.
Retention period
Your personal data will be stored for as long as communication between you and us is ongoing. If the contact leads to the conclusion of an agreement, we will, as a general rule, store your personal data throughout the term of the agreement, as well as for two (2) years after the agreement has ended. However, we may store your contact information for a longer period in order to maintain and facilitate a future business relationship, follow up on previous communication between you and us, and market our products and services to you in your capacity as a representative of a potential customer or business partner. If you, or the company you represent, inform us that you will no longer serve as a contact person for the company, we will immediately delete your contact information.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group. The company that is our client or business partner (if you are a contact person).

Recipients of Customer support

TO PROVIDE CUSTOMER SUPPORT
Purpose	Categories of customer data
We process your personal data in order to communicate with you and provide customer support when you have contacted us via one of our specific support channels: support@extend.no or tel. +47 73 54 61 00	Name Contact details, e.g., phone number, address, and email address National identity number (applies only if you contact us in your capacity as a sole proprietorship) The company you represent or are employed by, which is our customer Other information you provide to us in connection with your support case
Legal purpose
Performance of a contract: If you contact us for support as a sole proprietorship, our processing of your personal data is necessary for us to fulfill our obligations under the agreement with you. Legitimate interest: If you contact us for support as a representative or employee of one of our customers, we process your personal data based on our legitimate interest in fulfilling our agreement with that customer.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement and for two (2) years after the agreement has ended. However, your personal data may be anonymized and aggregated into general statistics regarding support cases at an earlier stage. Information provided in connection with the handling of support cases may be retained for a longer period for the purpose of ongoing learning and development.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Other companies within the Confirma Group. The company that is our client (if you are a contact person). Our provider of customer service and support contact services.

Users of our quality system EQS

TO DELIVER, MAINTAIN, DEVELOP AND IMPROVE OUR QUALITY SYSTEM EQS
Purpose	Categories of personal data
We process your personal data in order to provide our quality system, EQS, to our customers—for whom you are a user—as well as to maintain, analyze, further develop, and improve our quality system based on your usage, with the aim of ensuring maximum functionality, performance, and user-friendliness in EQS.	Name User ID and account details Contact information, e.g., email address The company you represent or are employed by, which is our customer Technical information and usage data related to your use of our system (e.g., logs, device and browser information)
Legal purpose
Legitimate interest: Our processing of your personal data is based on our legitimate interest in ensuring that our system, EQS, remains secure, stable, and functional, while also continuously improving its usability for you as a user.
Retention period
As a general rule, your personal data is stored throughout the term of the agreement with the customer (through whom you are a user), as well as for a minimum of 2 years following the termination of the agreement. However, your personal data may be anonymized and aggregated—prior to this timeframe—into general statistics regarding the functionality of EQS.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. The company that is our client (through which you are a user).

Recipients of newsletters

TO SEND OUT NEWSLETTERS
Purpose	Categories of personal data
We process your personal data to manage and send you our newsletter, which contains marketing and other updates regarding our business, services, products, and other relevant activities. When we direct marketing toward you, you always have the right to object; in such cases, we will no longer process your personal data for this purpose.	Name Contact details, e.g., phone number, address, and email address Title and role National identity number (if you are a sole proprietorship) The company you represent or are employed by
Legal purpose
Performance of a contract: If you have personally chosen to subscribe to our newsletter, the processing of your personal data is necessary for us to fulfill our obligations under the agreement with you, which was entered into in connection with your registration as a subscriber. Legitimate interest: If you receive our newsletters as a representative of a company, our processing of your personal data is based on our legitimate interest in marketing our products and services to potential customers and business partners.
Retention period
If you have personally chosen to subscribe to our newsletter, we will store your personal data until you unsubscribe from such communications. If you receive our newsletters as a representative of a company, we will store your personal data for as long as we consider the company you represent to be a potential customer or business partner. If you, or the company you represent, inform us that you are no longer the contact person for that company, we will immediately delete your contact information used for newsletter distribution. If you object to our processing of your personal data for direct marketing purposes, we will immediately cease such processing.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our CRM system provider. Our provider for the distribution of newsletters. Other companies within the Confirma Group.

Applicants for jobs or internships

TO CONSIDER YOUR QUALIFICATIONS
Purpose	Categories of Personal data
We process your personal data in connection with your job application or application for an internship in order to assess your qualifications and determine whether you are a suitable candidate for a position or an internship with us.	Name Contact details, e.g., phone number, address, and email address Application documents, e.g., CV and cover letter Photos of you (if you have included these in your application) Information appearing on your LinkedIn profile
Legal purpose
Legitimate interest: We process your personal data based on our legitimate interest in evaluating applicants for jobs and internship positions, and in conducting recruitment processes with the aim of hiring or offering an internship to the candidates who best match the needs of our organization. Legal obligation: Furthermore, our processing of your personal data concerning education, professional experience, and other qualifications relevant to the position or internship in question is necessary for us to fulfill our obligations under the Equality and Anti-Discrimination Act.
Retention period
If the recruitment process results in you being offered—and accepting—a position or an internship with us, we will store your personal data for the duration of your employment or internship, and for up to one (1) year after your employment or internship has ended. In such cases, the processing of your personal data will also be governed by our internal privacy policy, which applies to individuals employed by us or those completing an internship with us. If the recruitment process does not result in an offer of a position or an internship, your data will be removed from our systems and stored in our application portal, finn.no, for one (1) year—unless otherwise agreed upon directly with you.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our provider of recruitment tools.

TO CONDUCT INTERVIEWS AND TAKE REFERENCES
Purpose	Categories of Personal Data
We process your personal data in order to, where relevant, conduct interviews and obtain references as part of our recruitment process.	Name Contact details, e.g., phone number, address, and email address Application documents, e.g., CV and cover letter Photographs of you (if you have included these in your application) Information about you provided during interviews or in connection with reference checks, e.g., statements from previous employers
Legal purpose
Legitimate interest: We process your personal data based on our legitimate interest in evaluating applicants for jobs and internship positions, and in conducting recruitment processes with the aim of hiring or offering an internship to the candidates who best match the needs of our organization. Legal obligation: Furthermore, our processing of your personal data concerning education, professional experience, and other qualifications relevant to the position or internship in question is necessary for us to fulfill our obligations under the Equality and Anti-Discrimination Act.
Retention period
If the recruitment process results in you being offered—and accepting—a position or an internship with us, we will store your personal data for the duration of your employment or internship, and for up to one (1) year after your employment or internship has ended. In such cases, the processing of your personal data will also be governed by our internal privacy policy, which applies to individuals employed by us or those completing a temporary internship with us. If the recruitment process does not result in an offer of a position or an internship, your data will be removed from our systems and stored in our application portal, finn.no, for one (1) year—unless otherwise agreed upon directly with you.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our provider of recruitment tools. Your references.

TO CONDUCT RECRUITMENT TESTS
Purpose	Categories of Personal data
We process your personal data in order to—where relevant—invite you to complete personality tests and/or case assignments, and subsequently evaluate your results as part of our recruitment process.	Name Contact details, e.g., phone number, address, and email address Application documents, e.g., CV and cover letter Photographs of you (if you have included these in your application) Information about you provided during interviews or in connection with reference checks, e.g., statements from previous employers Results from completed tests
Legal purpose
Legitimate interest: We process your personal data based on our legitimate interest in evaluating applicants for jobs and internship positions, and in conducting recruitment processes with the aim of hiring or offering an internship to the candidates who best match the needs of our organization. Legal obligation: Furthermore, our processing of your personal data concerning education, professional experience, and other qualifications relevant to the position or internship
Retention period
If the recruitment process results in you being offered—and accepting—a position or an internship with us, we will store your personal data for the duration of your employment or internship, and for up to one (1) year after your employment or internship has ended. In such cases, the processing of your personal data will also be governed by our internal privacy policy, which applies to individuals employed by us or those completing an internship with us. If the recruitment process does not result in an offer of a position or an internship, your data will be removed from our systems and stored in our application portal, finn.no, for one (1) year—unless otherwise agreed upon directly with you.
Recipients of your personal data
We share your personal data with the following recipients: Our IT providers for the systems and tools we use to operate our business. Our provider of recruitment tools. Our provider of recruitment tests.

EXTEND RETENTION PERIOD

Regardless of what is stated regarding retention periods in the tables above, we may store your personal data for a longer period if required by law, or if necessary for us to establish, exercise, or defend legal claims.

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

As a general rule, we and our suppliers process your personal data only within the EU/EEA. The exceptions to this are our case management system for inquiries received via our support channel, our LinkedIn pages, and our newsletter distribution system—in these cases, data is stored on servers in the United States. Whenever personal data is processed outside the EU/EEA, we are obligated to ensure that the transfer complies with applicable data protection legislation. We achieve this by either (1) ensuring that the recipient of the personal data is located in a country that the European Commission has deemed to provide an adequate level of protection, or (2) ensuring that the transfer is covered by appropriate safeguards, such as the standard contractual clauses adopted by the European Commission.

You can read more about which countries the European Commission has determined to provide an adequate level of protection here. If you would like to learn more about—or access—the standard contractual clauses adopted by the European Commission, you can find them here.

YOUR RIGHTS

Below is a description of the rights you have regarding our processing of your personal data. To exercise your rights, you are welcome to contact us using the contact method provided further down.

Right to withdraw consent

If our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. In such a case, we must cease the processing, provided that there is no other legal basis for the processing.

Right of access

You have the right to request information as to whether we process your personal data. If this is the case, you have the right to access information regarding the processing, including the purpose of the processing, the categories of personal data involved, and how the data is handled. You also have the right to request a copy of the personal data we process about you—a so-called data access extract. The first copy is provided free of charge.

Right to rectification

You have the right to have inaccurate personal data corrected without undue delay, and to ask us to supplement incomplete data by providing us with the correct information.

Right to object

You have the right to object at any time to our processing of your personal data in cases where the processing is based on a public interest or a legitimate interest. If you lodge such an objection, we may only continue the processing if (1) we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or (2) the processing is necessary for the establishment, exercise, or defense of legal claims.

You also have the right to object at any time to our processing of your personal data when this is done for direct marketing purposes. If you lodge such an objection, we must cease our processing.

Right to erasure (the right to be forgotten)

You have the right to request the deletion of your personal data at any time. We are required to comply with your request and delete the data in the following cases:

if the data is no longer necessary for the purposes for which it was collected;
if the processing is based on your consent, and you withdraw that consent;
if the processing is for direct marketing purposes, and you object to the data being processed for this purpose;
if you object to processing based on our legitimate interests, and there are no legitimate grounds that override your interests;
if the personal data has been processed unlawfully;
if deletion is necessary to comply with a legal obligation to which we are subject.

However, we are not obliged to delete your personal data if our processing is necessary for one of the following reasons:

to exercise the right of freedom of expression and information;
to comply with a legal obligation that requires processing and to which we are subject;
to perform a task in the public interest;
to establish, exercise, or defend legal claims.

Right to restriction of processing

You have the right to request that our processing of your personal data be restricted in the following cases:

you contest the accuracy of the personal data, for the period it takes us to verify this;
the processing is unlawful, and you object to the erasure of the personal data and request a restriction on its use instead;
we no longer need the personal data for the purposes of our processing, but you require them for the establishment, exercise, or defense of legal claims;
you have objected to our processing of your personal data (as described under the heading above), for the period it takes us to verify whether our grounds for processing override your interests, rights, and freedoms.

Right to dataportability

If our processing of your personal data is based on your consent or an agreement with you, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transfer this data to another data controller, or to request that we transfer the data on your behalf, provided that this is technically feasible.

Right to lodge a complaint with the supervisory authority

If you have any complaints regarding our processing of your personal data, you have the right to lodge a complaint with the competent supervisory authority. In Norway, this is the Norwegian Data Protection Authority. You can read more about the Norwegian Data Protection Authority and how to proceed on their webisite.

OUR CONTACT INFORMATION

If you wish to get in touch with us regarding our processing of your personal data, you are welcome to do so at: firmapost@extend.no

You are also welcome to contact Extend’s designated Data Protection Officer: Tove Selbekk, Tove@extend.no

This privacy policy was established by Extend on October 25, 2026.