EOR Partners — Privacy Policy
Effective date: 16 September 2026
Version: 1.0
This policy explains how Orizon AS handles personal data when you use EOR Partners at eor.partners (the "Service"). It is written to be read, not skimmed past. If anything is unclear, ask us — contact details are at the end.
1. Who is responsible
The controller of your personal data is:
Orizon AS
Organisation number 936 219 705
Bryggegata 24, 4514 Mandal, Norway
havard.dalen@orizonstudio.no
We are established in Norway and process personal data under the EU General Data Protection Regulation (GDPR) as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven).
2. What the Service is, and why that matters here
EOR Partners is a business tool. Firms record which countries they operate in, on what basis, and at what price, and share that with partner firms they choose to connect with. Almost everything in the Service is business data about companies, not personal data about people.
The personal data we process is essentially about you as a user: the person signing in on behalf of a firm. This policy is about that data.
3. What personal data we process
Account data. Your name, work email address, the firm you belong to, your role in it (owner or viewer), and a securely hashed version of your password. If you sign in by emailed link, we process the fact and time of that sign-in.
Firm data you enter. Firm name, domain, website, description and logo. This is business data, but where a firm is a sole trader it may identify a person.
Content you enter. Coverage, rankings, notes and pricing. This should be business information only. We ask you not to put personal data about individuals into free-text fields. If you do, we process it as part of the content under the same rules.
Invitations. When an owner invites a colleague, we process the invitee's email address so we can send the invitation. The invitation names the firm and the person who sent it.
Usage and technical data. Sign-in times, the pages you use, your IP address, browser type and similar information generated automatically when you use the Service, plus an audit log of changes to coverage data recording who changed what and when.
Communications. What you write to us when you contact us.
We do not collect anything for advertising, we do not buy data about you, and we do not use analytics or tracking beyond what the Service needs to function.
4. Why we process it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: your account, your firm's data, connections, and showing data to the firms you connect with | Performance of a contract, the Terms of Service (Art. 6(1)(b)) |
| Sending invitations, sign-in links and password resets | Performance of a contract; for invitees, our and the inviting firm's legitimate interest in letting colleagues join (Art. 6(1)(f)) |
| Security: detecting misuse, protecting accounts, keeping an audit trail of data changes | Legitimate interest in running a secure service that firms can trust with commercially sensitive data (Art. 6(1)(f)) |
| Understanding how the Service is used so we can improve it | Legitimate interest (Art. 6(1)(f)), using aggregated data wherever possible |
| Telling you about material changes to the Service or these terms | Performance of a contract |
| Complying with law and resolving disputes | Legal obligation (Art. 6(1)(c)) and legitimate interest |
We do not send marketing. If that ever changes we will ask first.
5. Who sees your data
Other firms in the Service. The Service exists to share business data between firms that have chosen to connect. Your name and work email are visible to members of your own firm. To firms you connect with, you may appear as the person who made a change or sent a request. The Service's visibility rules — set out in the Terms of Service — govern exactly what other firms can see, and we enforce them at the database level, not just in the interface.
Our processors. We use a small number of service providers to run the Service. They act only on our instructions, under contracts that meet GDPR requirements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Data hosted in Frankfurt, Germany (EU) |
| JBOX (jboxai.com) and its hosting provider Fly.io | Application hosting | EU and/or United States |
| Postmark (ActiveCampaign, LLC) | Sending transactional email: sign-in links, password resets, invitations | United States |
AI assistants you connect. You may connect an AI assistant — such as Claude, Codex or Cursor — to act on your behalf in the Service. When you do, the data that assistant reads or writes passes to the company that provides it, under your own agreement with that company, not under this policy. The assistant acts with exactly your permissions and no more; you approve the connection explicitly; you and your firm's owners can see every connected assistant and revoke it at any time; and every change an assistant makes is recorded with the assistant's name. Your firm's owners decide whether assistants may be connected at all.
Legal requirements. We will disclose data where the law requires it, and will tell you if we lawfully can.
Business transfer. If Orizon or the Service is sold or merged, your data may transfer to the new owner under this policy. We would tell you.
We never sell personal data, and we do not share it with advertisers.
6. Transfers outside the EEA
Your account and content data lives in the EU. Two of our processors are US companies. Where personal data is transferred to the United States we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The personal data involved in those transfers is limited: for email delivery, your email address and the content of the system message; for hosting, technical request data.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and firm data | For as long as your firm has an account, then deleted within 30 days of closure |
| Content you enter | Same as above. Notes other firms hold about your firm are their data and stay with them |
| Audit log of coverage changes | 12 months, then deleted |
| Technical and access logs | Up to 90 days |
| Backups | Rolling, overwritten within 30 days |
| Communications with us | For as long as needed to deal with your enquiry, then up to 3 years for our records |
Where the law requires us to keep something longer — for example accounting records once fees apply — we keep it only for that period and only for that purpose.
8. How we protect it
- Every read and write is checked against access rules inside the database, so a firm cannot see another firm's data even if a bug exists in the interface.
- Data is encrypted in transit and at rest.
- Passwords are hashed, never stored in plain text, and checked against known-breached password lists.
- Emailed sign-in and reset links are single-use and expire.
- Access to production systems is limited to those who need it.
No system is perfectly secure. If we become aware of a breach affecting your personal data we will tell you and the Norwegian Data Protection Authority as the law requires.
9. Your rights
Under the GDPR you may:
- access the personal data we hold about you;
- have it corrected if it is wrong;
- have it erased, where there is no good reason for us to keep it;
- restrict how we use it in certain circumstances;
- receive it in a portable format;
- object to processing based on legitimate interests.
Most account data you can see and change yourself in the Service. For anything else, write to us at the address below. We will respond within one month.
You may also complain to the Norwegian Data Protection Authority: Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, datatilsynet.no. We would appreciate the chance to address your concern first.
10. Cookies
The Service uses only the cookies it needs to keep you signed in and secure. We do not use advertising, analytics or tracking cookies. Because these cookies are strictly necessary, we do not ask for consent to set them.
11. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly collect their data.
12. Changes to this policy
We will update this policy when the Service or the law changes. For material changes we will tell you by email and in the Service before they take effect. The version and effective date at the top tell you which version you are reading.
13. Contact
Orizon AS
Bryggegata 24, 4514 Mandal, Norway
havard.dalen@orizonstudio.no