Website privacy policy - MTA Group AS

Last updated: March 23, 2026

This privacy policy explains how MTA Group AS processes personal data in connection with the use of our website. The policy applies to the processing of personal data that occurs when you visit the website, use the contact form, contact us by email or phone from the website, and consent to the use of cookies and other tracking technologies. The requirement to provide clear, accessible and understandable information stems from Articles 12 and 13 of the RODO.

1. data controller

The controller of the personal data processed through the website is:

MTA Group AS
No. org. 919 017 805
Fjordveien 3, 1363 Høvik, Norway
E-mail: post@mtagroup.no
Phone: +47 219 55 151

For questions regarding the processing of personal data, please contact post@mtagroup.no. In accordance with Article 13 of the DPA, the data subject has the right to be informed of the identity and contact information of the controller.

MTA Group AS has not appointed a Data Protection Officer because the company does not meet the conditions for mandatory appointment of a DPO in accordance with Article 37 of the RODO. Inquiries regarding data protection should be addressed to the above contact information.

2 What personal data we process

We may process the following data in connection with your use of our website:

• name
• email address
• phone number
• company name
• organizational number (if provided)
• content of the message or inquiry sent to us
• technical data: IP address, browser type, device type, language settings, pages visited, time of visit and traffic sources
• data collected through cookies and similar technologies, according to the choices made in the cookie management tool

3 Processing purposes and legal basis

We process personal data for the following purposes:

(a) Responding to inquiries sent via contact form, e-mail or telephone

Legal basis: Article 6(1)(b) of the RODO when the inquiry relates to activities prior to the possible conclusion of a contract, and Article 6(1)(f) of the RODO when the processing relates to general contact and handling of correspondence. Our legitimate interest is to be able to respond to inquiries and handle contact related to our business.

(b) Handling inquiries and pre-contract contact

Legal basis: article 6(1)(b) of the RODO.

(c) Site security, fraud prevention, diagnostics and technical maintenance

Legal basis: article 6(1)(f) RODO. Our legitimate interest is to protect the site, our systems and users from abuse, errors and security incidents.

(d) Analyze the use of the site and improve content, functionality and user experience

Legal basis: Article 6(1)(a) of the RODO (consent), to the extent that the analysis is performed via cookies or other tracking technologies requiring consent.

(e) Ad performance measurement, remarketing and marketing

Legal basis: Article 6(1)(a) of the RODO (consent), to the extent that processing is carried out using Meta Pixel, Google Ads or similar technologies.

4. whether it is mandatory to provide the data

Providing personal information through the contact form or other contact with us is voluntary. If you do not provide the data necessary to understand or handle your request, we may not be able to fully respond or contact you.

5 Recipients of personal data

We may share personal data with processors and service providers to the extent necessary to operate the site and fulfill the purposes described in this policy.

This applies in particular:

• TheCamels – provider of hosting and maintenance of the site. Concluded data processing entrustment agreement.
• WordPress – a content management system for a website.
• Our email provider – inquiries from the contact form are forwarded to email.
• Google – if you agree to analytical or marketing cookies and tools such as Google Analytics, Google Ads or Google Tag Manager. Processing entrustment agreement (Data Processing Terms) accepted.
• Meta – if you agree to use Meta Pixel. Processing entrustment agreement (Data Processing Terms) accepted.

We share data only to the extent necessary for the purpose.

6. transfer of personal data outside the EEA

Some of our suppliers, notably Google and Meta, may process personal data in countries outside the EEA. Transfers take place on the basis of:

• Google: EU-US Data Privacy Framework (Adequacy Decision) and Standard Contractual Clauses (SCC).
• Meta: EU-US Data Privacy Framework (adequacy decision) and standard contractual clauses (SCC).

For more information about the basis of the transfer or the safeguards in place, contact us at post@mtagroup.no.

7. storage period

We keep personal data for no longer than is necessary to fulfill the purpose for which it was collected.

• Inquiries from the contact form and related data are stored for up to 90 days, unless the inquiry leads to further dialogue, an offer process, a contractual relationship or other documented need for further storage.
• Technical logs and security data are stored for up to 12 months. Data necessary for ongoing security investigations may be kept longer.
• Data processed on the basis of consent is processed until consent is withdrawn or until processing is no longer necessary for the purpose in question.
• Cookies are stored in accordance with the periods indicated in Section 9 of this policy or until you delete them.

8. your rights

You have the right to:

• access to your personal data
• rectification of incorrect or incomplete data
• deletion of data
• restrictions on processing
• object to processing based on legitimate interests
• Data portability when the relevant conditions are met
• withdraw consent when processing is based on consent

The withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.

You also have the right to file a complaint with the Norwegian supervisory authority:

Datatilsynet
Postboks 458 Sentrum, 0105 Oslo
www.datatilsynet.no

9. cookies and other tracking technologies

The website uses cookies and similar technologies. Under Norwegian law, the use of cookies and other tracking technologies generally requires prior consent, except for what is strictly necessary to provide a service that you have explicitly requested. As of January 1, 2025, such consent must meet the requirements of RODO.

Essential cookies

Necessary for the operation of the site and the cookie management tool. Do not require consent.

Analytical cookies

Used only with permission.

Marketing cookies

Used only with permission.

10. consent and how to withdraw it

You can change or withdraw your consent to analytical and marketing cookies at any time:

• by clicking the cookies icon at the bottom of the page
• using the “Cookie Settings” link in the footer of the page

Withdrawing consent should be as easy as granting it. Buttons and options should be clear and easy to understand.

11. Google Tag Manager

We use Google Tag Manager (GTM-5QXM43S) to manage scripts and services on the site. Google Tag Manager is a technical tool used to load other solutions and is not an analytics tool in itself. Which tools are actually loaded depends on your cookie and consent choices.

12 Automated decisions and profiling

We do not use the site to make automated decisions that have legal or similarly significant effects on you. If analytics and marketing tools are used when you give your consent, they may record activity on the site for statistical and marketing purposes. This does not imply automated decisions directed at you as an individual.

13. policy changes

We may update this privacy policy in the event of changes in regulations, technology, suppliers or the way the site operates. The updated version will always be available on the site with the date of the last update.

14 Contact.

For questions regarding this privacy policy or the processing of personal data, please contact:

MTA Group AS
Fjordveien 3, 1363 Høvik
E-mail: post@mtagroup.no
Phone: +47 219 55 151