Legal Document
Privacy Policy
How Catenda handles personal data across our website, marketing, and business interactions, separate from data uploaded to the platform.
Version 1.1 — September 2026
1. Who we are
This Privacy Policy describes how Catenda processes personal data in connection with our website, marketing, and business interactions.
Catenda AS (organisation number 994 023 977, Drammensveien 288, 0283 Oslo, Norway) is the data controller. Email: compliance@catenda.com.
For customers contracting via Catenda Japan KK, the local controller is Catenda Japan KK (Akasaka K-Tower 4F, 1-2-7 Motoakasaka, Minato-ku, 107-0051 Tokyo). The same standards apply across the Catenda group.
This policy covers personal data Catenda processes as controller — visitors to catenda.com and bimsync.com, newsletter subscribers, sales and prospect contacts, support requesters, and account-level contacts for our customers. Data you upload to the Catenda Hub platform is processed under the Data Processing Agreement (catenda.com/legal/dpa) between Catenda and your employer, not this policy.
2. What we collect and why
We process personal data only where we have a lawful basis under the EU GDPR and the UK GDPR — and, for customers in Switzerland and Japan, under the Swiss FADP and the Japanese APPI respectively — together with any other data protection law that applies to you.
| Category | Examples | Lawful basis | Purpose |
|---|---|---|---|
| Account registration | Name, email, job title, phone, company, city, country | Legitimate interest (Art. 6(1)(f) GDPR); contract (Art. 6(1)(b)) for paid subscriptions | Identifying you within the Subscription Service; account administration |
| Sales and prospect contact | Name, email, company, role, CRM conversation notes | Legitimate interest | Following up on enquiries; managing the sales pipeline |
| Support requests | Name, email, request content, technical context | Legitimate interest; contract | Resolving your support request |
| Newsletter and marketing | Email, name, marketing preferences, engagement metrics | Consent (Art. 6(1)(a)); soft opt-in for existing customers under Norwegian Marketing Act §15 | Sending product news and updates |
| Website usage | IP address, browser and device, pages visited, referrer, timestamps | Legitimate interest; consent for non-essential cookies | Operating the website; understanding usage; product improvement |
| Billing and accounting contacts | Name, email, billing address, VAT number | Contract; legal obligation (Bokføringsloven) | Invoicing and statutory record-keeping |
We do not process special-category data (GDPR Art. 9) about you in this controller capacity.
3. AI features
Catenda does not use the personal data we hold about you as a website visitor, prospect, or support contact to train AI or machine-learning models.
Content you and your colleagues create in the Subscription Service, and data about how it is used, is Customer Data processed under the Data Processing Agreement (catenda.com/legal/dpa) on your employer's instructions — not this Policy. Separately, Catenda may use that data in anonymized form to develop and improve the Subscription Service and to train and improve artificial intelligence and machine-learning models, and in anonymized and aggregated form to produce statistical analyses and benchmark studies. Once anonymized, the data is no longer personal data. Your employer may opt out of this use by emailing compliance@catenda.com; opt-out takes effect within thirty (30) days of receipt. See MSA §7.2 and DPA §1 for the full terms.
4. Cookies and similar technologies
Our website uses cookies that fall into the following categories:
- Strictly necessary cookies (no consent required): session management, security, load balancing.
- Analytics cookies (consent required): Google Analytics, used in aggregated form to understand how the site is used.
- Marketing cookies (consent required): HubSpot tracking, LinkedIn Insight Tag, used to measure campaign performance and personalise content.
You can manage your cookie preferences via the cookie banner on first visit, and at any time via the "Cookie preferences" link in the website footer.
5. How long we keep your personal data
We retain personal data only for as long as needed for the purpose, or as required by law.
| Data category | Retention period |
|---|---|
| Customer-account data | Subscription Term + 90 days |
| Billing and accounting records | 5 years (Norwegian Bookkeeping Act) |
| Support tickets | 24 months after closure |
| Marketing and newsletter subscribers | Until you unsubscribe |
| Sales and CRM data on prospects | Up to 24 months after last interaction |
| Website logs | Up to 12 months |
6. How we protect your personal data
We apply appropriate technical and organisational security measures, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, logging and monitoring, regular security testing, and annual data-protection training for staff. Catenda holds ISO 27001 certification. Detailed measures are in the DPA Annex at catenda.com/legal/dpa.
7. Where your personal data is stored
Data is hosted primarily in the European Economic Area, on Amazon Web Services infrastructure (default region: AWS eu-west-1, Ireland). Catenda may deploy customer data in another EU region on request — for example, DACH customers may opt for AWS eu-central-1 (Frankfurt).
Some service providers process limited personal data outside the EEA, including in the United States. Where this happens we apply appropriate safeguards: an adequacy decision, or the EU Standard Contractual Clauses, the UK Addendum, or the Swiss FDPIC-approved clauses, with supplementary measures where required.
8. Sub-processors and recipients
We engage third-party sub-processors to help operate and improve our service — for example, cloud hosting, product analytics, CRM, customer support, and marketing providers. These parties process personal data only under data processing agreements consistent with the GDPR. A current list of our sub-processors, including their names and locations, is set out in Annex B of our Data Processing Agreement, published at catenda.com/legal/dpa.
We may engage additional sub-processors as our business evolves. Subscription customers receive 30 days' notice and an objection right, as set out in the DPA.
We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
9. Your rights
Under the GDPR (and equivalent rights under the UK GDPR, Swiss FADP, and Japanese APPI) you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data, subject to our legal retention obligations.
- Restriction — ask us to restrict processing pending resolution of a request.
- Portability — receive your data in a structured, commonly used, machine-readable format.
- Object — to processing based on legitimate interest, including direct marketing.
- Withdraw consent — where processing is based on consent, at any time, without affecting prior processing.
- Lodge a complaint with a supervisory authority — for Norway, Datatilsynet (datatilsynet.no); for other jurisdictions, your local supervisory authority.
To exercise any of these rights, contact us at compliance@catenda.com. We respond within one (1) month, extendable by two further months for complex requests.
10. Children
Catenda's services are intended for business use. If we become aware that we hold personal data of someone under 16, we will delete it.
11. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to active subscription customers at least 30 days in advance via email or in-app notification. The current version is always at catenda.com/privacy-policy.
12. Contact
Catenda AS Drammensveien 288, 0283 Oslo, Norway Email: compliance@catenda.com Web: catenda.com
For matters specifically relating to Catenda Japan KK customers: same email, with "Japan" in the subject line.