Privacy Policy

1. Introduction, Scope, and Acceptance

This Privacy Policy ("Policy") explains how Halden Solutions AS and its subsidiaries, affiliates, and related entities (collectively, "Halden Solutions," "Halden," "we," "us," or "our") collect, use, disclose, retain, transfer, and otherwise process personal data in connection with:

• the website located at haldensolutions.com and any successor, related, or regional domains we operate (collectively, the "Site");
• the contact and enquiry forms, newsletter subscription tools, meeting-booking integrations (including Calendly), insights and publications, and the client-side "Halden AI" assistant / voice-agent demo made available on the Site (collectively, together with the Site, the "Services"); and
• any other interaction you have with us that links to this Policy, including emails, phone calls, sales conversations, trade-show or conference contact exchanges, and social media interactions.

This Policy is directed at visitors, prospective clients, current clients' personnel who interact with our marketing properties, job applicants, vendors, and other individuals who interact with the Services in a personal, non-engagement capacity ("you," "your," a "visitor," or a "data subject"). It does not govern personal data that Halden Solutions processes on behalf of a client in the course of delivering consulting, engineering, security, managed-operations, or training services under a signed Master Services Agreement, Statement of Work, Order Form, or Data Processing Agreement (each, an "Engagement Agreement"). That category of data, and our role as a processor/service provider with respect to it, is addressed separately in Section 20 ("Data We Process on Behalf of Clients") and is primarily governed by the applicable Engagement Agreement and any Data Processing Addendum executed with the relevant client, which will control in the event of any conflict with this Policy.

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you should discontinue use of the Services. Where required by applicable law (for example, where processing depends on your consent), we will separately request that consent before undertaking the relevant processing, and your continued use of the Site alone will not be treated as consent to processing that legally requires an affirmative opt-in.

This Policy is designed to comply with, among other frameworks, the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the UK GDPR and Data Protection Act 2018, the Norwegian Personal Data Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act and other U.S. state comprehensive privacy laws as they take effect, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), Brazil's Lei Geral de Proteção de Dados ("LGPD"), and applicable data protection laws of the United Arab Emirates (including the UAE Federal Decree-Law No. 45 of 2021 and DIFC/ADGM data protection regulations where relevant to our free-zone dealings), the Kingdom of Saudi Arabia's Personal Data Protection Law, the State of Israel's Privacy Protection Law, and other data protection laws of the jurisdictions in which we operate or in which our visitors, clients, and prospective clients are located. Where any provision of local mandatory law grants you rights broader than those described here, that local law governs to the extent required, and nothing in this Policy limits any non-waivable right you hold under the law of your habitual residence.

2. Who We Are — Data Controller Information

For the purposes of the GDPR and equivalent laws, the data controller responsible for personal data collected through the Services (except where Section 20 applies) is:

Halden Solutions AS Registered office: [registered office address — to be inserted] Organization / company registration number: [organization number — to be inserted] Country of incorporation: Norway Contact for all privacy, data protection, and legal matters: legal@haldensolutions.com

We have not appointed a statutory Data Protection Officer because we are not currently required to do so under applicable law. All privacy inquiries, including requests to exercise the rights described in Section 12, should be directed to legal@haldensolutions.com, which we treat as our single point of contact for privacy, security, and legal notices of every kind. Where we engage a local representative in the European Union, United Kingdom, or elsewhere as required by Articles 27 GDPR or UK GDPR, that representative's contact details will be published here and/or provided upon request.

3. Definitions

• "Personal data" (used interchangeably with "personal information") means any information relating to an identified or identifiable natural person, or, where applicable under a given law, information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household.
• "Processing" means any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Controller" means the entity that determines the purposes and means of processing personal data; "processor" or "service provider" means an entity that processes personal data on a controller's behalf and under its instructions.
• "Special category" or "sensitive" data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, or data concerning a person's sex life or sexual orientation, and, under U.S. state laws, similarly defined "sensitive personal information" (which may also include precise geolocation, government identifiers, and account credentials).
• "Cookies" and "similar technologies" means small data files and comparable mechanisms (local storage, pixels, tags, SDKs) placed on or read from your device, described further in Section 8.
• "Sale" and "sharing" have the meanings given under the CCPA/CPRA and equivalent state laws, generally referring to the disclosure of personal information for monetary or other valuable consideration, or for cross-context behavioral advertising.
• "Client Data" means personal data and other information that Halden Solutions accesses, receives, hosts, or processes on behalf of a client in the course of a paid consulting, engineering, or managed-operations engagement, as described in Section 20.

4. Information We Collect

We collect personal data through the categories described below. Not every visitor will trigger every category; the data actually collected depends on how you interact with the Services.

4.1 Information You Provide Directly

• Contact / enquiry form. When you submit our contact form we collect your first name, last name, work email address, telephone country code and phone number, the subject/topic of your enquiry, and the free-text message you write. We specifically prompt for a work email address rather than a personal one; if you submit a personal email address, we may still process it for the same purposes, but you should assume any message you send us using that channel is treated as a business enquiry.
• Newsletter subscription. When you subscribe to our newsletter we collect your email address, together with your subscription timestamp, source page, and (where applicable) the fact that our form asked you to use a business email address.
• Meeting bookings. When you use the "Book a Meeting" link, you are transferred to Calendly, a third-party scheduling service operated by Calendly, LLC. Calendly will collect your name, email address, meeting details, and any information you choose to enter into its scheduling form directly, subject to Calendly's own privacy policy and terms, which we encourage you to review. We receive booking confirmation details (name, email, meeting time, and any notes you provide) from Calendly in order to prepare for and attend the meeting.
• The "Halden AI" assistant / voice-agent demo. When you open the in-browser assistant widget and type or speak a question, we process the text of your question and the assistant's generated reply for the duration of your browser session in order to produce a response. If you click the microphone control, speech-to-text conversion is performed by your own browser's built-in speech-recognition capability (for example, the Web Speech API as implemented by your browser vendor), which may transmit audio to that vendor's own servers under that vendor's own privacy practices — this occurs outside our systems and outside our control, and is governed by your browser's own privacy policy, not this one. The assistant is a demo feature that answers only from information already published on the Site; it is not used to build a persistent profile of you, and we do not intentionally use it to derive or infer sensitive characteristics about you. See Section 17 for further detail on this feature and its limitations.
• Correspondence. If you email us, call us, message us on social media, or otherwise correspond with us outside of the forms above, we collect the contents of that correspondence together with any personal data you choose to include in it, and any metadata associated with the communication (such as the sending address, timestamp, and, for calls, the phone number used).
• Business-card and event information. If you provide us with a business card, meet us at a conference, or otherwise voluntarily share your contact details in person or via a third-party platform (such as LinkedIn), we may add that information to our customer relationship management system for legitimate business-development purposes as described in Section 5.
• Job applications. If we publish open roles and you apply, we collect the information contained in your application, resume/CV, cover letter, and any related correspondence, references, or interview notes, for recruitment purposes.
• Content you choose to submit. Any content you voluntarily submit through the Services — including testimonials, quotes you agree to provide, or feedback — is collected together with your name and any other details you include, subject to Section 15 of our Terms of Use governing user-submitted content.

4.2 Information Collected Automatically

When you browse the Site, our servers and hosting/CDN infrastructure automatically log standard technical information, including: your IP address; approximate geolocation derived from your IP address (typically city/region/country level only); browser type and version; operating system and device type; device identifiers; referring and exit pages; the pages, links, and content you view or interact with; timestamps and duration of visit; language settings; and, where applicable, crash and error diagnostics. This information is collected via standard web-server and hosting-infrastructure logging practices and, where cookies or similar technologies are used to support it, through the mechanisms described in Section 8.

4.3 Information We Receive From Third Parties

We may receive personal data about you from: (a) Calendly, in connection with meetings you book (Section 4.1); (b) our email delivery and newsletter platform, which provides engagement metrics such as opens, clicks, bounces, and unsubscribe events tied to your email address; (c) publicly available sources such as company websites, business registries, and professional networking platforms (for example LinkedIn), which we may use to qualify or enrich a business lead consistent with applicable law; (d) partners, resellers, or referral sources who introduce you to us, where they have confirmed they had a lawful basis to share your details; (e) our hosting, security, fraud-prevention, and analytics vendors, to the extent such vendors are engaged; and (f) publicly available social media profiles you use to engage with our published content.

4.4 Special Category / Sensitive Data

We do not intentionally solicit or collect special category or sensitive personal data (such as health information, racial or ethnic origin, religious beliefs, biometric identifiers, or precise real-time geolocation) through the Services, and we ask that you not include such information in any contact form, message, or communication with us unless we have specifically and separately requested it in connection with a legitimate purpose (for example, dietary or accessibility requirements for an in-person event). If you nonetheless submit sensitive information to us voluntarily, we will treat it as being provided with your explicit consent to the limited processing necessary to address your communication, and will apply additional safeguards to it, but you should not assume such information is necessary or expected, and we encourage you not to volunteer it through public-facing web forms.

4.5 Children's Data

The Services are directed at businesses and professionals and are not intended for, marketed to, or designed to attract individuals under the age of 16 (or the higher age of digital consent applicable in your jurisdiction, or 18 where local law treats that as the relevant threshold for a binding transaction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child in violation of applicable law, we will take reasonable steps to delete that information promptly. If you believe a child has provided us with personal data, please contact legal@haldensolutions.com.

5. How and Why We Use Personal Data

We use personal data for the following purposes, each mapped, for GDPR purposes, to the applicable legal basis under Article 6(1) GDPR (and, for special category data, Article 9 where relevant):

We do not use personal data collected through the Services to make decisions that produce legal effects concerning you, or similarly significant effects, based solely on automated processing (including profiling), without human involvement. The "Halden AI" assistant described in Section 17 generates informational responses only; it does not make or materially influence any decision about you, your eligibility for services, or your legal rights.

6. Cookies and Similar Technologies

The Site currently relies primarily on strictly necessary cookies and comparable local-storage mechanisms needed for basic functionality (for example, remembering that you dismissed a notice, or maintaining form state during a single session). We reserve the right to add, and this Policy is drafted to also cover, additional categories of cookies and tracking technologies in the future, which — when added — will fall into one or more of the following categories:

• Strictly necessary cookies, required for the Site to function (for example, security, load balancing, and session-management cookies). These cannot be switched off and do not require consent under applicable e-privacy laws.
• Functional / preference cookies, which remember choices you make (such as display preferences) to improve your experience.
• Analytics / performance cookies, which help us understand how visitors use the Site in aggregate (for example, via a web-analytics platform), so that we can improve content and navigation.
• Marketing / advertising cookies and pixels, which, if deployed, would be used to measure the effectiveness of our marketing and, potentially, to show you more relevant content on other platforms.

Where we deploy non-essential cookies (analytics, marketing, or similar technologies not strictly necessary for the Site to run), we will provide a cookie-consent mechanism that allows you to accept or reject those categories before they are set, consistent with the EU ePrivacy Directive, GDPR, UK PECR, and equivalent laws, and we will honor your choice. You can also control cookies generally through your browser settings, including blocking or deleting cookies; note that doing so may affect the functionality of the Site. We currently load web fonts from Google Fonts (fonts.googleapis.com / fonts.gstatic.com), which may result in your browser sending your IP address to Google as part of standard font-delivery; Google's handling of that data is governed by Google's own privacy policy.

Do Not Track and Global Privacy Control. Some browsers transmit "Do Not Track" (DNT) signals. Because no common industry standard for interpreting DNT has been adopted, we do not currently respond to DNT signals differently from a normal browsing session. Where we deploy technologies that constitute a "sale" or "sharing" of personal information under the CCPA/CPRA or a comparable state law, we will recognize and honor the Global Privacy Control (GPC) signal, where technically detectable, as a valid opt-out request under those laws.

7. How We Share Personal Data

We do not sell personal data for money, and we do not otherwise "sell" or "share" (as those terms are defined under the CCPA/CPRA) personal data collected through the Services for cross-context behavioral advertising, except that if we later deploy advertising or retargeting pixels as described in Section 6, we will update this Policy and provide the required opt-out mechanisms before doing so. We disclose personal data only in the following circumstances:

• Service providers and processors, engaged under written agreements requiring them to protect personal data and use it only for the purposes we specify, including: scheduling providers (Calendly); email delivery and marketing-automation platforms; cloud hosting, content-delivery, and infrastructure providers; website analytics providers (if and when deployed); customer-relationship-management (CRM) platforms; IT security and fraud-prevention vendors; and professional advisors such as our accountants, auditors, and outside counsel, who are bound by confidentiality obligations.
• Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, dissolution, or sale of some or all of our assets (whether as a going concern or as part of insolvency proceedings), personal data may be disclosed to counterparties and their advisors as part of that transaction, and may be transferred as one of the transferred assets, subject to standard confidentiality protections and, where required by law, notice to affected individuals.
• Legal compliance and protection of rights. We may disclose personal data where we believe in good faith that disclosure is reasonably necessary to: comply with a law, regulation, legal process, or enforceable governmental request; enforce our Terms of Use or other agreements; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Halden Solutions, our clients, our personnel, or the public, as required or permitted by law.
• With your direction or consent. Where you have asked us to share your information with a named third party, or have otherwise given consent for a specific disclosure.
• Aggregated or de-identified data. We may share information that has been aggregated or de-identified such that it can no longer reasonably be used to identify you, without restriction, for research, benchmarking, or business-analysis purposes.

We require our service providers, by contract, to use personal data solely to perform services on our behalf, to maintain appropriate security, and not to use it for their own independent marketing purposes, except where you have a direct relationship with that provider (for example, Calendly) governed by that provider's own privacy terms.

8. International Data Transfers

Because we operate and serve clients across Europe, the Middle East, and the Americas, personal data we collect may be accessed, stored, or processed in countries other than the one in which you are located, including countries that may not have data protection laws equivalent to those of your home jurisdiction. Where we transfer personal data originating in the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards recognized under applicable law, which may include: the European Commission's Standard Contractual Clauses (and, for UK-originating transfers, the UK International Data Transfer Addendum or equivalent), supplemented by additional technical, contractual, and organizational measures where required following a transfer risk assessment; reliance on an applicable adequacy decision; or your explicit consent to a specific transfer, obtained where legally required. For transfers of personal data originating from the Middle East jurisdictions in which we operate, we apply the safeguards required under the applicable local data protection law (including, where relevant, standard contracts recognized by the UAE Data Office or comparable regulator). You may request further information about the safeguards we use for a specific transfer by contacting legal@haldensolutions.com.

9. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, taking into account the nature of the data, the purposes of processing, and applicable legal, tax, accounting, and regulatory retention requirements. As general (and, in each case, subject to extension where necessary for legal claims, audits, or a longer statutory retention period in a given jurisdiction) guidance:

• Contact-form and sales-enquiry data is retained for the duration of the prospective relationship and, if no engagement results, typically for up to thirty-six (36) months from last contact, to allow follow-up on business opportunities, after which it is deleted or anonymized unless a longer period is required for a legitimate business or legal purpose.
• Newsletter subscriber data is retained until you unsubscribe, plus a reasonable period thereafter (typically up to ninety (90) days) to process the unsubscribe request and maintain suppression lists that prevent us from re-contacting you in error.
• Client and engagement-related business contact data (as opposed to Client Data under Section 20) is retained for the duration of the client relationship and thereafter for the period required by applicable statutory, accounting, tax, or contractual record-keeping obligations, which in many of the jurisdictions in which we operate ranges from five (5) to ten (10) years following the end of the relationship.
• Website server and security logs are typically retained for up to twenty-four (24) months for security, fraud-prevention, and diagnostic purposes.
• Job application data is retained for the duration of the recruitment process and, for unsuccessful candidates, for a reasonable period thereafter (typically up to twenty-four (24) months) in case a future suitable role arises, unless you ask us to delete it sooner or applicable law requires a different period.
• Data subject to a legal hold, dispute, or investigation is retained for as long as necessary for that purpose, notwithstanding the above guidance.

Where retention periods are not fixed by law, we determine the appropriate retention period based on the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and whether we can achieve the purposes of processing through other means.

10. Data Security

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk presented by the processing. These measures include, as applicable: encryption of data in transit using industry-standard protocols (TLS/HTTPS); access controls based on the principle of least privilege; segregation of duties; confidentiality obligations imposed on personnel and contractors with access to personal data; vendor security due diligence; and incident-detection and response procedures. No method of transmission over the internet, and no method of electronic storage, is 100% secure. While we strive to use commercially reasonable means to protect personal data, we cannot guarantee its absolute security, and you provide information to us at your own risk. In the event of a personal data breach that triggers a legal notification obligation, we will notify affected individuals and/or the competent supervisory authority within the timeframes required by applicable law (for example, without undue delay and, where feasible, within 72 hours of becoming aware of a qualifying breach under Article 33 GDPR).

11. Your Privacy Rights

The rights available to you depend on where you live and which law applies to you. We honor the rights described below to the extent they are legally applicable to your relationship with us, and, as a general practice, we aim to extend a consistent baseline of rights (access, correction, deletion, and the ability to object to marketing) to all visitors regardless of location, even where not strictly mandated.

11.1 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

Subject to the conditions and exceptions set out in applicable law, you have the right to: access the personal data we hold about you; rectify inaccurate or incomplete data; erase your data ("right to be forgotten") in certain circumstances; restrict processing in certain circumstances; object to processing carried out on the basis of legitimate interests, including profiling, and to object absolutely, at any time and without needing to give a reason, to processing for direct marketing purposes; receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller ("data portability"), where processing is based on consent or contract and carried out by automated means; withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and lodge a complaint with a supervisory authority, including the Norwegian Data Protection Authority (Datatilsynet), the UK Information Commissioner's Office (ICO), or the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.

11.2 United States (California, Virginia, Colorado, Connecticut, Utah, and other applicable state laws)

Subject to the exceptions set out in applicable state law, you have the right to: know / access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes of collection, and the categories of third parties with whom we have disclosed it; delete personal information we have collected from you, subject to certain exceptions (for example, where retention is necessary to complete a transaction, comply with a legal obligation, or exercise free speech); correct inaccurate personal information; opt out of the sale or sharing of personal information (we do not currently sell or share personal information as described in Section 7, so there is nothing to opt out of at this time, but we will honor such requests going forward if that changes); limit the use and disclosure of sensitive personal information to what is necessary to provide the Services (we do not use sensitive personal information for purposes beyond that necessary baseline); and not be discriminated against for exercising any of these rights. Where permitted, you may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authority and independently verify your identity. California residents may also request information under California's "Shine the Light" law (Civil Code § 1798.83) regarding disclosures of personal information to third parties for their own direct marketing purposes in the preceding calendar year; because we do not make such disclosures, no information is available under that statute. If your request is denied, you may appeal by replying to our denial with the word "Appeal," and we will respond consistent with applicable law.

11.3 Middle East, Canada, Latin America, and Other Jurisdictions

Where you are located in a jurisdiction with its own applicable data protection law not specifically addressed above — including, without limitation, the United Arab Emirates, the Kingdom of Saudi Arabia, Israel, Canada (PIPEDA), Brazil (LGPD), or another jurisdiction in the Middle East or the Americas in which we do business — we will honor the rights guaranteed to you under that law to the extent legally required, which typically include rights of access, correction, deletion, objection, and complaint to the competent local regulator. If you are uncertain which rights apply to you, contact us at legal@haldensolutions.com and we will advise you of the rights available under the law that governs your relationship with us.

11.4 How to Exercise Your Rights

To exercise any of the rights described above, contact us at legal@haldensolutions.com with sufficient detail to allow us to identify you and understand your request. We will need to verify your identity before acting on certain requests (for example, by matching the email address you contact us from against records we hold, or by requesting additional information), consistent with applicable law and to protect against fraudulent requests. We will respond to verifiable requests within the timeframe required by applicable law (generally within thirty (30) days under GDPR, extendable by a further two months for complex requests, and within forty-five (45) days under most U.S. state laws, extendable by a further forty-five (45) days where necessary), and we will inform you if we need additional time or information. We do not charge a fee to process or respond to a verifiable request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or decline to act on the request, as permitted by applicable law.

12. Marketing Communications

Where we send you marketing communications on the basis of your consent (for example, our occasional newsletter), you may withdraw that consent and unsubscribe at any time by using the unsubscribe link included in every marketing email, replying "unsubscribe," or contacting legal@haldensolutions.com. We will process opt-out requests promptly. Please note that even after you unsubscribe from marketing communications, we may continue to send you non-marketing, transactional, or service-related communications (for example, responses to a support request you initiated, or booking confirmations) where reasonably necessary and permitted by law.

13. Third-Party Websites and Services

The Services may contain links to, or embed content from, third-party websites and platforms, including Calendly (meeting scheduling), YouTube or YouTube-nocookie (embedded video content), and various social media platforms. We are not responsible for the privacy practices, content, or security of any third-party website or platform, even where it is linked from or embedded within the Site. We encourage you to review the privacy policy of every third-party site or service you visit or interact with. The inclusion of a link or embed does not imply endorsement of the linked entity or its content by Halden Solutions.

14. AI-Assisted Features and Content

We use AI tools to assist with drafting and producing certain marketing content on the Site (for example, insights articles, service descriptions, and the client-side "Halden AI" assistant demo described in Section 17). AI-assisted content is reviewed and curated by our team before publication, but automated processes are inherently capable of error; see Sections 17 and the corresponding provisions of our Terms of Use for the applicable disclaimers. Personal data you submit through AI-assisted features on the Site (such as the assistant widget) is processed as described in Section 4.1 and is not used to train any third-party foundation model on your personal data, except to the extent your input is processed transiently by an underlying AI service provider strictly in order to generate a response to you, consistent with that provider's data-processing terms.

15. Notice to California Minors

If you are under 18 and a registered user of the Site (which currently does not offer user accounts), California's "eraser law" (California Business & Professions Code § 22581) may give you the right to request removal of content or information you have publicly posted. As the Site does not currently support public posting by minors, this provision is included for completeness and will apply if such functionality is introduced. We do not knowingly direct the Services at, or engage minors in, our consulting business.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. The "Last updated" date at the top of this page indicates when this Policy was last revised. Where a change is material, we will provide reasonably prominent notice (for example, a banner on the Site or, for material changes affecting how we use data collected under a specific consent, an email to affected subscribers) before the change takes effect. For processing that depends on your consent, a material change will not be applied retroactively to previously collected data without obtaining renewed consent where legally required. Your continued use of the Services after a revised Policy takes effect constitutes your acknowledgment of the revised Policy, except where applicable law requires your affirmative, separate consent, in which case we will seek that consent before proceeding.

17. The "Halden AI" Assistant and Voice Input — Specific Notices

The in-browser assistant ("Ask Halden AI") is an informational demo feature. It is activated only when you deliberately open it; it does not run, listen, or record automatically or in the background, and it does not autoplay audio or begin listening without you first clicking the microphone control. When you type a question, we process the text you enter and generate a response drawn only from information already published on the Site; the assistant is designed not to invent facts about our company, but its output is automatically generated, may nonetheless be incomplete, outdated, or inaccurate, and should not be treated as a definitive, binding, or professionally reliable statement of our services, pricing, availability, or capabilities — see the corresponding disclaimer in our Terms of Use. If you use the microphone control, speech-to-text conversion is performed by your own browser's built-in speech-recognition engine, which, depending on your browser and its settings, may transmit the resulting audio to that browser vendor's own servers for processing under that vendor's own privacy terms — this processing happens outside our infrastructure and outside our control, and we do not receive or retain the raw audio. We do not use voice input for biometric identification or voiceprint matching, and the feature is not designed or intended to build a persistent profile of any individual user across sessions.

18. Unsolicited Business Ideas and Confidential Information

Please do not send us confidential, proprietary, or sensitive business information through the public contact form or similarly informal, non-secured channels unless we have a signed non-disclosure agreement in place. See Section 13 of our Terms of Use for the full "Unsolicited Ideas and Confidential Information" clause, which applies to, and is incorporated into, this Policy by reference.

19. Complaints and Supervisory Authorities

If you have a concern about how we handle your personal data, we ask that you contact us first at legal@haldensolutions.com so that we can try to resolve it directly. You also have the right to lodge a complaint with a competent supervisory authority at any time, including, without limitation: the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no); the UK Information Commissioner's Office (ICO, www.ico.org.uk); the data protection authority of your EU/EEA member state of habitual residence, place of work, or place of the alleged infringement; the U.S. Federal Trade Commission or the Attorney General of your U.S. state of residence; or the equivalent data protection regulator in the Middle East, Canadian, or Latin American jurisdiction in which you are located.

20. Data We Process on Behalf of Clients ("Client Data")

In the course of delivering cloud and platform engineering, data and AI, AI voice-agent, cybersecurity and sovereign cloud, managed operations, and technology training services, Halden Solutions may be given access to, or may host, configure, migrate, secure, or otherwise process, systems and data that belong to our clients, which may include personal data relating to our clients' own employees, customers, contractors, or other individuals ("Client Data"). With respect to Client Data:

• Halden Solutions acts solely as a processor, sub-processor, or service provider on behalf of the client, which remains the controller (or "business," under U.S. state law terminology) responsible for that data;
• Client Data is processed only in accordance with the client's documented instructions, as set out in the applicable Engagement Agreement and any Data Processing Addendum executed between Halden Solutions and the client, which — not this public-facing Policy — governs our handling of Client Data, including the specific technical and organizational security measures applied, sub-processor arrangements, audit rights, breach-notification timelines, cross-border transfer mechanisms (including Standard Contractual Clauses where required), and data-return or deletion obligations upon termination of the engagement;
• individuals whose personal data is contained within Client Data and who wish to exercise a privacy right should, in the first instance, contact the relevant Halden Solutions client directly, as that client is the appropriate controller to receive and respond to such requests; we will reasonably assist our client in responding to such requests as required by the applicable Data Processing Addendum and law; and
• nothing in this Policy is intended to, and nothing in this Policy does, create any rights for a data subject as against Halden Solutions with respect to Client Data, except as required by mandatory applicable law or as expressly set out in a Data Processing Addendum to which that data subject's controller is a party.

21. Contact Us

If you have questions, concerns, or requests relating to this Policy or our data practices, please contact:

Halden Solutions AS Email: legal@haldensolutions.com Registered office: [registered office address — to be inserted]

We aim to acknowledge privacy-related inquiries within a reasonable time and, in any event, within the timeframes required by applicable law as described in Section 11.4.