Privacy Policy

The data controller for personal data processed through this website and the Salgssystem platform is:

Lead Magnet AS is established in Norway. For users of the Salgssystem platform, we typically act as the data processor for personal data you upload to your workspace (your customers, contacts, deals), and as the data controller for account, billing, and platform-usage data. This distinction matters because it determines who is responsible for any given dataset — see Section 8 for the workspace data agreement.

We collect personal data in three categories:

Account data

Name, email address, password hash, workspace name, job title, profile picture, language preference, authentication method (password, passkey, Google, Microsoft), and the time of your last sign-in. We need this to create your account, authenticate you, and provide the platform.

Platform usage data

Pages and features you use, API requests made on your behalf, error logs, browser type, IP address, device type, and approximate location derived from IP. We use this to operate the platform, fix problems, and improve the product.

Workspace content

Companies, contacts, deals, agreements, quotes, tasks, emails, attachments, notes, and any other content you or your colleagues create or import into your workspace. This often contains personal data about your customers and prospects. You are the controller for this data; we are the processor (see Section 8).

Billing data

Company name, billing address, VAT number, payment method (handled by Stripe — we never see your full card number), invoices, and subscription status.

Website and marketing data

If you visit salgssystem.no, request a demo, or sign up for a trial, we record the form data you submit and basic analytics about your visit. The marketing site does not use third-party advertising cookies.

Under the GDPR, we need a legal basis for each processing purpose. Ours are:

To provide the platform (Article 6(1)(b) GDPR — contract)

Account creation, authentication, workspace data storage, billing, and customer support. Without this processing we cannot deliver the service.

To operate and improve the platform (Article 6(1)(f) — legitimate interests)

Error logs, performance monitoring, security event detection, abuse prevention, and aggregate product analytics. We balance these interests against your rights; you can object at any time.

To meet legal obligations (Article 6(1)(c))

Bookkeeping (Norwegian Bookkeeping Act — 5 years), tax compliance, and responding to lawful requests from authorities.

Where you have given consent (Article 6(1)(a))

Optional product communications, beta program participation, and any other processing where we explicitly ask. You can withdraw consent at any time.

We use the following sub-processors to deliver the platform. Each one is bound by a Data Processing Agreement and may only process personal data on our documented instructions.

Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (2021/914) or an adequacy decision. A current list of sub-processors is available on request to privacy@salgssystem.no.

We keep personal data only as long as we need it for the purpose it was collected for, or as required by law:

• Account data: while your account is active, plus 90 days after closure for recovery, then deleted or anonymised.
• Workspace content: while your subscription is active, plus 30 days after termination for export, then deleted.
• Billing records and invoices: 5 years (Norwegian Bookkeeping Act, § 13).
• Application logs and security events: 90 days, then aggregated or deleted.
• Marketing leads and demo requests: 24 months after last contact, unless converted to a customer.

Under the GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to legal retention requirements.
• Restriction — ask us to stop processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format and transfer it elsewhere.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for any processing based on consent.
• Complain to a supervisory authority — in Norway, Datatilsynet (datatilsynet.no).

To exercise any of these rights, email privacy@salgssystem.no. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

We take security seriously. Data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted at the database and storage layer. Access to production systems is restricted to a small number of authorised engineers, logged, and protected by multi-factor authentication. We run regular backups with point-in-time recovery and test our restore procedures. We will notify affected users and Datatilsynet within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to your rights and freedoms, in accordance with Article 33 GDPR.

For the data you and your team upload to your Salgssystem workspace — your customers, contacts, deals, agreements, communications — you are the data controller and we are the data processor. The terms of that relationship are governed by our Data Processing Agreement (DPA), which is incorporated into the Terms of Service by reference. We only process workspace data on your documented instructions, we hold our sub-processors to the same standard, and we will help you respond to data-subject requests directed at you. You can request a signed DPA at privacy@salgssystem.no.

The salgssystem.no marketing site uses only essential cookies needed to remember your language and theme preference. We do not use advertising cookies or third-party tracking pixels on the marketing site. The Salgssystem platform uses cookies for authentication (session and CSRF tokens) and for remembering your in-app preferences. These are strictly necessary for the platform to function and do not require consent under the ePrivacy Directive.

Salgssystem is a B2B sales platform and is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent revision. If we make material changes that affect how we process your personal data, we will notify active users by email or in-product notice at least 30 days before the change takes effect.

For any privacy-related question, data-subject request, or to request a copy of the Data Processing Agreement, contact: