Privacy notice
Updated 28 October 2026
ProCorp AS processes personal data in connection with our services, contact with clients and investors, and use of our website. This notice explains which data we process, why we use it and your rights. It also applies to company contacts and representatives, beneficial owners and other individuals involved in our engagements.
Who is responsible for your data
ProCorp AS is the controller for the processing described here. We process personal data in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).
Company registration number: 912 361 322
Address: Grundingen 2, 0250 Oslo, Norway
Email: post@procorp.no
Telephone: +47 22 47 88 20
Which data we process
Personal data is information that can be linked to an individual. Depending on your relationship with us and the engagement concerned, we process:
Name, address, telephone number, email address, date of birth, national identity number where necessary, and identification documents.
Position, authorisations, ownership and beneficial ownership, and information required for customer due diligence, including source of funds and politically exposed person (PEP) status.
Client classification, investment knowledge and experience, and other information required for the service.
Agreements, subscriptions, orders, allocations, transactions, account and payment information, and settlement details.
Enquiries, complaints, correspondence, and legally required records of telephone conversations and electronic communications.
Where we obtain data
We receive information from you or the company you represent. We also obtain necessary information from public registers, including the Brønnøysund Register Centre, public sources and media, banks, clients and relevant transaction parties, and external sources for PEP, sanctions and background checks where applicable.
What we use data for
We process data for the following purposes and on the following legal bases:
Agreements with individual clients: To enter into and perform agreements, provide services and handle subscriptions, orders and settlements. The legal basis is Article 6(1)(b) GDPR.
Corporate clients and other parties involved: To administer and carry out engagements and communicate with representatives and contacts. Where this is not required by law, the legal basis is Article 6(1)(f). Our legitimate interest is to provide and follow up services and engagements. We assess necessity and balance this interest against your privacy. You may request information about this balancing assessment.
Statutory duties: For customer due diligence and ongoing monitoring, client classification, mandatory client assessments, record-keeping, reporting and bookkeeping. The legal basis is Article 6(1)(c), together with the Norwegian Anti-Money Laundering Act and regulations, the Securities Trading Act and regulations, and bookkeeping legislation. Recording under section 9-17 of the Securities Trading Act covers communications that must be documented by law, including communications relating to relevant orders and transactions.
Enquiries and legal claims: To respond to enquiries and establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) and our legitimate interest in following up enquiries and protecting our rights. Enquiries about entering into an agreement with an individual client may rely on point (b). Statutory complaint handling relies on point (c).
Marketing: Consent-based marketing relies on Article 6(1)(a). We use relevant contact details and any preferences you have provided. You can withdraw consent by contacting us or unsubscribing. Identification documents and customer due diligence information are not used for marketing.
Whether you must provide information
Some information is necessary to enter into or perform an agreement, while other information is required under anti-money laundering and securities legislation. Without necessary information, we may have to decline to establish a client relationship or execute a subscription, order or transaction. Consent to marketing is voluntary.
Who we share data with
We share necessary information with banks, settlement providers, issuers, project companies and other relevant transaction parties where the engagement requires it and there is a lawful basis for sharing. The same applies to auditors, accountants and legal advisers where needed. We disclose information to authorities where legally required or otherwise permitted, including the Financial Supervisory Authority of Norway, the tax authorities and Økokrim.
Providers processing data on our behalf are subject to data processing agreements. Other recipients may act as independent controllers.
We use external providers for services including IT operations, data storage, client administration, electronic signatures, communications and telephone recording. Providers processing personal data on our behalf are subject to data processing agreements.
Whether data is transferred outside the EEA
Some of our providers and their subcontractors may process personal data outside the EEA. This includes services associated with our website, as described below.
Transfers outside the EEA require a valid basis under Chapter V GDPR, such as an adequacy decision or EU Standard Contractual Clauses with the necessary assessments and measures. Contact us for information about applicable safeguards and how to obtain a copy.
How long we retain data
We delete or anonymise data when its purpose has been fulfilled and there is no basis for further retention. The following periods apply:
Anti-money laundering documentation: Generally five years after the client relationship ends or an occasional transaction is completed. The period is ten years where the relationship at its termination, or the occasional transaction, was subject to enhanced customer due diligence, pursuant to section 6-4 of the Norwegian Anti-Money Laundering Regulations.
Mandatory telephone recordings and records of electronic communications under section 9-17 of the Securities Trading Act: Five years, or up to seven years if required by the Financial Supervisory Authority of Norway. Clients may request access within the limits of the applicable rules.
Bookkeeping documentation: In accordance with statutory bookkeeping retention periods, generally five years after the end of the financial year for core accounting records.
Marketing: Data is removed from active mailing lists when consent is withdrawn or you opt out. Necessary records of consent and opt-outs are retained to demonstrate compliance and prevent further mailings.
Other engagement documentation and correspondence are retained for as long as necessary to carry out and document the engagement, comply with legal obligations or establish, exercise or defend legal claims. Data is deleted or anonymised when there is no longer a lawful basis for retention.
How we protect data
We use technical and organisational measures to protect data against unauthorised access, loss and misuse. Access is granted on a need-to-know basis. Employees and others covered by section 10-5 of the Securities Trading Act are subject to its duty of confidentiality.
Whether we use automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Your rights
You can contact post@procorp.no to exercise your rights. You have the right to access and receive a copy of your personal data and to have inaccurate data corrected. Where the conditions under the GDPR are met, you may also request erasure or restriction of processing.
You may object to processing based on legitimate interests on grounds relating to your particular situation. You may always object to direct marketing, in which case we will stop processing for that purpose.
Where processing is based on consent or a contract and carried out by automated means, you may, subject to the GDPR conditions, receive data you have provided in a structured, machine-readable format. You may also request direct transfer to another controller where technically feasible.
You may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal. Statutory retention duties may limit the right to erasure. Anti-money laundering rules may limit the information we can provide about investigations and reporting.
We respond without undue delay and normally within one month. We may request information necessary to verify your identity. You have the right to complain to the Norwegian Data Protection Authority. Information about complaints is available at www.datatilsynet.no.
What is collected when you visit our website
Operations and security
When you visit our website, your IP address and technical information necessary to display the website are processed. This may include the time of access, pages and files requested, browser type and error information. The data is used to deliver the website, maintain stable operation, resolve errors and prevent misuse. The legal basis is our legitimate interest in secure and stable operation under Article 6(1)(f) GDPR.
The website is hosted on a Hetzner server in Helsinki, Finland, managed using Coolify. Bunny.net delivers the website through a content delivery network (CDN). Images and documents are delivered by Sanity, and fonts are loaded from Google Fonts. When these resources are requested, the providers receive your IP address and technical information about the request. This also happens if you decline analytics.
Technical logs are retained for as long as necessary for operations, troubleshooting and security. Where a specific error or security incident occurs, relevant log data may be retained for as long as necessary to investigate and follow up the incident.
Contact form
When you use the contact form, we process your name, email address and message to respond to and follow up your enquiry. The message is sent via our website server to Form Alert, provided by Aamodt & Ko, which forwards it to us by email. The website's form solution does not store the message in a separate database or write its contents to the application log.
Processing is based on our legitimate interest in responding to enquiries under Article 6(1)(f). If your enquiry concerns steps you ask us to take before entering into a contract with you, the legal basis is Article 6(1)(b).
Enquiries are retained for as long as necessary to respond to and follow them up. If an enquiry leads to an engagement or must be retained to comply with a legal obligation or establish, exercise or defend legal claims, the retention criteria described elsewhere in this notice apply. Please do not submit national identity numbers, identification documents or other confidential information through the form.
Google Analytics and cookies
With your consent, we use Google Analytics 4 to understand how our website is used and improve its content. Analytics data may include the pages you visit, how you reached the website, and technical information about your browser and device. Google receives your IP address when the connection is made, but states that IP addresses are not logged or stored in Google Analytics 4. Cookies are used to distinguish visits and recognise a browser over time.
Google Analytics is only loaded after you consent. The legal basis is consent under Article 6(1)(a). You can decline analytics and still use the entire website. We have disabled Google Signals and advertising personalisation signals in the website's Analytics configuration.
We use the following cookies:
analytics_consent: Remembers whether you accepted or declined analytics. Duration: 180 days from when your choice is saved.
_ga and _ga_*: Used by Google Analytics to distinguish visitors and keep track of visits. Set only after consent. Duration: Up to two years. This period may be renewed on subsequent visits with consent.
The cookie remembering your choice is necessary to respect your settings. It is not used for analytics. The lifespan of Analytics cookies is not the same as the retention period for analytics data held by Google. In Google Analytics, retention for user and event data is set to two months. New visits do not extend the retention period for existing user data. Data that has reached its retention limit is deleted through Google's monthly deletion process. Aggregated standard reports are not subject to this retention period and may remain available for longer.
You can change or withdraw consent at any time through “Cookie settings” at the bottom of the website. When consent is withdrawn, further analytics stops and the website deletes accessible Google Analytics cookies. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.
Providers and processing outside the EEA
We use the providers mentioned above for operations, content delivery, contact forms and analytics. Although the website server is located in Finland, some providers and their subcontractors may process data outside the EEA. Such transfers must have a valid transfer basis under the GDPR, such as an adequacy decision or EU Standard Contractual Clauses with any necessary supplementary measures. You can contact us for further information about providers and the transfer basis applicable to the processing of your data.
How we communicate changes
The current version is available on our website with its update date. If we make material changes, we inform affected individuals in a way that ensures they receive the information. For new purposes, we provide information before the new processing begins.