Legal
Privacy policy
Privacy Policy
Personvernerklæring
Edgeon AS | Ledgeron | Thermon
Version 1.0 | March 2026
This Privacy Policy explains how Edgeon AS (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you access our website, platform, or services – including Ledgeron (logistics unit accounting) and Thermon (IoT monitoring). It is written in plain language and complies with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).
If you have questions, please contact us at the details in Section 1 before proceeding.
1. Who We Are (Data Controller)
Edgeon AS is the data controller for all personal data processed through our website and services. As data controller, we determine the purposes and means of processing your data and are responsible for ensuring compliance with GDPR.
| Field | Details |
| Legal Name | Edgeon AS |
| Organisation Number | [Insert Org.nr – e.g. 924 XXX XXX] |
| Registered Address | [Insert registered address, Norway] |
| Privacy Contact / DPO | privacy@edgeon.no |
| Website | edgeon.no |
| Products Covered | Ledgeron, Thermon, edgeon.no website |
| Supervisory Authority | Datatilsynet (datatilsynet.no) |
2. What Data We Collect
We only collect personal data that is necessary for the services we provide. Below is a complete overview of what we collect, why, on what legal basis, and for how long we keep it.
| Category of Data | Purpose | Legal Basis (GDPR Art. 6) | Retention Period |
| Name & Email address | Account creation, user authentication, service communication | Contract (Art. 6(1)(b)) | 2 years after contract termination |
| Phone number | 2-factor authentication, urgent notifications | Contract (Art. 6(1)(b)) | 2 years after contract termination – stored encrypted |
| IP address & device info | Security, fraud prevention, session management | Legitimate interest (Art. 6(1)(f)) | 12 months – then anonymised |
| Audit log data (user actions) | Security, regulatory compliance, dispute resolution | Legal obligation (Art. 6(1)(c)) | 12 months from event |
| Billing & payment data | Invoicing, subscription management | Contract (Art. 6(1)(b)) | 5 years (Norwegian Bookkeeping Act) |
| Usage analytics (anonymised) | Product improvement, performance monitoring | Legitimate interest (Art. 6(1)(f)) | 24 months |
| IoT sensor data (Thermon) | Real-time monitoring service delivery | Contract (Art. 6(1)(b)) | As defined in customer agreement |
| Support messages & chat logs | Resolving support requests | Contract (Art. 6(1)(b)) | 3 years |
| Cookie identifiers (optional) | Analytics, user preference (with consent) | Consent (Art. 6(1)(a)) | As set in Cookie Policy – max 13 months |
Note: We never sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces significant legal effects.
3. How We Collect Data
We collect data through the following channels:
Directly from you – when you register an account, sign up for a trial, fill in a contact form, or communicate with us
Automatically – technical data (IP, browser, device) collected when you visit our website or use our platform
From our customers (B2B) – when a company administrator registers users on the Ledgeron or Thermon platform on your behalf
From integrations – data imported from third-party systems such as ERP or WMS as part of a customer’s service setup
4. Who We Share Data With (Sub-Processors)
We use a limited number of trusted third-party providers (sub-processors) to deliver our services. All sub-processors are bound by Data Processing Agreements and are required to uphold GDPR standards.
| Provider | Purpose | Location | Safeguard |
| Microsoft Azure | Cloud infrastructure & hosting | EU (North Europe) | EU data residency – GDPR compliant |
| Supabase / PostgreSQL | Database (hosted on Azure EU) | EU | EU data residency |
| Auth0 / Azure AD B2C | Authentication & identity management | EU | Standard Contractual Clauses (SCCs) |
| Stripe | Payment processing & billing | EU / USA | SCCs + EU data addendum |
| Sendgrid / email provider | Transactional email notifications | USA | Standard Contractual Clauses (SCCs) |
| Analytics tool (TBD) | Anonymised usage analytics | EU preferred | Anonymised data – no personal data transferred |
We do not share personal data with any other parties unless required by law (e.g. court order, regulatory authority request), in which case we will notify you where legally permitted to do so.
5. Transfers Outside the EEA
Our primary infrastructure is hosted in the EU (Microsoft Azure, North Europe region). However, some of our sub-processors (notably Stripe and transactional email services) may process data in the United States.
Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place:
Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Supplementary technical measures (encryption in transit and at rest)
You can request details of specific transfer mechanisms by contacting privacy@edgeon.no.
6. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our security measures include:
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Role-based access control (RBAC) – users only access data they need for their role
Multi-factor authentication (MFA) for all platform access
Comprehensive audit logging of all user actions (ISO 27001 aligned)
Automated session timeout and password history enforcement
Vulnerability scanning and regular security reviews
Tenant data isolation – each customer’s data is strictly separated
In the event of a personal data breach that poses a risk to your rights, we will notify Datatilsynet within 72 hours as required by GDPR Art. 33, and notify affected individuals without undue delay.
7. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR (Art. 15–21). You may exercise any of these rights by contacting privacy@edgeon.no. We will respond within 30 days.
| Your Right | What It Means |
| Right of Access (Art. 15) | You can request a copy of all personal data we hold about you, free of charge. |
| Right to Rectification (Art. 16) | You can ask us to correct inaccurate or incomplete data. |
| Right to Erasure (Art. 17) | You can ask us to delete your data where there is no legitimate reason to continue processing it. Note: some data must be retained for legal obligations. |
| Right to Restrict Processing (Art. 18) | You can ask us to pause processing of your data while a dispute is being resolved. |
| Right to Data Portability (Art. 20) | You can receive your data in a structured, machine-readable format (e.g. JSON or CSV). |
| Right to Object (Art. 21) | You can object to processing based on legitimate interest. We will stop unless we demonstrate compelling grounds. |
| Right to Withdraw Consent (Art. 7(3)) | Where we rely on consent (e.g. optional analytics cookies), you can withdraw it at any time without affecting prior processing. |
8. Cookies
We use cookies and similar tracking technologies on our website. Please refer to our separate Cookie Policy for full details on what cookies we use and how to manage your preferences.
In summary:
Strictly necessary cookies: Always active – required for the website and platform to function (login sessions, security tokens)
Analytics cookies: Only loaded with your explicit consent – help us understand how our website is used (anonymised)
Marketing cookies: We do not currently use marketing or advertising cookies
You can manage your cookie preferences at any time via the cookie banner on our website or by contacting us.
9. B2B Customers – Data Processing Agreement
When Edgeon processes personal data on behalf of a business customer (e.g. a company using Ledgeron to manage pallet accounts or Thermon for IoT monitoring), we act as a Data Processor under GDPR Art. 28.
In these cases:
The business customer is the Data Controller – they determine why and how data is processed
Edgeon AS acts as the Data Processor – we process data only on documented instructions from the customer
A Data Processing Agreement (DPA) must be signed before the customer goes live on the platform
If you are a business customer and need a DPA, please contact privacy@edgeon.no.
10. Children’s Data
Our services are intended exclusively for business use and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@edgeon.no.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices. The version number and date at the top of this document will always reflect the latest revision.
If we make material changes, we will notify registered users by email and display a prominent notice on our website before the changes take effect. The previous version will remain accessible on our website for 12 months.
12. How to Complain
If you are unhappy with how we have handled your personal data, we encourage you to contact us first so we can resolve the matter:
Email: privacy@edgeon.no
You also have the right to lodge a complaint directly with the Norwegian Data Protection Authority:
Datatilsynet – The Norwegian Data Protection Authority
Website: www.datatilsynet.no
Phone: +47 74 07 70 00
You may also contact the data protection authority in your country of residence within the EU/EEA if applicable.
Document Information
Version 1.0 | March 2026 | Edgeon AS | Prepared for GDPR compliance
This document should be reviewed annually or upon material changes to services or applicable law. [TODO: Insert Org.nr, registered address, and confirm sub-processor list before publishing]