Legal
Privacy notice
Last updated 15 October 2026
This notice is published in English only, and the English version governs. We would rather give you one text we can stand behind than eight machine translations of it. If you need it in another language for a procurement process, email contact@arenorg.com and we will arrange a professional translation.
This notice explains what personal data ArenOrg AS handles when you use the 4Auditee website or workspace, why we hold it, how long we keep it, and how to exercise your rights under the GDPR. It is written to be specific rather than reassuring — where a period or a provider is stated, it is the one the system actually applies.
1. Who we are
- Controller
- ArenOrg AS
- Organisation number
- XXX XXX XXX
- Registered address
- XXXXX
- Privacy contact
- contact@arenorg.com
2. Two different roles
This matters more than it may appear, because it determines who you should contact.
We are the controller for data you give us directly — a demo request, a workspace application, or an enquiry by email. We decide why and how that data is used.
We are a processor for everything inside a customer's workspace: audits, findings, documents, evidence, competency records and the people named in them. Your employer is the controller of that data and decides what goes in it. If you are an employee asking about records held in your employer's workspace, please contact them first — we act on their instructions.
3. What we collect, and why
If you contact us
- Demo request
- Your name, work email, company, optionally the standards you work to and your message. Used to contact you about the demo you asked for.
- Workspace application
- Your name, work email, phone, company, country and website. Used to assess and provision the workspace you requested.
Both forms are rate-limited per IP address and protected against automated submissions. We do not buy contact lists, and we do not use these details for unrelated marketing.
If you subscribe to new articles
- What we keep
- Your email address, the topics you chose (sections, standards or reader groups), how often you want email, your language, and when you signed up, confirmed and were last sent something.
- Why
- To send you the articles you asked for — nothing else. The legal basis is your consent, which you give by confirming the link we email you; nothing is sent before that.
- Leaving
- Every email has a link to change your topics or unsubscribe in one click, and your mail program's own unsubscribe button works too. You can also write to us and we delete the address.
If you use a workspace
- Account
- Name, email, optional phone and profile image, and a hashed password. Passwords are stored only as a bcrypt hash and are never readable by us.
- Activity records
- Who created, changed, approved or closed each audit, finding and document, with timestamps. This is the audit trail — it is the point of the product, and customers rely on it to pass their own certification audits.
- Competency records
- Training, qualifications and site assignments for people your employer records, including external contractors.
- Technical
- IP address and browser user agent are recorded for administrative actions and for external-auditor portal access, so unauthorised access can be investigated.
If you sign in as a visitor at a site
Some of our customers run a visitor register at their entrances. If you sign in at one, the customer holds your name, your mobile number, the company you gave, who you were visiting and why, and — at food and production sites — your answer to a question about infectious symptoms. That answer is deleted within a fortnight; the rest is kept for the period the sign-in screen showed you, which the site sets and which cannot exceed two years. Your number is passed to our SMS provider so you can be sent a sign-out link.
The customer is the controller of that record and we process it for them. If you want a copy of it or want it deleted, contact the site you visited, or write to us at the address below with the mobile number you used and we will pass it on or act on it.
If you are an external auditor
When a customer shares an audit with you, we hold your name, email and firm, plus a log of each time the shared link is opened. Access links expire, can be protected with an access code, and can be revoked at any time.
5. Who else processes it
We use a small number of service providers. Each is bound by a data processing agreement and may only act on our instructions.
- Hosting and storage
- The application runs in an EU region and files and evidence are stored in EU object storage in Frankfurt. Provider names to be confirmed.
- Resend, for transactional email such as notifications and password resets, and for the article newsletter.
- Text messages
- An SMS provider delivers the sign-out link a site visitor is texted, and the arrival alert a host may choose to receive by text. The visitor's mobile number is passed to that provider, and the host's alert also carries the visitor's name and the company they gave. Provider name and location to be confirmed.
- Error reporting
- Sentry, which may capture technical request context when something fails.
- AI features
- An external model provider processes the text you submit to AI features. The provider's retention and model-training terms are being confirmed and will be stated here explicitly.
We do not sell personal data, and we do not share it with third parties for their own purposes.
6. How long we keep it
These periods are enforced by an automated routine, not by intention — the same values drive the deletion job.
- Demo requests
- 365 days from submission
- Rejected workspace applications
- 365 days. Approved applications are kept as the provenance record for the workspace they created.
- External auditor access logs
- 365 days
- Visitor register
- The period each site sets, 180 days unless it sets another, from the day of the visit
- Newsletter
- For as long as you are subscribed. A sign-up never confirmed is deleted after 30 days; after you unsubscribe, your address is deleted after 30 days.
- Expired sign-in and password reset tokens
- 7 days after they expire
- Workspace content
- Kept for as long as your employer's agreement with us is in force, and thereafter per that agreement. Post-termination period to be confirmed.
The audit trail is deliberately not deleted on a schedule. Its completeness is what makes it usable as evidence, and removing entries would undermine the customer's own compliance. Where erasure applies to trail entries, we pseudonymise the person rather than delete the record.
7. Your rights
Under the GDPR you can request access to your data, correction, erasure, restriction or objection to processing, and portability. You may also complain to your supervisory authority — in Norway, Datatilsynet.
Email contact@arenorg.com and we will respond within one month. If your request concerns data inside an employer's workspace, we will forward it to them, since they decide the outcome.
8. Where your data is
The application and its storage run in the EU. Where a provider processes data outside the EEA, it is covered by an adequacy decision or Standard Contractual Clauses. The provider list in section 5 is being finalised, and any transfer will be named there.
9. Changes
If we change how we handle personal data we will update this notice and the date at the top. Material changes affecting workspace customers are communicated directly.
Questions about security rather than privacy? See Security & data, or send us your security questionnaire.