Datenschutzerklärung

Would you like this document in your own language? Contact us at hello@lekko.tech.

NelMil AS, Terrasseveien 31 E, 1363 Høvik, Norway, company registration number 934 480 724, which provides the Lekko service ("NelMil", "Lekko", "we", "us" or "our"), is the data controller for personal data as described here.

Lekko is a tool for internal control of playground equipment, made for use by organisations and the people they invite in. This policy applies to visitors to our website, customers and prospective customers, invited users, and people who contact us. It does not replace any data processing agreement between Lekko and a customer.

1. Roles and responsibilities

When an organisation uses Lekko to manage equipment, inspections and deviations, the organisation is the data controller for personal data about its own users, and Lekko is the data processor, processing that data only on the customer's instructions (GDPR, the Norwegian Personal Data Act, the data processing agreement).

Lekko is itself the data controller for information we process for our own purposes: sales and marketing, account administration, invoicing, support, security, improvement and compliance with legal obligations. The data processing agreement is available at lekko.tech/dpa.

2. Categories of personal data

• Users invited by a customer: name, email address, organisational affiliation, role, time of login and actions, and technical metadata (including IP address).
• Customers and business contacts: name, organisation, contact details, contract and invoicing information, and correspondence.
• Website visitors: IP address, device and browser information, and information from cookies (see section 8).
• Newsletter: name and email address provided on sign-up.

Lekko is designed to document equipment and routines, not people. We do not process special categories of personal data (GDPR article 9).

3. Purposes and legal basis

As a data processor, we process information in order to deliver Lekko, enable inspections and deviation handling, maintain history and ensure reliable operation, with the legal basis determined by the customer.

As a data controller, we process on the basis of:

• Contract (article 6(1)(b)): account creation, delivery, invoicing, support.
• Legitimate interest (article 6(1)(f)): improvement, security, prevention of misuse, communication with existing customers about the service.
• Legal obligation (article 6(1)(c)): accounting, tax and other statutory retention.
• Consent (article 6(1)(a)): non-essential cookies, marketing and newsletters. Consent may be withdrawn at any time.

4. Retention periods

• Customer and user data: deleted within a reasonable time after the subscription ends, following a period in which the customer can export the data.
• Invoicing and payment data: in accordance with bookkeeping legislation (normally 5 years).
• Email and support enquiries: up to 24 months, unless longer retention is necessary for legal reasons.
• Newsletter and marketing: until you unsubscribe or object.

Once the retention period has expired, the information is deleted or anonymised.

5. Sub-processors

We use a limited number of sub-processors, bound by agreements in accordance with GDPR article 28. An up to date overview is available at lekko.tech/sub-processors.

6. Transfers outside the EEA

Personal data is processed within the EU/EEA. The database and images are stored in Frankfurt (AWS Europe Central 1), and email is sent via a provider in the EU (Ireland). If a sub-processor in individual cases accesses data from outside the EEA, the transfer is safeguarded by appropriate measures (the EU standard contractual clauses). Details per provider: lekko.tech/sub-processors.

7. Security

We have appropriate technical and organisational measures in place (GDPR article 32): role-based access control, passwordless login, encryption in transit and at rest, logging, backups, and secure development and operating routines.

8. Cookies

Essential cookies are set without consent, because the service does not work without them. Non-essential cookies are set only with consent, obtained via a banner on your first visit, and your choice can be changed at any time via "Cookies" in the footer. Full overview: lekko.tech/cookie-policy.

9. Your rights

You may request access, rectification, erasure, restriction and data portability, and you may object to processing or withdraw your consent. Where the information is processed on behalf of a customer, requests should be directed to that customer. Otherwise: hello@lekko.tech. You may lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no), or with the supervisory authority in the country where you live or work.

10. Automated decision-making

We do not use personal data for automated decision-making or profiling with legal or similarly significant effects (GDPR article 22).

11. Data protection officer

Lekko is not required to appoint a data protection officer (GDPR article 37) and is established within the EEA. For privacy questions: hello@lekko.tech.

12. Changes

We may update this policy. Material changes will be notified in advance. Previous versions are available on this page.

13. Contact

NelMil AS Terrasseveien 31 E, 1363 Høvik, Norway hello@lekko.tech