1. What data do we collect?

• Name, date of birth, nationality, contact details
• CV, certifications, course records, medical certificate (offshore)
• Police certificate and ID documentation (only where required for specific assignments)
• Employment history and work experience
• Any additional information you choose to send us

2. Purpose and legal basis

We process data in order to:

• Recruitment — assess whether we have assignments matching your profile (legal basis: consent / legitimate interest)
• Staffing assignments — present you to client companies (legal basis: contract)
• Compliance — meet statutory requirements for offshore work, NORSOK, ISO 9001/29001 (legal basis: legal obligation)
• Invoicing and payroll (legal basis: contract)

3. Where is the data stored?

All data is stored on servers within the EU/EEA (Supabase, Stockholm, Sweden). Files are held in private, encrypted object storage. Our provider has entered into a data processing agreement (DPA) ensuring GDPR-compliant processing.

4. Who do we share data with?

• Client companies (operators such as Equinor, Aker BP and others) — only upon active assignment, and only the necessary information
• Anthropic (USA) — CV text is sent to Claude AI for structured extraction. Anthropic is certified under the EU-US Data Privacy Framework. Data is not used for training.
• Resend (EU) — for sending email only (name + email address)
• Vercel (EU) — hosting and delivery of the website

We never sell personal data, and we do not share it with third parties beyond what is necessary to deliver the service.

5. Retention periods

• Active employees: for the duration of the employment or assignment relationship
• Former employees: up to 5 years for accounting purposes, then deleted
• Applications received without a subsequent agreement: up to 12 months, then deleted

6. Your rights

You have the right to:

• Access the information we hold about you
• Have inaccurate information corrected
• Have your data erased (the “right to be forgotten”)
• Restrict or object to the processing
• Data portability (export of your data)
• Withdraw consent at any time
• Lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no)

To exercise your rights, contact us at marius@aid-a.no. We respond to enquiries within 30 days.

7. Security

We apply industry-standard security controls, including:

• TLS 1.3 encryption of all data in transit
• Encrypted storage (AES-256) of files and databases
• Strict role-based access control (admin/coordinator/reader)
• Audit logging of all changes
• Security headers (HSTS, CSP, X-Frame-Options)
• Rate limiting and bot protection on public forms

8. Cookies

We use only strictly necessary cookies for authentication in the portals, plus one cookie that remembers your language choice. The public website uses no tracking or marketing cookies.

9. Contact

AIDA AS
Org. no. 926 068 040
Austråttbakken 40A, 4326 Sandnes, Norway
Email: marius@aid-a.no
Data controller: Marius A. Jakobsen, CEO