Privacy Policy

Last updated: 29 May 2026

1. Who we are (the data controller)

ControlNow AS, org. nr. 937 736 258, Oslo, Norway, is the controller for the personal data described here. For any privacy question or to exercise your rights, contact us at hello@controlnow.ai.

2. What we collect

We do not knowingly collect special-category personal data through this website, and we ask that you not include it in free-text fields.

3. Why we use it, and our legal basis

PurposeLegal basis (GDPR Art. 6)
Respond to your enquiry and arrange a meeting or demoSteps taken at your request prior to a contract, and our legitimate interest in responding to business enquiries (Art. 6(1)(b)/(f))
Send you occasional product and company updatesYour consent (Art. 6(1)(a)); opt-in only, withdraw any time
Operate, secure, and improve the websiteOur legitimate interest in running a safe, functional site (Art. 6(1)(f))
Comply with legal obligations (e.g. accounting)Legal obligation (Art. 6(1)(c))

4. Who we share it with (processors)

We share personal data only with vendors who process it on our behalf under a data processing agreement, and only as needed to run our business:

ProcessorPurposeLocation
HubSpot, Inc.CRM, forms, meeting scheduling, emailUSA (SCCs in place)
Amazon Web Services (AWS)Website and application hostingEU — Stockholm (eu-north-1)
Microsoft (Microsoft 365)Business email and productivityEU

We do not sell personal data. A current list of sub-processors is available on request.

5. International transfers

Our infrastructure is hosted within the EEA (AWS, Stockholm). Where a processor is located outside the EEA (e.g. HubSpot in the USA), the transfer is governed by the European Commission's Standard Contractual Clauses together with supplementary safeguards and a transfer risk assessment.

6. How long we keep it

We keep enquiry and contact data for as long as needed to handle your request and our ongoing relationship, and thereafter only as required for legitimate business or legal purposes (Norwegian bookkeeping rules require certain records to be kept for up to five years, or longer in defined cases). Marketing data is kept until you withdraw consent or object.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time. To exercise any right, email hello@controlnow.ai. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and EEA-based hosting — to protect personal data. No method of transmission is completely secure, but we work to protect your data and to respond promptly to any incident.

9. Cookies

We use a small number of essential cookies and, with your consent, analytics cookies. You can review and change your choice at any time — see the Cookie Policy.

10. Changes to this policy

We may update this policy as our service and the law evolve. We will revise the "last updated" date above and, for material changes, take reasonable steps to inform you.

11. Contact

ControlNow AS · Org. nr. 937 736 258 · Oslo, Norway · hello@controlnow.ai