Privacy & Data Protection Policy

Howden is committed to protecting your privacy online. We appreciate that you don’t want the personal data you give us to be used or shared indiscriminately. This policy explains what data we collect through our website, why, and what rights you have.

In this policy, “Howden”, “we”, “us” and “our” means Howden Norway AS, org. no. 989 006 266, of Wergelandsveien 1-3, 0167 Oslo, Norway.

1. Who is responsible for your data

Howden Norway AS is the data controller for personal data collected through this website.

If you have any questions about this policy or how we handle your personal data, contact:

• Email: [email protected]
• Post: Howden Norway AS, Wergelandsveien 1-3, 0167 Oslo, Norway
• Phone: +47 40 00 63 12
• Data protection contact: [email protected]

2. What personal data we collect

We collect personal data in two ways:

• Information you give us directly — for example, your name, email address, postal address and telephone number, when you submit a proposal, quote request or other enquiry. You’re not obliged to provide this, but if you withhold it, we may not be able to respond to you or provide the service you’ve asked for.
• Information collected automatically — technical and usage data such as your IP address, browser and device type, and pages visited, collected through cookies and similar technologies. See our cookie policy for details.

3. How we use your data, and our legal basis for doing so

4. Marketing communications

We send marketing communications in two situations:

• Where you’ve given your consent — for example, by signing up for our newsletter or ticking a consent box when submitting an enquiry.
• Where you’re an existing customer — we may send you information about our own similar products or services, in line with the Norwegian Marketing Control Act (markedsføringsloven § 15). This applies only if we obtained your contact details in connection with an existing service relationship, and you were given a clear opportunity to opt out at that time.

You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by emailing [email protected]. If you withdraw consent, this won’t affect the lawfulness of anything we did before you withdrew it.

5. Who we share your data with

We may share your personal data with:

• Other companies within the Howden group, where you’ve opted in to this;
• Service providers who process data on our behalf (for example, IT hosting or analytics providers), under a written data processing agreement;
• Regulators, courts or other authorities, where required by law;
• Other parties, where we believe this is necessary to protect the rights, property or safety of Howden, our website, or our visitors.

We don’t sell your personal data.

A current list of the third-party service providers (sub-processors) who process personal data on our behalf is available at howdengroup.com/no-en/sub-processors.

This site contains links to other websites. Howden isn’t responsible for the privacy practices or content of those sites.

6. International transfers

Some of the organisations we share your data with are based outside Norway and the European Economic Area (EEA), including in the United Kingdom. The UK is covered by an adequacy decision from the European Commission, meaning it’s recognised as offering an equivalent level of protection to the EEA.

7. How long we keep your data

We keep personal data for no longer than necessary for the purposes described in this policy, or as required by law. The retention periods we apply depend on the type of data and the legal requirements that apply to it:

• Customer financial data (e.g., payment and invoicing records): 5 years after the account or relationship ends, in line with anti-money laundering legislation.
• Customer due diligence records (KYC): At least 5 years after the business relationship ends, or 10 years for customers subject to enhanced due diligence, as required by the Norwegian Anti-Money Laundering Act.
• Insurance policy and claims records: Retained for a period sufficient to address potential claims under the policy, typically aligned with statutory limitation periods under Norwegian insurance mediation and limitation legislation.
• Enquiries and correspondence: Retained for as long as necessary to respond to your enquiry and for a reasonable period thereafter, unless a longer retention period applies (for example, if your enquiry leads to an insurance policy or client relationship).
• Cookies and analytics data: Retained in accordance with our cookie policy.

8. Security

Howden places great importance on the security of personal data associated with our customers and website visitors. We maintain technical and organisational measures to protect against loss, misuse and unauthorised access to data, including access restrictions and regular review of our security practices. No system can guarantee complete security, but we work to prevent loss, misuse or alteration of your data.

9. Cookies

We use cookies and similar technologies to collect some of the data described in section 2. Cookies are small text files placed on your device when you visit our site. They help us understand how the site is used and improve it. Our cookies don’t store personal data or let us read files on your device.

You can manage your cookie preferences at any time using the “Manage cookie preferences” link at the bottom of this page, or view full details of the cookies we use in our cookie policy (howdengroup.com/no-en/cookie-policy).

10. Your rights

Under the GDPR, you have the right to:

• ask for access to the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data, in certain circumstances;
• ask us to restrict how we use your data;
• receive a copy of your data in a portable format, where technically feasible;
• object to processing based on our legitimate interests, including for direct marketing;
• withdraw your consent at any time, where we rely on it.

To exercise any of these rights, contact us using the details in section 1.

If you’re not satisfied with how we’ve handled your request or your data more generally, you have the right to complain to the Norwegian Data Protection Authority:

Datatilsynet

Postboks 458 Sentrum, 0105 Oslo, Norway

+47 22 39 69 00

www.datatilsynet.no

11. Children

Our website isn’t directed at children, and we don’t knowingly collect personal data from children through it.

12. Changes to this policy

We may update this policy from time to time. Where we make material changes, we’ll post the update here and revise the “last updated” date at the top of this page.

13. Contact us

Please send any questions, concerns or comments about this policy to [email protected], or write to us at:

Howden Norway AS

Wergelandsveien 1-3, 0167 Oslo, Norway

T +47 40 00 63 12