Privacy policy

1. Data controller

HEM, a sole proprietorship registered in Norway with organisation number 924 807 342 and business address Folke Bernadottes vei 6, 0862 Oslo, is the data controller for personal data collected through HMS Lederkurs (hmslederkurs.no). HMS Lederkurs is the trading name used for this service.

Privacy inquiries: the contact form at hmslederkurs.no/en/support, marked "privacy".

The service is not directed at children under 16. We do not knowingly process personal data about minors.

2. Data we process

We collect:

• Name and email (sign-in, certificate, communication).
• Employer / organisation if provided for the certificate.
• Course progress, lesson quiz answers, and final test results.
• Invoice data (amount, buyer, organisation number for business purchases) for bookkeeping.
• The content of support requests and ticket threads.
• Technical: IP address, user-agent, attribution tags at checkout (gclid, utm_*, referrer, landing page).
• Session cookie (hms-session). first-party, strictly necessary for sign-in.
• The 40-hour safety representative course: answers and photos you enter in the workplace tasks, the hours you report, and the active time the platform records per lesson and day.
• The manager's name, e-mail, role, response and timestamp when you ask your manager to confirm the action plan (task 5).
• Requests for AI tips, when the feature is switched on: the text of one task answer after we have automatically removed names we know of, e-mail addresses, phone numbers, organisation numbers, national identity numbers and links (automatic removal is not perfect), the tips that come back, and a log of the requests without any text (time, task, outcome and size).
• Feedback you give on a course: stars, the text you write and your answer about possibly showing it on the website.

3. Purpose and legal basis

• Deliver the course and issue the certificate: GDPR art. 6(1)(b) (contract).
• Bookkeeping and retention of invoice documents for 5 years: art. 6(1)(c) (Bookkeeping Act §13).
• Prevent fraud, secure the service, measure aggregate usage: art. 6(1)(f) (legitimate interest).
• Measure the effectiveness of marketing channels via first-party attribution (gclid, utm_*): art. 6(1)(f). We set no third-party cookies without your consent.
• Send you email about similar courses we offer ourselves after you have bought from us: art. 6(1)(f) (legitimate interest), within the limits of the Norwegian Marketing Control Act §15 third paragraph. You can reserve against it already when you enter your email address at checkout, and in every email we send. The same reservation also stops the request for feedback (see the point on feedback below).
• Delivering the 40-hour safety representative course, assessing the tasks and producing the employer report when you bought the course yourself: art. 6(1)(b) (contract with you). If your employer bought your seat, the contract is between your employer and us. Delivery, assessment, the overview of progress and folder status while the course is running, and the report to the person who ordered the seats (once the folder has been assessed and is complete) then rest on art. 6(1)(f): the employer's legitimate interest in documenting the training of safety representatives, see Working Environment Act section 6-5 and the regulation on organisation, management and participation §3-18. You can object to this processing under art. 21(1), see your rights below. Recorded active time is used as documentation in the report. It and the times you completed each lesson are shown to the course lead when the folder is assessed. They never block you.
• The manager confirmation: the manager is a third party. We process the data to document the review of the action plan at the request of the participant and the employer, based on art. 6(1)(f) (legitimate interest). The manager is informed about this in the e-mail and may choose not to respond. The manager can object to the processing under art. 21(1) and ask for access or erasure through the contact form, marked "personvern".
• AI tips: only if you switch them on and ask for them. The basis is your consent under art. 6(1)(a), which you can withdraw at any time. We then delete the tips. A log of the requests without any text is kept for up to 90 days to prevent abuse and control costs, based on art. 6(1)(f). The tips do not affect the assessment, and the course lead never sees them.
• Asking for and receiving feedback on the courses, to improve the courses and the service: art. 6(1)(f) (legitimate interest). After each certificate we may ask you once by e-mail about that course, and at most once every 30 days. You can reserve against it already when you enter your e-mail address at checkout and in that e-mail, and we do not ask if you have reserved against e-mail from us. Your employer does not see your feedback.
• Showing your feedback on the website, anonymously or with your first name: only if you said yes to it, art. 6(1)(a) (consent). You can withdraw that consent at any time in the same form or through the contact form. If you say no, the feedback is used internally only.

4. Storage and deletion

Concrete retention periods:

• Invoice documents and payment references: 5 years (Bookkeeping Act §13, primary documentation).
• Certificate data: as long as your user account is active. You can request deletion at any time (the invoice records above persist for the 5-year period).
• Course progress and quiz answers: as long as the account is active; anonymised on deletion.
• Support threads: 24 months from the last message.
• Attribution data (gclid, utm_*): 24 months.
• Session cookie and sign-in codes: session 30 days rolling, one-time codes 10 minutes.
• Email logs (recipient, subject and delivery status): 12 months. E-mails with task answers, assessment comments or the manager's reply are not stored with their content once sent.
• Task answers, photos, manager confirmation, recorded time and assessment comments in the safety representative course: 2 years after the folder was assessed and approved (one safety representative term), so the report can be retrieved again during that time. After that all of it is deleted automatically, while the certificate is kept. A folder that was sent back and not changed since is deleted 2 years after the last assessment and the last change. You can ask for earlier deletion. Answers, recorded time and the note to the course reviewer in a folder that was never submitted are deleted once nothing in the course has changed for 12 months. Photos in a folder that has not been paid for are deleted once you have done nothing in the course for 30 days, and the task they belonged to goes back to draft. Requests to a manager that do not end in a confirmation are deleted 30 days after they expired, were declined or were withdrawn, together with the e-mails about them. A photo you remove after the folder has been submitted is kept in the review history and deleted once the folder has been assessed, at the earliest 30 days after you removed it. If you withdraw from the purchase after the folder has been submitted, or the seat is refunded, the folder is deleted 30 days after the refund, also if it has not been submitted yet. A folder that has already been assessed and approved follows the 2-year rule above.
• Log of AI requests, with the time of consent and which version of the consent text each request relied on: 90 days. If you withdraw consent, we delete the tips straight away, but the log is kept for the rest of the period as evidence that the requests had consent.
• Course feedback: 3 years from when you sent or last changed it. After that it is deleted automatically.

If you want your data deleted earlier, send us a message through the contact form (marked "privacy") and we will remove what we can within legal requirements.

5. Processors and recipients

We share personal data with the following categories of providers, only to the extent necessary to deliver the service. A data processing agreement (GDPR art. 28) is in place with each of the providers listed.

• Stripe. payment processing. Headquartered in the EU (Ireland), data channels in the USA. Transfer basis: Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Resend. email delivery (transactional and support replies). EU region eu-west-1.
• Hetzner Online GmbH. server and database hosting. EU (Nürnberg / Falkenstein, Germany).
• Cloudflare. CDN, edge TLS, and DDoS protection. Global network with EU/USA nodes; transfer basis SCCs and EU-US DPF.
• Bugsink. error reporting from the website and the server. We run Bugsink ourselves on the same Hetzner server as above (Germany, EU), and reports are sent through our own domain. No additional provider receives the error data.

Recipients that are not processors

Your employer, if it bought your seat in the 40-hour safety representative course: the person who ordered the seats can download the report with task answers, photos, reported time, total recorded time and the manager confirmation once the folder has been assessed and is complete. The employer is a recipient, not our processor. If you bought the course yourself, you decide whether to pass the report on. If a company bought your seat in any course, the person who ordered the seats can see how far you have come while the course is running (the number of completed lessons and whether the certificate has been issued). In the 40-hour safety representative course they can also see the status of the folder (not submitted, in review, sent back, assessed), but not the answers or the comments until the report is ready.

We never sell personal data, and do not use it for third-party marketing.

6. Your rights

Under GDPR you have the right to:

• access the data we hold about you,
• rectification of inaccurate data,
• erasure where possible within legal requirements (bookkeeping is an exception),
• restriction or objection to processing based on legitimate interest,
• object to direct marketing (GDPR art. 21(2)). If you object we stop all marketing email to you, no reason needed and no cost,
• data portability for data you have provided us.

Send requests through the contact form at hmslederkurs.no/en/support, marked "privacy". We normally respond within 30 days.

7. Right to lodge a complaint with Datatilsynet

You have the right to lodge a complaint about our processing of personal data with Datatilsynet (the Norwegian Data Protection Authority). We encourage you to contact us first through the contact form so we can try to resolve the matter directly.

8. Automated decision-making

We make no automated decisions or profiling that have legal or similarly significant effects on you. Quizzes and the final knowledge test are scored automatically, but the result is a mechanical count of correct answers. not an evaluation of the person.

The assessment of the workplace tasks in the safety representative course is made by a person. AI tips are guidance for you only and are not part of the assessment.

9. Cookies

Strictly necessary (always set; the service cannot function without them):

• hms-session: first-party session cookie that keeps you signed in. Lifetime 30 days rolling. Only set after you sign in.
• Short-lived technical cookies for CSRF protection and language preference. Lifetime bounded by the session, max 30 days.

Marketing and attribution (only set if you arrive with a tracking parameter in the URL, typically from a Google Ads click):

• hms-gclid and hms-gclid-type: first-party cookies that store Google's click identifier (gclid, gbraid or wbraid) when present on the landing URL. Lifetime approximately 90 days. Purpose: link a later purchase back to the originating ad so we can measure which campaigns convert. Legal basis: art. 6(1)(f), legitimate interest in measuring marketing performance.
• utm_* parameters (utm_source, utm_medium, utm_campaign, and similar) are read from the URL at checkout and stored with the order in the database, not in a cookie.

We set no third-party tracking, analytics or advertising cookies, and use neither Google Analytics, Facebook Pixel nor similar tools. All measurement happens on our own server through the cookies listed above.

10. Changes to this policy

We may update this policy when the service or applicable regulations change. The current version is published on this page. Material changes are notified by email to registered users.

11. Contact

For privacy questions and everything else: the contact form at hmslederkurs.no/en/support. We do not receive e-mail, but we reply to the address you enter in the form.