top of page

Privacy Policy

About the Privacy Policy

This Privacy Policy explains how Fair Collection AS (“Fair”) processes your personal data in connection with its debt collection activities. It also describes your rights regarding the processing of your personal data and how you can exercise those rights. It is therefore important that you read this Privacy Policy carefully.


Fair operates in Norway, and Norwegian legislation governing the processing of personal data applies to our processing activities.


The most important regulations governing Fair’s processing of personal data are:

  • The General Data Protection Regulation (GDPR)

  • The Norwegian Personal Data Act

  • The industry standard for processing personal data in the Norwegian debt collection industry


Data Controller

Fair Collection AS, organisation number 920 999 360, is the data controller for the personal data we process.


What Personal Data Do We Process?

To fulfil the purposes of our processing activities, we process the following categories of personal data:

  • Name

  • Address information

  • Date of birth / National identity number

  • Contact details (e.g. email address and telephone number)

  • Personal information (e.g. details about your life situation relevant to the case)

  • Financial information (e.g. income, expenses, other debt)

  • Purchase information (e.g. what goods were ordered, how they were ordered, delivery address)

  • Invoice information (e.g. invoice amount, customer number, order number)

  • Payment information (details of payments made)

  • IP address

  • Bank account details

  • Criminal convictions and fines (if received from public authorities, for example in connection with debt settlement arrangements)

  • Information about a legal guardian, if you have one acting on your behalf


As a rule, we do not process special categories of personal data (“sensitive personal data”), such as ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or sexual orientation. Such information is only processed with your consent or where necessary to establish, exercise, or defend legal claims.


Date of birth / national identity number is collected to ensure that the claim is enforced against the correct person.


Where Do We Collect Information From?

Most information is received from our client that has an outstanding claim and transfers the matter to us as a debt collection assignment. We also collect information from third parties, such as public registers, public authorities, and companies that provide personal data.


Examples include:

  • Name, address, identity number, contact details, invoice details, and payment information from our clients

  • Address and contact information from public registers to ensure accuracy

  • Financial information from credit agencies and authorities, such as income, expenses, other liabilities, payment remarks, and debt balances

  • National identity number from public registers


If any information we hold is incorrect, we ask that you log in to the portal using BankID and update it. This may also help resolve the matter in the best possible way.


Purpose of Processing, Legal Basis, and Retention Period


Purpose 1:

Debt Recovery or Effective Claim Protection Through Extrajudicial or Legal Collection


Processing Activities

  • Collection of information

  • Identification and age verification

  • Analysis of how to process the case effectively, including review of previous payment history and financial data

  • Filing conciliation board complaints, enforcement petitions, bankruptcy petitions, or other legal measures

  • Debt settlement arrangements

  • Payment handling

  • Address verification

  • Sending debt collection letters and other correspondence

  • Telephone contact

  • Storage

  • Verification of contact details

  • Transfer of information to clients

  • Transfer of information to authorities


Legal Basis

  • Performance of a task carried out in the public interest under GDPR Article 6(1)(e)

  • Debt collection activities are regulated by the Norwegian Debt Collection Act of 13 May 1988

  • Consent / defence of legal claims (only for special categories of personal data)


Retention Period

  • Standard debt collection cases: retained for 3 years after full payment

  • Incorrectly sent / withdrawn cases: retained for 1 year after closure

  • Unpaid cases: retained for 1 year after the statute of limitations date


Purpose 2:

Evaluation, Development, Testing, Troubleshooting, and Maintenance of Systems and Procedures

Personal data may also be used for statistical purposes.


Processing Activities

  • Analysis of data used for these purposes

  • De-identification or pseudonymisation of data


Legal Basis

  • Public interest under GDPR Article 6(1)(e)

  • Legitimate interest in delivering effective and secure services, meeting GDPR security requirements, and fulfilling ICT regulatory requirements


Retention Period

Same as above.


Purpose 3:

Compliance with Accounting Obligations


Processing Activities

  • Storage and disclosure of data necessary for accounting obligations


Legal Basis

  • Legal obligation


Retention Period

  • Retained for 5 years in accordance with accounting legislation.


Who Do We Share Your Data With?

In some cases, we share personal data with companies and public authorities used to fulfil the purposes described above.


We do not share data with companies that fail to comply with applicable data protection laws.

We do not sell your personal data to third parties, nor disclose it for direct marketing, telemarketing, opinion polling, or market research.


Categories of Recipients

Data Processors

Some suppliers process personal data on our behalf. These processors may only use the information according to our instructions.


All processors are assessed for adequate security, and we sign data processing agreements with them.


Independent Data Controllers

We may also share data with companies or authorities such as:

  • Our clients

  • Conciliation boards

  • Enforcement authorities

  • Tax authorities


These entities act as independent data controllers and are responsible for their own privacy notices.


Where Is Your Data Processed?

We aim to process your data within the EU/EEA. If data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as:

  • Adequacy decisions

  • Standard contractual clauses

  • Binding corporate rules

  • Approved codes of conduct

  • Other suitable safeguards


Is Your Data Safe With Us?

We use modern technology and all necessary technical and organisational measures to protect your personal data against unauthorised access, transfer, destruction, or other unlawful processing.


Security measures include:

  • Firewalls

  • Encryption

  • Secure IT environments

  • Access controls

  • Employee training

  • Supplier oversight


Only employees who need the information to perform their work have access. All employees have signed confidentiality agreements.


Your Rights

Right of Access

You have the right to know whether we process your personal data and request information about:

  • Why we process it

  • What categories of data we process

  • Who receives the data

  • How long we store it

  • Your rights

  • Where we obtained the data

  • Whether automated decision-making/profiling is used

  • How data is protected if transferred outside the EEA


You can access your information by logging into our portal with BankID.


Right to Rectification

If your information is incorrect (for example, you changed name or address), you can update it via the portal using BankID.


Right to Erasure

You may request deletion if we process your data unlawfully or longer than necessary. However, we may need to retain data where required by law or for legal claims.


Right to Restriction of Processing

You may request restriction if:

  • You dispute the accuracy of the data

  • Processing is unlawful

  • Processing is no longer necessary

  • You object to processing


Right to Data Portability

You may receive data you have provided to us in a structured, commonly used, machine-readable format and transfer it to another controller, where legally applicable.


Right to Withdraw Consent

Where processing is based on consent, you may withdraw consent at any time.


Right to Object

You may object to processing based on public interest or legitimate interests, including profiling. We may continue only if compelling legitimate grounds exist or for legal claims.


Questions or Complaints

If you have questions or wish to complain about our processing of your personal data, contact us via the Customer Portal / Privacy section.


You may also complain to the Norwegian Data Protection Authority (Datatilsynet):

http://www.datatilsynet.no


If dissatisfied with our response, you may submit a complaint directly to Datatilsynet.


Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy, including due to legal changes. We recommend reviewing it regularly.


Last revised: 15 May 2019


Information About Cookies

Cookies are automatically stored on your computer. A cookie is a small text file stored on your device. Cookies are necessary for the website to function, but they also provide information about how the site is used so we can improve user experience.


You may choose to disable cookies, but the website may not function optimally if cookies are rejected.

We use cookies for statistics and to optimise content on the website.

bottom of page