GDPR and your data

Why you are here without ever signing up

InvestorData publishes who owns shares in companies listed on Oslo Børs. That information comes from registers that are open by law, and if you hold shares in a listed Norwegian company your name is likely to appear in one of them.

You did not give us your data and we never asked you for it. Under GDPR Article 14 we owe you an explanation of what we hold and where it came from, which is what this section is.

What we hold about you

• Your name, and your year or date of birth where the register includes it — used to tell people with the same name apart, not to identify you further.
• Your country of residence as registered.
• The shares you hold in each company, and how those holdings have changed over time.
• Where relevant, roles and ownership links between you and companies, from the company registers.

Where it came from

• Euronext Securities Oslo — the VPS shareholder register.
• Oslo Børs — listings and market data.
• The Brønnøysund Register Centre — company and role information.
• The Norwegian Tax Administration’s shareholder register.

On what basis we process it

Legitimate interest, under Article 6(1)(f). Ownership of listed companies is public by design — that is why these registers exist and why they are open. Our interest, and our customers’, is in seeing that ownership clearly and in time to act on it.

We weigh that against your privacy. In practice that means we publish holdings and how they change, and not addresses, personal identity numbers, or anything else that would tell someone more about you than the registers already do.

What you can ask us to do

Write to hei@investordata.no with enough detail to find you — your name, and ideally a company you hold shares in. We answer within 30 days. There is no charge.

• Ask for a copy of everything we hold about you.
• Have it corrected if it is wrong.
• Object to us processing it. Where we have no overriding reason to continue, we stop.
• Ask for it to be deleted. Note that our copy is not the register — deleting it here does not change Euronext, Brønnøysund or the Tax Administration, and if the underlying register still lists you the data may reappear on the next import unless we suppress it, which we can do.
• Complain to Datatilsynet if you are not happy with how we have handled your request.

Our role

For your account, your subscription and your use of the product, we are the data controller. We are not a processor acting on your instructions, because the data you look at is ours to publish rather than yours to entrust to us.

If your organisation needs a data processing agreement for a specific arrangement, get in touch and we will look at it.

Sub-processors

All of these process within the EU/EEA:

• Supabase — database, authentication and storage.
• Vercel — application hosting.
• Chargebee — subscriptions, invoicing and card payments.
• Amazon Web Services (SES, Ireland) — outgoing email.

Transfers outside the EU/EEA

None. Personal data stays within the EU/EEA. If that ever changes we will update this page before it does, and put the appropriate safeguards in place.

Security

• Access to customer data is limited to those who need it to run the service.
• Data is encrypted in transit and at rest by our infrastructure providers.
• Card details never reach our systems; payments go through Chargebee.
• Access to the product is controlled per account, and entitlements are enforced on the server rather than in the browser.

Breach notification

If a breach affects your personal data we notify Datatilsynet within 72 hours where required, and tell you directly where the risk to you is high.