Privacy notice

Controller and contact

Kystservice & Drone AS (organisation no. 936 441 246), Fitjar, Norway, is the controller for personal data processed through NEREVIK. Privacy questions and rights requests can be sent to Steffen@valvik-kystdrone.com.

Data we process

• Account identifiers supplied through sign-in
• Contact and organisation details
• Operation scopes, locations and uploaded files
• Supplier capability, equipment and verification documents
• Energy profile, operational emissions evidence and calculated readiness scores
• Technical logs required for security and traceability
• Website statistics after consent: visited page, time, referrer domain, country, device category and language

Purposes and legal basis

We process data to provide requested marketplace services, manage accounts and submissions, qualify suppliers, communicate about operations, secure the platform and comply with legal obligations. Depending on the activity, the basis is performance of a contract or requested pre-contract steps, legitimate interests, consent, or legal obligation.

Optional website statistics are processed only after consent. The visitor identifier is random and stored as a secure first-party cookie; NEREVIK stores only its hashed form and does not store raw IP addresses for analytics.

Cookies and analytics choices

The necessary nerevik_consent cookie remembers whether you selected necessary functions only or allowed analytics. If analytics is accepted, nerevik_analytics_id distinguishes returning browsers so aggregate visitor counts can be calculated. No advertising or cross-site tracking cookies are used.

You can reopen Privacy settings at any time and choose Necessary only. This removes the analytics identifier and stops further analytics collection on that browser. Analytics events are retained for up to 180 days.

Sharing, AI processing and international access

Information is shared only as needed to operate the service, evaluate a request, identify suitable suppliers or comply with law. AI matching uses structured operation and supplier information; dedicated customer contact fields and uploaded file contents are not included in the model request. Model requests are configured not to be stored by the model provider.

A buyer's project information is not released to a supplier as an award. Where service providers process data outside the EEA, appropriate transfer safeguards must be used.

Retention, security and your rights

We keep account and operation information only as long as needed for the service, legitimate documentation needs and applicable legal duties. Access controls and protected storage are used, but no online service can promise absolute security.

You may request access, correction, deletion, restriction, portability or objection where applicable, and may complain to Datatilsynet. Some data must be retained when required by law or to establish legal claims.