Privacy Policy

1. Data Controller

RiisBiTech (hereinafter "we", "us", or "our") is the data controller responsible for your personal data. We are based in Norway and subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Norwegian Personal Data Act (personopplysningsloven).

Contact: info@riisbitech.com

2. Data We Collect

We collect only what is necessary to provide our services:

• Account data: name, email address, and password (hashed) when you register via our authentication provider (Clerk).
• Usage data: pages visited, features used, and timestamps — collected in aggregate form only.
• Contact data: messages or enquiries you send us via email.
• Technical data: IP address, browser type, and device type for security and fraud prevention purposes.

3. Legal Basis for Processing (GDPR Article 6)

• Performance of a contract (Art. 6(1)(b)): to create and manage your account and deliver our platform.
• Legitimate interests (Art. 6(1)(f)): to maintain security, prevent fraud, and improve our services.
• Legal obligation (Art. 6(1)(c)): to comply with applicable Norwegian and EU law.
• Consent (Art. 6(1)(a)): for any non-essential cookies or marketing communications, where explicitly given.

4. Cookies

We use only strictly necessary cookies required for secure authentication and site functionality. We do not use advertising or third-party tracking cookies.

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only with:

• Clerk — our authentication provider, acting as a data processor under a DPA. Data may be stored in the US under Standard Contractual Clauses.
• Legal authorities — when required by applicable law.

6. International Data Transfers

Where personal data is transferred outside the EEA (e.g., to our processor Clerk in the US), we ensure appropriate safeguards are in place — specifically Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46.

7. Data Retention

We retain personal data only for as long as necessary:

• Account data: until you delete your account.
• Security logs: up to 12 months, unless required longer by law.
• Contact enquiries: up to 3 years.

8. Your Rights under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure ("right to be forgotten") (Art. 17) — request deletion of your data.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any right, contact us at info@riisbitech.com. We will respond within 30 days.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing your personal data in violation of GDPR:

www.datatilsynet.no

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.