Privacy Policy

1. Who is responsible for your personal information?

The data controller is:

Questions concerning this Privacy Policy or the use of your personal information may be sent to the email address above.

2. What personal information we may collect

We may collect personal information when you:

• contact us through our website or by email;
• request technical information, reports, case studies, or other downloadable material;
• submit an online inquiry form;
• purchase a book, publication, service, or other product;
• book or request consulting services;
• subscribe to communications from us; or
• otherwise communicate with K. Garshol Rock Engineering AS.

Depending on the situation, this information may include:

• first and last name;
• email address;
• company or organization;
• job title;
• telephone number;
• correspondence and information you voluntarily provide;
• order, purchase, and payment-related information; and
• technical website information such as browser type, device information, IP address, and cookie data where applicable.

We do not intentionally request or collect sensitive categories of personal information through our marketing or contact forms.

3. How we use personal information

We may use your personal information to:

• provide material or information you have requested;
• respond to inquiries;
• provide consulting or professional services;
• process and administer purchases and orders;
• communicate about an existing or potential business relationship;
• administer our website and maintain its security;
• comply with accounting, tax, and other legal obligations; and
• where you have agreed to it, send occasional relevant information about groundwater control, tunneling, PEG, publications, professional services, or related technical subjects.

We do not sell personal information to third parties.

4. Legal basis for processing

We process personal information only when we have a lawful basis. Depending on the purpose, the legal basis may include:

Your request or a contract

Where processing is necessary to provide a service, fulfill an order, respond to steps requested before entering into a contract, or otherwise perform an agreement with you.

Legal obligations

We must retain certain information to comply with accounting, tax, or other statutory requirements.

Legitimate interests

We may process information where reasonably necessary to operate our business, answer inquiries, maintain website security, administer professional relationships, or provide material expressly requested by you, provided that these interests do not override your privacy rights.

Consent

Where required, we will ask for your consent, for example, for optional email marketing or non-essential cookies. You may withdraw consent at any time.

GDPR requires organizations to identify the purpose and lawful basis for processing and to explain this to the individual whose information is being collected.

5. Contact information forms

K. Garshol Rock Engineering AS may use contact information forms to provide technical information, case studies, publications, or similar material. When you submit such a form, we may receive the information you choose to provide, which may include your:

• first and last name;
• work email address;
• company name; and
• job title.

We use this information primarily to provide the material you requested and to administer your inquiry. If we wish to use your information for additional email marketing, we may ask separately for your consent. Once K. Garshol Rock Engineering AS receives the information you submit, this Privacy Policy governs our processing.

6. Email communications and marketing

If you specifically agree to receive relevant professional or marketing communications from K. Garshol Rock Engineering AS, we may occasionally contact you about:

• tunneling and groundwater-control subjects;
• technical publications and case studies;
• Tunneling Without Water Problems;
• consulting services; and
• closely related professional information.

You can withdraw your consent or unsubscribe at any time by using the unsubscribe option in an email or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew consent.

Norwegian rules generally require prior consent before sending electronic marketing to natural persons, subject to limited exceptions such as certain existing customer relationships.

7. Purchases and payments

When you purchase a book, publication, or service, payment, e-commerce, accounting, or fulfillment providers may handle the information needed to process the transaction. K. Garshol Rock Engineering AS does not need to retain complete payment-card information when payments are processed securely by a payment provider. We may retain transaction and accounting information for the period required under applicable Norwegian law.

8. Service providers and sharing of information

We may use trusted service providers to operate parts of our business, including providers of:

• website hosting;
• email and communications;
• customer relationship management;
• payment processing;
• order fulfillment;
• accounting;
• cloud storage;
• website analytics; and
• advertising platforms such as LinkedIn.

These providers may process personal information only as necessary to provide their services and are expected to protect the information appropriately. We may also disclose information where required by law or by a competent public authority. We do not sell or rent personal information.

9. Transfers outside the EEA

Some service providers may process information outside Norway or the European Economic Area. Where such transfers occur, we will rely on an appropriate legal mechanism, such as:

• an adequacy decision by the European Commission;
• approved Standard Contractual Clauses; or
• another lawful safeguard permitted by the GDPR.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or for as long as required by law. Retention depends on the nature of the information. For example:

• inquiry information is retained while it remains relevant to the inquiry or professional relationship;
• customer and project information may be retained for as long as reasonably necessary for contractual, professional, documentation, or legal purposes;
• accounting and transaction information is retained for the statutory retention period;
• marketing information is retained until consent is withdrawn, the person unsubscribes, or the information is no longer required for that purpose.

Where appropriate, we may retain limited information to ensure we continue to respect an unsubscribe request. GDPR requires personal information to be kept no longer than necessary for the purpose for which it is processed.

11. Cookies and website technologies

Our website may use cookies or similar technologies that are necessary for the website to function. Where optional cookies or similar technologies are used for analytics, advertising, or other non-essential purposes, they will only be activated where the required consent has been obtained. Users should be able to accept or reject optional cookies and withdraw their consent.

Under Norwegian rules effective from 1 January 2025, non-essential cookies and similar technologies generally require consent meeting GDPR standards; strictly necessary technologies are subject to a narrow exception. Where applicable, the website's cookie notice or consent tool may provide further information about specific cookies.

12. Security

We take reasonable technical and organizational measures to protect personal information against:

• unauthorized access;
• loss;
• misuse;
• alteration; and
• unlawful disclosure.

Access to personal information is limited to persons and service providers who need it for legitimate business purposes.

13. Your rights

Subject to applicable law, you may have the right to:

• obtain information about how your personal data are processed;
• request access to your personal information;
• request correction of inaccurate information;
• request deletion of information;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a data-protection authority.

These rights are provided under GDPR, including the rights of access, rectification and erasure. You can send requests to K. Garshol Rock Engineering AS using the contact details at the beginning of this policy.

If you believe that your personal information has been handled contrary to applicable privacy rules, you also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

14. Automated decision-making

K. Garshol Rock Engineering AS does not use personal information for automated decision-making that produces legal or similarly significant effects on individuals.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our services, website, technology, or legal obligations change. We will always publish the current version on our website, along with the latest revision date.