Skip to main content

Privacy Policy

Last updated: 17 June 2025 · Version 1.0

Table of content

  • Introduction
  • Collection of personal data, purpose and basis
  • Use of personal data for marketing and personalisation; purpose and basis for processing
  • Cleansing and enrichment of data
  • Retention and storage of personal data
  • Sharing of personal data
  • Your rights
  • Contact information

1. Introduction

This privacy policy explains how and when we collect, use and share information about you, and which legal basis for processing applies to the processing.

Controllership

Ahead Group Norway AS (org. no. 921 186 207) consists of the co-located agencies Oculos AS, 11:11 (Elleve Elleve AS), Bloom Oslo AS, Ahead Group Consulting and WergelandApenes AS. The companies operate under a common privacy framework and have established common control activities and routines. Controllership will vary depending on the context and purpose of the processing, but where the companies collaborate on services or infrastructure, controllership is exercised jointly or on behalf of one another in accordance with established internal guidelines.

Oculos AS (org. no. 984 459 564) is the controller for the processing of user data in the technology services Trigg and Oculos Dialog.

We mainly process information about you in the following cases

  • You have sent us an inquiry
  • You represent one of our customers
  • You have signed up for or attended one of our events
  • You take part in our competitions
  • You subscribe to our newsletter
  • You have applied for a job with us
  • You have contacted one of our employees by email or have a business relationship with Oculos
  • You are a partner or supplier
  • You visit our websites
  • You use our technology services (Trigg and Oculos Dialog)

We may also receive information about you from others in the following cases

  • We provide services to one of our customers where your personal data is registered
  • We assist our customers with advice or assessments of the personal data they have collected
  • When we collaborate with partners on joint projects where we have shared controllership, or are a data processor.

We mainly use personal data in the following contexts

  • Direct marketing
  • Profiling and analysis
  • Digital advertising with personal matching
  • Digital advertising and third-party tools
  • Handling of and communication about our events
  • Customer follow-up and sales contexts
  • Preventing misuse of our services
  • Data cleansing
  • Where necessary in connection with agreements entered into

2. Collection of personal data, purpose and basis

You have sent us an inquiry

Inquiries through our websites, or to one of our account managers, may result in us creating a contact card in order to follow up the process with you and your company for as long as this is relevant. Should the relationship not develop into a customer relationship, we will delete this data after a reasonable period of time in accordance with Ahead Group's instructions for the storage and deletion of personal data.

Information we collect: Name, telephone number, email address, position and employer.

Purpose: Dialogue on the basis of the inquiry.

Legal basis: GDPR Article 6(1)(f). The processing is necessary in order to take steps at the request of the data subject.

You represent one of our customers

If you represent one of our customers, we store data about you in connection with the customer relationship. The basis for this processing is your role with your employer and the agreement entered into between the companies.

Information we collect: Name, telephone number, email address, position, role and employer.

Purpose: Order processing, delivery, invoicing and customer service.

Legal basis: GDPR Article 6(1)(b). Performance of a contract to which you are a party.

You have signed up for or attended one of our events or competitions

When you take part in our events or competitions, we process the information you provide in order to administer your participation. Information about allergies is treated confidentially and deleted shortly after the event. If we share participant lists with co-organisers, we will inform you of this, as well as the purpose, at registration.

Information we collect: Name, telephone number, email address, position, employer, food preferences, allergies and other considerations we need to take that you provide.

Purpose: Carrying out the event and contact afterwards.

Legal basis: GDPR Article 6(1)(b). In cases where we share customer data with co-organisers for the purpose of contacting you afterwards, the basis will be consent; GDPR Article 6(1)(a).

You subscribe to our newsletter

If you subscribe to our newsletters, it will be necessary for us to store information in order to send you newsletters, as well as information about how you interact with our newsletters. This includes which links you click on and whether you open the newsletter.

The legal basis for the processing is GDPR Article 6(1)(a).

You have applied for a job with us

We process job applications primarily through recruitment agencies and their portals, and they will be the controller. In cases where we nevertheless receive job applications by email, these will be deleted from the email system and stored temporarily in SharePoint for as long as is relevant and in accordance with Ahead Group's instructions for the storage and deletion of personal data, with access only for those for whom it is natural, and with the applicant's consent. The legal basis for the processing is GDPR Article 6(1)(f).

Bloom processes job applications to Bloom Activation through the TeamTailor portal.

You have contacted one of our employees by email

We use email to carry out our work tasks. Emails we have received are to be deleted when it is no longer necessary to store them. In practice, this means that such emails should normally not be stored for longer than approximately one year without a basis for doing so. A basis for storing them longer may be sales processes, existing customer or partner relationships or other matters relevant to our daily work.

We ask that personal data not be sent to us unencrypted by email beyond the personal data that is naturally sent in plain text when sending an email. We do not permit the receipt of large amounts of data through unencrypted solutions such as email. Contact your contact person if you need to send large amounts of personal data to us.

We scan all incoming and outgoing email for viruses and malware in order to ensure the integrity, confidentiality and availability of our systems that process personal data.

The legal basis and the information we collect will depend on the situation, context and purpose.

You are a partner or supplier

Our instruction is to collect and process only personal data that is strictly necessary for the purpose.

Information we collect: Name, job title, work address, email address and telephone number. This may also include financial information necessary for transactions and accounting.

Legal basis: GDPR Article 6(1)(b), (c) or (f), depending on context and purpose.

You have previously been a customer or supplier of ours

Data relevant to former customer relationships is stored for the period that this is either required by legislation in connection with accounting, or to the extent that this is governed by agreements between the companies that have entered into an agreement with us. To the extent that documentation is necessary after the customer relationship has ended, we retain this data. This also applies to partnerships or supplier relationships.

Legal basis: GDPR Article 6(1)(f) and, where required by law, (c).

You visit our websites

We collect information about how our websites are used in order to understand traffic patterns and improve the user experience. This includes, among other things, which pages are visited, the time of visits and general technical information about the browser and device. We use analytics tools that do not store or read data from your device unless you have given consent to this. Where possible, we use techniques such as IP address anonymisation and data aggregation to reduce the privacy impact. The use of cookies and analytics tools is also regulated by the Norwegian Electronic Communications Act (ekomloven). This means that we only set cookies or similar technology for analytics purposes if you have given consent, unless it concerns technically necessary functions. Since we operate several different websites, we refer to the respective cookie statement that applies to each domain. There you will find more information about which cookies are used, what they are used for, and how you can manage your choices.

Some of our websites use cookies to improve your user experience and to collect data about how you interact with our website. Cookies are small text files that are stored on your device when you visit our website, and they help us remember your preferences and previous actions.

You can at any time choose to disable cookies through the settings in your browser. Please note, however, that this may affect the functionality of the website.

The cookies we use can be categorised as follows:

  • Necessary/technical cookies: These are essential for you to be able to navigate the website and use its features, such as logging in or remembering what is in your shopping cart. Their use is based on our legitimate interest in ensuring stable and secure operation of the website.
  • Functional cookies: These cookies improve the user experience by remembering settings and choices, such as language preferences or customisations of the interface. They are not strictly necessary for the website to function, but make its use smoother and more tailored.
  • Analytics cookies: These cookies help us understand and improve our website by collecting information about how visitors use it. Your consent to these is obtained through a consent pop-up.
  • Advertising cookies and sharing with third parties: These cookies are used for targeted advertising, to share information with third parties in order to optimise advertisements, and for analysis. These third parties are Google, Facebook and LinkedIn. Your consent to these is obtained through a consent pop-up. Without this consent, you will still be able to see advertisements from us on other platforms, but they will not be based on your personal data from our websites.

Note: You may withdraw your consent to the use of cookies at any time. We are obliged to respect your choices and to protect your personal information in accordance with applicable data protection laws.

The legal basis for processing is GDPR Article 6(1)(f) for necessary cookies, and for analytics, advertising and third-party cookies it is Article 6(1)(a).

Forms and registration solutions

On our websites it is possible to use various registration forms, either in connection with events, booking services or to be contacted. If you provide us with data here, we will process personal data about you to the extent necessary for the above-mentioned needs. We process the data that you provide in the form. In addition, one of our form solutions also provides location and origin data. This, however, is data that we do not store or process.

The legal basis for processing is GDPR Article 6(1)(b).

You use the technology services Trigg or Oculos Dialog

Trigg

Trigg Loyalty receives and processes data on behalf of our users and functions as an intermediary layer for facilitating bonuses, campaigns and coupons. Oculos AS is responsible for Trigg and is a data processor on behalf of suppliers and users of Trigg. The users are the controllers. The types of data processed are transaction data and customer identifiers.

Oculos is the controller with regard to user data. User data is not used for any other purpose. User data consists of name, mobile number, email address and role. If you register in our contact form for a demo, we will only use this information to contact you. The legal basis for processing is GDPR Article 6(1)(b).

Oculos Dialog

Oculos Dialog is a CRM and marketing automation platform where we process data on behalf of our customers, with customer profiles and associated data, segmentation tools, the setup and sending of email and SMS campaigns, as well as automations. Oculos AS is responsible for Oculos Dialog and is a data processor on behalf of suppliers and users of Oculos Dialog. The users are the controllers. Oculos is the controller with regard to user data. User data consists of name, mobile number, email address and role. User data is not used for any other purpose. The legal basis for processing is GDPR Article 6(1)(b).

Data security

To secure the data on our loyalty platforms, we implement several important security measures. First and foremost, access to our system requires the use of specific API keys. This means that only approved units and services that have been assigned a unique key can connect to our servers. In addition, we practise strict whitelisting of IP addresses. This means that only pre-approved IP addresses are given access to our systems, which significantly reduces the risk of unauthorised access and security breaches. These measures are in line with ISO 27001 standards, which reflect our commitment to maintaining the highest level of data security.

3. Use of personal data for marketing and personalisation; purpose and basis for processing

Direct marketing

If you are a customer of ours, we may send you newsletters based on the customer relationship. If you are not a customer, we send newsletters and other digital communication based on the consents we have obtained from you.

Purpose: To inform you about our services and to provide professional advice and tips.

Legal basis: The legal basis for processing is GDPR Article 6(1)(f), in accordance with Section 15(3) of the Norwegian Marketing Control Act, for customers, and (a) for other subscribers.

Profiling and analysis

In some contexts, we wish to offer a more personal and tailored experience within marketing, communication and our service offerings. To achieve this, we may use information such as your name, contact details, your customer relationship with us, your use of our services, and other information you have shared with us. This practice, known as profiling, will only take place when it is reasonable to expect it. Our goal is to carry out thorough analyses and segmentation in order to better understand your interests and needs. This allows us to identify the most relevant target groups for our communication, so that we can offer you the most valuable and tailored experience.

The legal basis for the processing is GDPR Article 6(1)(f) for customers and participants at our events. For others, the basis will be GDPR Article 6(1)(a).

You may request a restriction of profiling based on your customer data, and opt out in situations where this is possible.

Digital advertising with customer matching

Some of our companies offer digital advertising based on your CRM profile with us. If you have agreed to digital advertising, we will be able to advertise in digital networks by performing so-called customer list matching, with email and mobile number as the only data points. If you later choose to withdraw your consent to digital advertising, please note that there may be delays before the change takes effect in our networks.

We may use lookalike analysis to identify potential new customers with similar interests and needs to our existing members. The purpose of the processing is to reach new customers and expand our customer base, and the basis for the processing is GDPR Article 6(1)(f), legitimate interest. This applies only to members who have consented to digital advertising based on their profile; lookalike analysis is regarded as a natural extension of this purpose and, in addition, is not directly targeted at the data subject.

We currently advertise in the following networks: Meta (Facebook) and LinkedIn.

The legal basis for the processing is GDPR Article 6(1)(a).

If you wish to withdraw your consent to digital advertising, this can be done via the contact addresses provided on the respective companies' websites.

Digital advertising and third-party tools

On some of our websites, we use tools for visitor analytics and targeted advertising. The purpose is to understand usage patterns, improve content and show more relevant advertisements in digital channels.

Such tools use cookies and similar technology, and the processing only takes place where you have given valid consent, in accordance with the Norwegian Electronic Communications Act (ekomloven) and Article 6(1)(a) of the General Data Protection Regulation.

Which tools are used on each website, and how you can manage your choices, is set out in the respective cookie statement and consent solution on the domain in question.

Market research, focus groups and interviews

From time to time, we conduct market research to gain insight into user behaviour, preferences and needs. This may take the form of surveys, interviews or focus groups – both on our own behalf and on behalf of customers we assist.

Participation is voluntary, and you will receive clear information about the purpose, the use of data and the degree of anonymity before you choose whether to participate.

Basis for processing: When the survey involves the processing of personal data, this takes place on the basis of your consent (GDPR Art. 6(1)(a)).

If a survey is not fully anonymous and you wish to withdraw your responses, you can contact us. We will then do what is possible to delete or anonymise your information, unless the data has already been aggregated or anonymised.

4. Cleansing and enrichment of customer data

Data cleansing

Pursuant to Article 5(1)(d) of the General Data Protection Regulation, personal data must be accurate and kept up to date, and measures must be taken accordingly. We therefore update, from time to time, the contact data in our recipient database with information available from public registers where a valid basis for processing exists.

The legal basis for the processing is GDPR Article 6(1)(f).

Data enrichment

As a starting point, we do not enrich with any information other than that which our customers have provided themselves. However, in cases where we lack primary contact data for customers, we may enrich the customer profile with entirely basic data – name, mobile number and role at the customer (general manager or board position) – with information available from public registers.

The legal basis for the processing will then be GDPR Article 6(1)(f).

5. Retention and storage (deletion) of personal data

Our systems are primarily operated on servers within the EEA, but in certain cases data may be processed outside the EEA, for example in connection with system maintenance or support services provided by our external suppliers.

When we process personal data on behalf of our customers, this always takes place in accordance with a data processing agreement between the parties. In cases where data is processed outside the EEA, we require that the data processor either:

  • is certified under the EU-US Data Privacy Framework (DPF), or
  • has entered into the European Commission's Standard Contractual Clauses for the transfer of personal data (SCCs), with the necessary supplementary measures.

We regularly assess our data processors and transfer mechanisms to ensure that your information is processed in accordance with applicable data protection legislation.

Deletion

We do not store personal data for longer than necessary. This is assessed on the basis of the purpose of the processing, any statutory requirements, and our internal deletion strategy.

Ahead Group has established common guidelines and routines for the storage and deletion of personal data. All companies in the group are obliged to comply with these, and regular checks and spot checks are carried out to ensure compliance.

If you would like more information about how long your information is stored in a specific context, you can contact the company in question. See the contact information in section 8.

6. Sharing of personal data

We do not share your personal data with others unless there is a lawful basis for such sharing. Where we use data processors to process personal data on our behalf, we enter into the necessary agreements to safeguard information security at every stage of the processing. If you would like further information about which systems are used in a specific company or context, you can contact the company in question directly. Contact information can be found in section 8.

7. Your rights

You have the following rights under the GDPR:

  • Access: You can request a copy of the personal data we process about you (Art. 15).
  • Rectification: You can ask us to correct inaccurate or incomplete information (Art. 16).
  • Erasure: You can request the erasure of personal data that is no longer necessary (Art. 17).
  • Restriction of processing: You can ask us to restrict the processing of your information in certain situations (Art. 18).
  • Data portability: You can request to receive personal data you have provided to us in a structured, machine-readable format (Art. 20).
  • Objection to processing: You can object to processing based on legitimate interest or to direct marketing (Art. 21).
  • Automated decisions and profiling: You have the right not to be subject to a decision based solely on automated processing, if this has legal or similarly significant consequences for you (Art. 22).

8. Contact us

If you have any questions about this privacy policy, you can contact the Privacy Manager at Ahead Group Norway, Jørn Eriksson, at jorn.eriksson@oculos.no.

You can also use the contact information provided on the respective companies' contact pages.

If your inquiry concerns processing we carry out on behalf of our many customers, we ask that you contact them first, and they will then contact us in accordance with our agreements. This ensures that your inquiry is handled as quickly as possible.