Privacy Policy
Privacy Policy
Data Controller
The data controller responsible for the processing of personal data on this platform is:
Iruption AS
Organisation number: 927 347 695
Address: Tverråsveien 4, 8610 Mo I Rana, Norway
Phone: +47 21 63 58 41
Email: contact@investorweb.no
As the data controller, Iruption AS determines the purposes and means of processing personal data collected through the platform in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") as incorporated into Norwegian law through the Norwegian Personal Data Act (Personopplysningsloven).
Scope & Applicability
This Privacy Policy applies to all visitors of the Iruption platform, including our website, mobile-optimised pages, and any subdomains operated by Iruption AS. It covers all personal data processing activities carried out in connection with your use of the platform.
This policy does not cover the practices of third-party websites, platforms, or services that may be linked to from our platform. We encourage you to review the privacy policies of any third-party services you interact with through or alongside Iruption.
Iruption does not require user accounts or login functionality. However, certain features — such as watching webcasts and submitting questions — may ask you to voluntarily provide limited personal information such as your name and email address. The scope of personal data we collect is outlined in Section 3 below.
Data We Collect
Iruption does not require user accounts, login, or passwords. However, certain features on the platform ask you to voluntarily provide limited personal information (such as your name and email address) as described in Section 3.2 below. In addition, certain data is collected automatically when you visit and interact with our platform.
3.1 Automatically Collected Data
When you access the Iruption platform, the following information may be collected automatically through standard web technologies:
| Data Category | Examples |
|---|---|
| Device & Browser Information | Browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution |
| Network Information | IP address (which may be truncated or anonymised), approximate geographic location (country/region level derived from IP) |
| Usage Data | Pages visited, webcasts viewed, time spent on pages, click interactions, scroll depth, referring URL, entry and exit pages |
| Temporal Data | Date and time of visit, session duration, time zone |
| Video Engagement Data | Webcast play/pause events, viewing duration, video completion percentage, quality settings selected |
3.2 Voluntarily Provided Data
In certain limited circumstances, you may choose to provide personal data voluntarily. Specifically:
- Webcast registration — when you watch a webcast, you are asked to provide your name and email address. This information is collected to track viewership and is shared with the company hosting the webcast.
- Questions to webcasts — when you submit a question to a webcast, you are asked to provide your name. Your question and name may be displayed publicly in the Q&A section of the webcast.
- Company notifications — when registering for a webcast, you may opt in to receive email notifications about future webcasts from the same company. Your email address is used solely for this purpose, and you can unsubscribe at any time.
- Direct communication — if you contact us via email or other channels, we may collect your name, email address, and the content of your communication.
3.3 Data We Do Not Collect
Iruption does not collect, process, or store any of the following:
- Financial or investment portfolio data
- National identification numbers or government-issued IDs
- Payment or credit card information
- Special categories of personal data (as defined in Article 9 of the GDPR), including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sexual orientation
- Login credentials, usernames, or passwords
Legal Basis for Processing
Under the GDPR, we must have a valid legal basis for each processing activity involving personal data. Iruption relies on the following legal bases:
| Processing Activity | Legal Basis (GDPR Article) |
|---|---|
| Essential website functionality & security — processing necessary to deliver the platform, prevent abuse, and ensure technical stability | Legitimate Interest — Art. 6(1)(f) |
| Analytics & platform improvement — understanding visitor behaviour to improve content, user experience, and webcast quality | Legitimate Interest — Art. 6(1)(f) |
| Non-essential cookies & tracking — placement of analytics or third-party cookies beyond what is strictly necessary | Consent — Art. 6(1)(a) |
| Webcast registration & questions — processing your name and email when you register for a webcast or submit a question | Legitimate Interest — Art. 6(1)(f) |
| Company notifications — sending email notifications about future webcasts when you opt in | Consent — Art. 6(1)(a) |
| Responding to enquiries — processing your name and email when you contact us | Legitimate Interest — Art. 6(1)(f) / Consent — Art. 6(1)(a) |
| Legal compliance — processing required to meet legal or regulatory obligations | Legal Obligation — Art. 6(1)(c) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. Given that we do not require user accounts and only collect limited voluntarily provided data alongside technical data, we believe the impact on your privacy is minimal and proportionate to our legitimate interests.
Purpose of Processing
We process personal data for the following specific and defined purposes:
- Platform delivery and performance — to ensure the Iruption platform loads correctly, webcasts stream reliably, and content is displayed appropriately for your device and browser.
- Analytics and improvement — to understand how visitors interact with our platform, which webcasts are most viewed, and how we can improve the user experience and content quality.
- Security and abuse prevention — to detect and prevent malicious activity, protect against denial-of-service attacks, and maintain the integrity and availability of the platform.
- Webcast viewership tracking — to record and share registration data (name and email) with the company hosting the webcast, so they can understand who is watching their presentations.
- Aggregated reporting — to provide publicly listed companies with anonymised, aggregated viewership data regarding their webcasts (e.g., total views, average watch duration, geographic distribution of viewers at a country level).
- Q&A facilitation — to display submitted questions and the names of those who asked them in the webcast Q&A section.
- Company notifications — to send email reminders about future webcasts from companies you have opted in to follow.
- Communication — to respond to enquiries or messages you send to us voluntarily via email or contact forms.
- Legal and regulatory compliance — to meet our obligations under applicable Norwegian and European laws and regulations.
Third-Party Services
To provide and improve our platform, we use a limited number of third-party service providers. These services may process certain personal data on our behalf or independently. We ensure that all third-party processors offer sufficient guarantees regarding data protection in compliance with the GDPR.
7.1 Service Providers
The following categories of third-party services may be used in connection with the Iruption platform:
- Hosting and infrastructure providers — for serving the platform, storing content, and ensuring uptime and reliability.
- Content delivery networks (CDNs) — for fast and reliable delivery of video content and static assets.
- Analytics services — for gathering anonymised and aggregated usage statistics to improve the platform (e.g., Google Analytics with IP anonymisation enabled, or privacy-focused alternatives).
- Video hosting and streaming services — for encoding, hosting, and streaming investor webcast content.
- Email service providers — for handling any communication you initiate with us.
7.2 Data Processing Agreements
Where third-party services act as data processors on our behalf, we have entered into Data Processing Agreements (DPAs) as required under Article 28 of the GDPR. These agreements ensure that processors handle your data only according to our instructions and implement appropriate technical and organisational security measures.
Data Sharing & International Transfers
8.1 Data Sharing
Iruption does not sell, rent, or trade your personal data to third parties. We may share data in the following limited circumstances:
- With data processors — third-party service providers who process data on our behalf and under our instructions, subject to appropriate DPAs.
- With webcast-hosting companies — when you register to watch a webcast, your name and email address are shared with the company hosting the webcast for their investor relations purposes.
- Aggregated, anonymised data — we may also share non-identifiable, aggregated viewership statistics with listed companies. This aggregated data cannot be used to identify individual visitors.
- Legal requirements — we may disclose data if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Iruption, our users, or others.
- Business transfers — in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the relevant third party, subject to this Privacy Policy and applicable data protection laws.
8.2 International Data Transfers
We primarily store and process data within the European Economic Area (EEA). In cases where data may be transferred to countries outside the EEA, we ensure that adequate safeguards are in place, including:
- Transfers to countries recognised by the European Commission as providing an adequate level of data protection (adequacy decisions).
- Use of Standard Contractual Clauses (SCCs) approved by the European Commission.
- Supplementary measures as necessary, following the guidance of the Court of Justice of the European Union and the European Data Protection Board.
You have the right to request information about the specific safeguards applied to any international transfers of your data.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention practices are as follows:
| Data Type | Retention Period |
|---|---|
| Server logs (including IP addresses) | Up to 90 days, then deleted or anonymised |
| Analytics data | Aggregated and anonymised within 14 months |
| Cookie data | Varies by cookie type; see cookie consent settings for details |
| Webcast registration data (name, email) | Retained for as long as the webcast is available on the platform, then deleted |
| Question data (name, question text) | Retained for as long as the webcast is available on the platform |
| Communication data (emails, enquiries) | Up to 12 months after the enquiry is resolved, unless ongoing communication warrants longer retention |
| Aggregated viewership reports | Retained indefinitely as they contain no personal data |
When the retention period expires, data is securely deleted or irreversibly anonymised so that it can no longer be associated with any individual.
Data Security
Iruption implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
- Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis, with role-based permissions.
- Infrastructure security — our hosting providers implement physical security, firewalls, intrusion detection systems, and regular security audits.
- Regular assessments — we periodically review and update our security practices to address new threats and vulnerabilities.
- Incident response — we maintain a data breach response plan in compliance with Article 33 and 34 of the GDPR, ensuring that the relevant supervisory authority and affected data subjects are notified within the required timeframes in the event of a qualifying breach.
While we strive to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard protections.
Your Rights Under the GDPR
As a data subject under the GDPR, you have the following rights with respect to your personal data. These rights can be exercised by contacting us at contact@investorweb.no.
| Right | Description |
|---|---|
| Right of Access (Art. 15) | You have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data along with information about how it is processed. |
| Right to Rectification (Art. 16) | You have the right to request correction of inaccurate personal data or completion of incomplete data. |
| Right to Erasure (Art. 17) | You have the right to request deletion of your personal data under certain conditions, such as when the data is no longer necessary for the purpose it was collected. |
| Right to Restriction (Art. 18) | You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data. |
| Right to Data Portability (Art. 20) | Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. |
| Right to Object (Art. 21) | You have the right to object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. |
| Right to Withdraw Consent (Art. 7(3)) | Where processing is based on consent (e.g., non-essential cookies), you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. |
| Right to Lodge a Complaint (Art. 77) | You have the right to lodge a complaint with a supervisory authority if you believe your data has been processed in violation of the GDPR. |
We will respond to all legitimate requests within 30 days. In complex cases or where we receive a high volume of requests, this period may be extended by a further 60 days, in which case we will inform you of the extension and the reasons for it.
For automatically collected data (such as analytics), it may be difficult to associate specific data with a particular individual. In such cases, we may ask you to provide additional information to verify your identity before fulfilling your request. For voluntarily provided data (such as webcast registrations), you can contact us to exercise your rights regarding that data.
Children's Privacy
The Iruption platform is designed for investors, financial professionals, and the general public interested in investor relations content from publicly listed companies. It is not directed at children under the age of 16.
We do not knowingly collect personal data from children under 16. We do not collect age-related information. If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete such data.
If you are a parent or guardian and believe your child has provided personal data to us (for example, through a contact form), please contact us at contact@investorweb.no and we will promptly address the matter.
AI-Generated Content
Iruption may use artificial intelligence (AI) tools to assist in the creation of editorial content, summaries, and other written materials related to the companies and webcasts featured on our platform. Where AI tools are used in content creation, the following principles apply:
- AI-generated content is reviewed by our editorial team before publication to ensure accuracy and quality.
- AI tools used by Iruption may process publicly available financial data and company information, but they do not process personal data of our platform visitors.
- AI-generated content on our platform is clearly labelled where required or appropriate, in line with the EU AI Act's transparency obligations.
- We do not use AI to profile visitors or make automated decisions that produce legal or similarly significant effects on individuals.
For more information about how AI tools are used in our content creation process, please refer to our editorial policy or contact us directly.
Embedded Content & Third-Party Players
The Iruption platform features embedded content, including investor webcasts, video players, and potentially content from third-party platforms. When you interact with embedded content, the following may occur:
- The third-party provider of the embedded content may set its own cookies and collect data independently, subject to that provider's own privacy policy.
- Video streaming services may collect technical data such as your IP address, video playback quality, and viewing behaviour.
- If webcasts are hosted via third-party platforms, those platforms' terms of service and privacy policies will also apply to the extent that they collect data directly from your browser.
We recommend reviewing the privacy policies of any third-party services whose embedded content you interact with on our platform. Iruption is not responsible for the data processing practices of these independent third parties.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons. When we make material changes, we will:
- Update the "Effective date" at the top of this policy.
- Post a prominent notice on the Iruption platform to inform visitors of the changes.
- Where changes affect processing based on consent, seek renewed consent where appropriate.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Continued use of the platform after changes have been posted constitutes acceptance of the updated policy, to the extent permitted by applicable law.
Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, you can contact us using the following details:
Iruption AS
Email: contact@investorweb.no
Phone: +47 21 63 58 41
Address: Tverråsveien 4, 8610 Mo I Rana, Norway
We aim to respond to all privacy-related enquiries within 30 days of receipt. If your request is particularly complex, we will inform you of any necessary extension within the initial 30-day period.
Supervisory Authority
If you are not satisfied with how we handle your personal data or respond to your request, you have the right to lodge a complaint with the Norwegian Data Protection Authority:
Datatilsynet (Norwegian Data Protection Authority)
Address: P.O. Box 458 Sentrum, 0105 Oslo, Norway
Phone: +47 22 39 69 00
Email: postkasse@datatilsynet.no
Website: www.datatilsynet.no
If you reside in another EEA member state, you may also lodge a complaint with your local supervisory authority. A full list of EEA data protection authorities is available on the European Data Protection Board website.