Utkast. Den endelige avtalen kvalitetssikres av en som kan GDPR.
The company that orders the calendar (data controller) and adventlig, a Norwegian sole proprietorship (data processor).
To deliver the advent calendar to the team in December and an anonymous summary to the leader in January.
Names and emails of the participants and the leader, answers on the doors, photos and video links the company shares, and answers to anonymous questions with no link to people.
Supabase (EU region), Vercel and an email service. The company is told before new sub-processors are used.
Login with a code by email. Only people on the leader’s list can get in. Each team only sees its own calendar. Anonymous answers are stored without names.
The data processor notifies the company without undue delay if personal data goes astray.
All data is deleted on 28 February 2027. Forms and photos from companies that do not order are deleted after 30 days.