
Privacy Policy
About the Privacy Policy
This Privacy Policy explains how Fair Collection AS (“Fair”) processes your personal data in connection with its debt collection activities. It also describes your rights regarding the processing of your personal data and how you can exercise those rights. It is therefore important that you read this Privacy Policy carefully.
Fair operates in Norway, and Norwegian legislation governing the processing of personal data applies to our processing activities.
The most important regulations governing Fair’s processing of personal data are:
The General Data Protection Regulation (GDPR)
The Norwegian Personal Data Act
The industry standard for processing personal data in the Norwegian debt collection industry
Data Controller
Fair Collection AS, organisation number 920 999 360, is the data controller for the personal data we process.
What Personal Data Do We Process?
To fulfil the purposes of our processing activities, we process the following categories of personal data:
Name
Address information
Date of birth / National identity number
Contact details (e.g. email address and telephone number)
Personal information (e.g. details about your life situation relevant to the case)
Financial information (e.g. income, expenses, other debt)
Purchase information (e.g. what goods were ordered, how they were ordered, delivery address)
Invoice information (e.g. invoice amount, customer number, order number)
Payment information (details of payments made)
IP address
Bank account details
Criminal convictions and fines (if received from public authorities, for example in connection with debt settlement arrangements)
Information about a legal guardian, if you have one acting on your behalf
As a rule, we do not process special categories of personal data (“sensitive personal data”), such as ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or sexual orientation. Such information is only processed with your consent or where necessary to establish, exercise, or defend legal claims.
Date of birth / national identity number is collected to ensure that the claim is enforced against the correct person.
Where Do We Collect Information From?
Most information is received from our client that has an outstanding claim and transfers the matter to us as a debt collection assignment. We also collect information from third parties, such as public registers, public authorities, and companies that provide personal data.
Examples include:
Name, address, identity number, contact details, invoice details, and payment information from our clients
Address and contact information from public registers to ensure accuracy
Financial information from credit agencies and authorities, such as income, expenses, other liabilities, payment remarks, and debt balances
National identity number from public registers
If any information we hold is incorrect, we ask that you log in to the portal using BankID and update it. This may also help resolve the matter in the best possible way.
Purpose of Processing, Legal Basis, and Retention Period
Purpose 1:
Debt Recovery or Effective Claim Protection Through Extrajudicial or Legal Collection
Processing Activities
Collection of information
Identification and age verification
Analysis of how to process the case effectively, including review of previous payment history and financial data
Filing conciliation board complaints, enforcement petitions, bankruptcy petitions, or other legal measures
Debt settlement arrangements
Payment handling
Address verification
Sending debt collection letters and other correspondence
Telephone contact
Storage
Verification of contact details
Transfer of information to clients
Transfer of information to authorities
Legal Basis
Performance of a task carried out in the public interest under GDPR Article 6(1)(e)
Debt collection activities are regulated by the Norwegian Debt Collection Act of 13 May 1988
Consent / defence of legal claims (only for special categories of personal data)
Retention Period
Standard debt collection cases: retained for 3 years after full payment
Incorrectly sent / withdrawn cases: retained for 1 year after closure
Unpaid cases: retained for 1 year after the statute of limitations date
Purpose 2:
Evaluation, Development, Testing, Troubleshooting, and Maintenance of Systems and Procedures
Personal data may also be used for statistical purposes.
Processing Activities
Analysis of data used for these purposes
De-identification or pseudonymisation of data
Legal Basis
Public interest under GDPR Article 6(1)(e)
Legitimate interest in delivering effective and secure services, meeting GDPR security requirements, and fulfilling ICT regulatory requirements
Retention Period
Same as above.
Purpose 3:
Compliance with Accounting Obligations
Processing Activities
Storage and disclosure of data necessary for accounting obligations
Legal Basis
Legal obligation
Retention Period
Retained for 5 years in accordance with accounting legislation.
Who Do We Share Your Data With?
In some cases, we share personal data with companies and public authorities used to fulfil the purposes described above.
We do not share data with companies that fail to comply with applicable data protection laws.
We do not sell your personal data to third parties, nor disclose it for direct marketing, telemarketing, opinion polling, or market research.
Categories of Recipients
Data Processors
Some suppliers process personal data on our behalf. These processors may only use the information according to our instructions.
All processors are assessed for adequate security, and we sign data processing agreements with them.
Independent Data Controllers
We may also share data with companies or authorities such as:
Our clients
Conciliation boards
Enforcement authorities
Tax authorities
These entities act as independent data controllers and are responsible for their own privacy notices.
Where Is Your Data Processed?
We aim to process your data within the EU/EEA. If data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as:
Adequacy decisions
Standard contractual clauses
Binding corporate rules
Approved codes of conduct
Other suitable safeguards
Is Your Data Safe With Us?
We use modern technology and all necessary technical and organisational measures to protect your personal data against unauthorised access, transfer, destruction, or other unlawful processing.
Security measures include:
Firewalls
Encryption
Secure IT environments
Access controls
Employee training
Supplier oversight
Only employees who need the information to perform their work have access. All employees have signed confidentiality agreements.
Your Rights
Right of Access
You have the right to know whether we process your personal data and request information about:
Why we process it
What categories of data we process
Who receives the data
How long we store it
Your rights
Where we obtained the data
Whether automated decision-making/profiling is used
How data is protected if transferred outside the EEA
You can access your information by logging into our portal with BankID.
Right to Rectification
If your information is incorrect (for example, you changed name or address), you can update it via the portal using BankID.
Right to Erasure
You may request deletion if we process your data unlawfully or longer than necessary. However, we may need to retain data where required by law or for legal claims.
Right to Restriction of Processing
You may request restriction if:
You dispute the accuracy of the data
Processing is unlawful
Processing is no longer necessary
You object to processing
Right to Data Portability
You may receive data you have provided to us in a structured, commonly used, machine-readable format and transfer it to another controller, where legally applicable.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time.
Right to Object
You may object to processing based on public interest or legitimate interests, including profiling. We may continue only if compelling legitimate grounds exist or for legal claims.
Questions or Complaints
If you have questions or wish to complain about our processing of your personal data, contact us via the Customer Portal / Privacy section.
You may also complain to the Norwegian Data Protection Authority (Datatilsynet):
If dissatisfied with our response, you may submit a complaint directly to Datatilsynet.
Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy, including due to legal changes. We recommend reviewing it regularly.
Last revised: 15 May 2019
Information About Cookies
Cookies are automatically stored on your computer. A cookie is a small text file stored on your device. Cookies are necessary for the website to function, but they also provide information about how the site is used so we can improve user experience.
You may choose to disable cookies, but the website may not function optimally if cookies are rejected.
We use cookies for statistics and to optimise content on the website.