Privacy & Cookie Policy

XEEVA Advisory, Oslo, Norway, is the data controller for personal data processed through this website and our engagements. We process personal data under the Norwegian Personal Data Act (personopplysningsloven), which incorporates the General Data Protection Regulation (GDPR) into Norwegian law.

What we collect

• Contact details you send us: name, email, phone, company, and role.
• The content of your inquiry and correspondence.
• Basic technical data needed to run the website securely.

Please do not submit medical records or clinical health information through the website. Where special-category personal data is volunteered in an engagement, it is processed only where a valid legal basis and an applicable GDPR condition exist.

Why we use it

• To respond to inquiries and deliver agreed services (steps before a contract and performance of a contract).
• To meet accounting and other binding legal duties (legal obligation).
• To protect and operate the website and our services (legitimate interests).
• To use optional analytics technologies only where valid consent has been given.

We never sell personal data and never use it for advertising.

Confidentiality of engagements

Information shared during advisory sessions is treated as strictly confidential under NDA and is only kept for as long as the engagement requires, unless the law requires longer.

Sharing

Consultation bookings take place on Calendly, which opens only when you select the booking link. Calendly processes the booking details you provide, such as your name, email address, chosen time, and optional notes. These details are used to arrange your consultation and notify the advisor. Please review Calendly's Privacy Notice before booking, and do not include medical records or sensitive clinical information.

Data is shared only with trusted processors (e.g. email and hosting providers) under data processing agreements, with professional advisers where necessary, or when required by law. Processors may act only on documented instructions and must protect the information.

International transfers

Where a service provider processes personal data outside Norway or the EEA, XEEVA uses a lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or the European Commission's Standard Contractual Clauses, as required by the GDPR.

Retention

Inquiries that do not lead to an engagement are deleted within 12 months. Accounting records are kept as required by the Norwegian Bookkeeping Act.

Cookies

Cookies and similar technologies are governed by section 3-15 of the Norwegian Electronic Communications Act (ekomloven) and, where personal data is involved, the Personal Data Act and GDPR. Strictly necessary storage may be used to provide a service you request. Optional analytics technologies are not activated unless you give prior, voluntary consent. We use no advertising cookies.

You may decline optional cookies without losing access to the website. You may withdraw consent as easily as you gave it by clearing the saved cookie preference in your browser; the consent choice will then be shown again on your next visit.

Your rights

You may request access, correction, deletion, restriction, or portability of your data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Contact us at contact@xeeva-agency.com. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

Security and changes

We use proportionate organisational and technical safeguards to protect personal data. We may update this policy when our processing or applicable law changes; the current revision date is shown above.