Data Privacy Notice & GDPR Framework

Last Updated: March 2026 · Official Data Controller: METACORTEX AS

1. Identification of the Data Controller

The entity legally responsible for the processing of personal data collected via the Kainos platform is:

2. Categories of Data Collected

We collect only the minimum personal data strictly necessary to fulfill our educational publication mission:

• Inquiry & Assessment Data: Your name, email address, inquiry topic, and voluntary mobility assessment responses submitted via forms.
• Technical & Connection Telemetry: Anonymized IP addresses, HTTP user-agent headers, operating system classification, and page timestamp data collected for network security and denial-of-service prevention.
• Consent Records: Local preferences indicating your acceptance or refusal of optional analytical cookies.

3. Legal Bases for Processing (GDPR Article 6)

We process personal data under the following legitimate grounds:

• Consent (Art. 6(1)(a)): Provided when submitting your email to receive our mobility baseline summary or when opting into analytical metrics.
• Contractual Pre-steps (Art. 6(1)(b)): Responding to direct inquiries, partnerships, or corporate ergonomic consultations initiated by you.
• Legitimate Interests (Art. 6(1)(f)): Maintaining server resilience, preventing automated spam submissions via honeypot filtering, and auditing platform performance.

4. Data Retention Periods

Contact desk inquiries and assessment records are retained for a maximum duration of 12 months from the date of final communication, after which they are securely purged from our operational databases. Technical server log entries are overwritten on a rolling 30-day security cycle.

5. Data Subject Rights Under GDPR (Articles 15–22)

As an individual resident in Norway, the European Economic Area, or worldwide, you possess enforceable rights regarding your data:

• Right of Access (Art. 15): Obtain confirmation as to whether your personal data is processed and receive a copy thereof.
• Right to Rectification (Art. 16): Require the correction of inaccurate or incomplete information.
• Right to Erasure (Art. 17): Request deletion of your personal data where statutory grounds are satisfied.
• Right to Restriction (Art. 18): Request temporary freezing of processing under contested circumstances.
• Right to Data Portability (Art. 20): Receive your submitted data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Object at any time to processing grounded on legitimate interests.

To exercise any statutory right, contact our designated privacy officer via [email protected]. We respond to verified data subject access requests within 30 calendar days at no charge.

6. International Data Transfers & Sub-processors

All primary data processing infrastructure is hosted within verified European Economic Area data centers adhering to ISO 27001 standards and European standard contractual clauses (SCCs). We never sell, lease, or monetize your contact details to third-party commercial brokers or advertising networks.

7. Right to Lodge a Complaint with a Supervisory Authority

If you consider that our processing violates European data protection regulations, you retain the statutory right to lodge a complaint with the Norwegian Data Protection Authority: