Privacy policy

Who we are

Konnected’s legal name and organisation number, to be added runs Konnected and is responsible for the personal data in this app (the controller).

Clifford on the Konnected team is our privacy owner. He handles every question and request about your data.

To reach us about your data, use the buttons under Settings, or write to privacy email address, to be added.

What we store

Your account: your email address, your name, how you sign in (your Google account id, or a password stored only as a hash), when you last signed in, your language, and which version of these texts you accepted and when.

Students: the profile you write (school, programme, year, pitch, skills, interests, experience, highlights and the kinds of project you like), your CV, a contact email and phone number if you give them, what you agree to share with a company and each change to that choice, your applications, hand-ins, questions, problem reports, feedback and the status of your pay.

Companies: the company’s name, organisation number, contact person, website, logo, description and billing details, and its projects, attachments, questions and feedback.

Agreements: the signed PDF, the typed name, the tick, the time, how the signer had signed in, the signer’s IP address and browser, and a fingerprint (SHA-256) of the PDF.

A log of what was done in the app and by whom, without the contents.

From others: Google gives us your name, email address and Google account id when you sign in with Google. After a project, the company gives feedback on the work.

When we review a company, we look up its organisation number in the public Brønnøysund Register (Enhetsregisteret) to check its registered name and status. Only the organisation number is sent, and we do not store the answer.

We never ask for a national identity number (fødselsnummer).

Why we use it, and on what legal basis

To run your account and the service you asked for: profiles, applications, matching, projects, agreements, hand-ins and the emails about them. Legal basis: the contract with you (GDPR article 6(1)(b)).

To keep accounting records and pay students. Legal basis: our duty under the Norwegian Bookkeeping Act (article 6(1)(c)).

To keep the app safe and to be able to show what happened: sign-in records, the activity log and the records kept with each signature. Legal basis: our legitimate interest (article 6(1)(f)). Lawyer to confirm the basis for the IP address and browser kept with signatures.

We send no marketing and use no analytics or advertising tools.

People at Konnected review profiles and projects and choose the student for each project. No decision about you is made by a computer alone.

Who sees it

The Konnected team (Oliver, Amanda, Clifford and Julie).

A company sees a student only after Konnected selects that student for the company’s project, and then only what the student agreed to share. Companies never search or browse students.

Other students see nothing about you.

Each party to an agreement gets the signed PDF by email.

Who helps us

These services process data for us, under agreements with us:

netcup (Germany) runs the server with the app, its database and the uploaded files.

Hetzner (Germany) keeps our encrypted backups on a Storage Box.

Mailjet (France) sends our emails.

Google, only if you choose “Continue with Google”, confirms who you are. Google’s role and any transfer outside the EU/EEA to be confirmed with the lawyer.

Have I Been Pwned: when you choose a password, we send only the first 5 characters of a fingerprint (SHA-1) of it, to check it against known data breaches. Your password and email address never leave the app.

Bugsink receives error reports from the app, with as little personal data as we can manage. Where Bugsink is hosted, to be added.

UptimeRobot checks that the app is running. It receives no personal data.

Stripe (Stripe Payments Europe, Ireland) sends Konnected’s invoices for paid projects and takes card payments on its own invoice page. It receives the company’s name, organisation number, invoice email and reference, and the project’s title and price; never anything about the student. Konnected never sees card numbers. Stripe’s parent company is in the United States. Stripe’s role and the transfer basis to be confirmed with the lawyer.

Later, not in use yet: Fiken for accounting. We will update this policy before we start using it.

Your data stays in the EU/EEA, except as noted above.

How long we keep it

Your account and profile: as long as you have an account. Deletion after a period without use, to be decided.

Uploaded files that are not in use (for example an old CV): deleted after 7 days.

Sign-in links: removed a day after they expire.

Signed agreements and the records kept with each signature: kept as contracts, also after an account is deleted. How long, to be set with the lawyer.

Accounting records (invoices and the payment log): 5 years after the end of the financial year, as the Bookkeeping Act requires.

Backups: 14 days. Data you delete can stay in a backup for up to 14 days, and is then gone.

Your rights

You can see and get a copy of your data, correct it, have it deleted, limit or object to how we use it, and take it with you.

Under Settings, use “Request a copy of my data” or “Delete my account”. You can correct your profile yourself at any time.

We answer within one month.

When we delete your account, we tell every company that received your information that it must delete it.

You can also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

Cookies

We use only the cookies the app needs: one that keeps you signed in, one that protects a sign-in with Google for 10 minutes, and one that remembers your language for a year. No tracking cookies.

Security

The app runs on a server in the EU and only over an encrypted connection. Backups are encrypted. Uploaded files are never public. Only the Konnected team can open the team workspace, and the team signs in with Google.

Changes

When this policy changes, we raise its version and ask you to accept again the next time you open Konnected.