Privacy Policy

1. Scope and structure of this Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the central Heras Group website at heras.com, use its functions, submit an enquiry or interact with services integrated into the website.

The central website is operated as a modular Group platform. It includes the central Group pages and country-specific sections, such as:

• heras.com/de-de;
• heras.com/de-en; and
• additional country sections that may be added in the future.

The central Group website is presented by Heras Group Norway AS. Country-specific companies may be responsible for individual country pages or for particular processing activities, such as local sales enquiries, customer communications, newsletter activities or recruitment.

Local country pages may also contain their own legal notices and supplementary privacy information.

This website is primarily an information and corporate presentation website. It does not provide a customer account, customer login or online shop.

2. Controller for the central Group website

The controller responsible for the central Group website is:

Heras Group Norway AS
Apotekergata 10B
0180 Oslo
Norway

Where a country-specific Heras company independently determines the purposes and means of a particular processing activity, that company acts as a separate controller. The relevant company will be identified on the country page, in the relevant form, in the legal notice or in subsequent communication.

3. Country-specific responsibility

The central platform is technically and organisationally managed under the responsibility of Heras Group Norway AS.

A local Heras company may act as an independent controller where it determines the purposes and means of processing for:

• local contact and sales enquiries;
• quotations and contractual relationships;
• local customer and CRM management;
• local newsletters and marketing communications;
• events and local campaigns;
• recruitment and job applications;
• locally provided products or services.

4. Data protection contact

Questions concerning this Privacy Policy or the processing of personal data may be addressed to:

Heras Group Norway AS
Data Protection
Apotekergata 10B
0180 Oslo
Norway

Email: info@heras.com

5. General legal bases

Depending on the relevant processing activity, we process personal data on the following legal bases:

• consent pursuant to Article 6(1)(a) GDPR;
• performance of a contract or steps taken at your request before entering into a contract pursuant to Article 6(1)(b) GDPR;
• compliance with a legal obligation pursuant to Article 6(1)(c) GDPR;
• our legitimate interests or those of a third party pursuant to Article 6(1)(f) GDPR.

Where processing is based on legitimate interests, those interests may include:

• the secure and reliable operation of the website;
• the protection of our systems;
• the prevention of fraud and misuse;
• the efficient handling and allocation of enquiries;
• the presentation of the Heras Group and its services;
• the improvement of our website and business processes.

6. Provision of the website and server log files

When you visit the website, technical information is processed in order to provide the website and ensure its security, availability and stability.

This information may include:

• IP address;
• date and time of access;
• requested page or file;
• browser type and version;
• device information;
• operating system;
• referring website;
• access status or HTTP status code;
• security and diagnostic information;
• amount of data transferred.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of the website, the detection of technical errors and the prevention of attacks and misuse.

Log data is retained only for as long as necessary for these purposes. Longer storage may take place where required to investigate a security incident, establish or defend legal claims or comply with legal obligations.

7. Webflow website platform and hosting

We use Webflow for the creation, management, development, hosting and technical delivery of the central Group website.

Service provider:
Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, California 94103
United States

When the website is accessed, Webflow may process technical information required to deliver and secure the website, including IP addresses, requests, browser and device information, access times, diagnostic data and security information.

The website frontend and static website content are distributed through a global content delivery network. Webflow states that websites hosted by it are stored and delivered through Cloudflare.

The legal basis for the processing strictly necessary to provide, secure and maintain the website is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient provision of the website.

Further information is available in the:

• Webflow EU and Swiss Privacy Policy
• Webflow Data Processing Agreement

Where personal data is transferred to the United States, the transfer may be based on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses, depending on the recipient and processing circumstances.

Native Webflow forms are not used for the collection and storage of contact enquiries. Contact forms are provided through Jotform.

8. Cookies and similar technologies

The website uses cookies and similar technologies. These technologies may store information on your device or access information already stored on your device.

We distinguish between:

• strictly necessary technologies;
• preference or functional technologies;
• analytics technologies;
• marketing and conversion technologies;
• external media.

Non-essential technologies are activated only after you provide the relevant consent.

The legal basis for the processing associated with analytics, advertising, marketing and external media is Article 6(1)(a) GDPR.

Current information about the technologies used, their providers, purposes and storage periods is available through the cookie settings on the website.

9. Consent management with Usercentrics

We use Usercentrics Business as our consent management platform.

The service is used to:

• provide information about cookies and other services;
• obtain and document consents;
• store consent preferences;
• prevent non-essential services from loading before consent;
• transmit consent signals to integrated services;
• allow users to change or withdraw their consent.

The following information may be processed:

• consent status;
• selected consent categories;
• date and time of consent or withdrawal;
• consent identifier;
• browser and device information;
• language and regional settings;
• technical information necessary to demonstrate the consent decision.

Processing is necessary to comply with our obligation to obtain and demonstrate valid consent and is based on Article 6(1)(c) GDPR in conjunction with the applicable consent and accountability requirements. Where the processing serves the technical management and security of consent preferences, it is based on Article 6(1)(f) GDPR.

You may withdraw or change your consent at any time by using the Cookie Settings or Privacy Settings link on the website.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. Webflow Analyze

Subject to your consent, we use Webflow Analyze to analyse website usage and visitor interactions.

The service may process:

• pages visited;
• click events;
• sessions;
• unique visitor information;
• bounce information;
• time spent on the website or individual pages;
• traffic sources;
• regional information;
• device and browser information;
• interaction and conversion events.

Webflow states that Webflow Analyze collects information including click events, unique visitors, sessions, bounce rates, time on pages, traffic sources, regions and device information.

Service provider:
Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, California 94103
United States

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Webflow Analyze is configured so that tracking does not begin until the relevant analytics consent has been provided. Webflow provides a “Don’t track by default” setting for this purpose, which waits for consent before tracking begins.

You may withdraw your consent through the cookie settings at any time.

11. Google Analytics 4

Subject to your consent, we use Google Analytics 4 to analyse website usage and measure the performance of website content and campaigns.

Service provider:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Depending on the service configuration, Google LLC and other Google companies or providers may also process data outside the European Economic Area.

The following information may be processed:

• online and cookie identifiers;
• IP and approximate location information;
• browser, device and operating-system information;
• language and screen settings;
• pages visited;
• date and time of access;
• referral and campaign information;
• interactions and events;
• session duration;
• conversion information;
• consent signals.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Google Analytics 4 is not activated before the relevant consent is provided.

Google states that it relies on mechanisms including adequacy decisions, the EU-U.S. Data Privacy Framework and Standard Contractual Clauses for international data transfers, depending on the transfer concerned.

Further information is available in the Google Privacy Policy.

12. Microsoft Clarity

Subject to your consent, we use Microsoft Clarity to analyse website usability and visitor interactions.

Service provider:
Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399
United States

The service may process:

• clicks and scrolling behaviour;
• navigation paths;
• session and interaction information;
• browser and device information;
• operating-system information;
• page and referral information;
• approximate location information;
• technical identifiers;
• consent signals.

Input fields and website areas intended for the submission of personal data are excluded from session recordings or masked in accordance with the implemented configuration.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Microsoft Clarity is not activated before the relevant consent is provided.

Microsoft states that Clarity data is stored in Microsoft data centres in the United States and that information likely to contain personally identifiable information, including input fields, is masked on the client side by default.

Microsoft Clarity requires a valid consent signal for full functionality for visits originating from the EEA and does not place Clarity cookies in the EEA unless a valid consent signal has been received.

Further information is available in the Microsoft Clarity privacy information.

13. Google Tag Manager

We use Google Tag Manager to manage and control website tags.

The Tag Manager is a technical management layer. It does not replace the consent required for analytics or marketing services. Services managed through the container are assigned to their respective consent categories and are not activated unless the necessary consent has been provided.

The tag-management configuration may process technical connection information, including the IP address necessary to deliver the container.

The legal basis for the technical administration of the container is Article 6(1)(f) GDPR. Our legitimate interest is the secure, controlled and auditable management of website services.

Analytics and marketing services deployed through Google Tag Manager are based on consent pursuant to Article 6(1)(a) GDPR.

Where the Tag Manager is loaded before consent, this occurs only to the extent technically necessary to manage consent-dependent services. The services controlled through the container are not activated before the required consent has been provided.

14. Server-side tracking through Stape.io

We use Stape.io for server-side tag management and the controlled transmission of analytics and marketing events.

The tagging server is hosted in Frankfurt, Germany.

Depending on your consent and the activated service, the server-side infrastructure may process:

• technical identifiers;
• page and event information;
• browser and device information;
• campaign and referral information;
• consent signals;
• analytics events;
• conversion events;
• pseudonymous or hashed identifiers where configured.

The server-side tagging configuration prevents analytics and marketing events from being transmitted unless the corresponding consent signal has been received.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Stape.io provides a Data Processing Agreement incorporating Standard Contractual Clauses for relevant international transfers.

Further information is available in the Stape Data Processing Agreement.

15. Google Ads and conversion measurement

Subject to your consent, we use Google Ads to measure the effectiveness of advertising campaigns and to determine whether users perform defined actions after interacting with an advertisement.

The following information may be processed:

• cookie and online identifiers;
• browser and device information;
• advertising and campaign information;
• website interactions;
• conversion events;
• referral information;
• approximate location;
• consent signals.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Google Ads and associated conversion services remain inactive until the relevant marketing consent has been provided.

16. LinkedIn Insight Tag

Subject to your consent, we use the LinkedIn Insight Tag to measure the performance of LinkedIn campaigns, create campaign statistics and understand whether users perform defined actions after interacting with a LinkedIn advertisement.

Service provider for users in the EEA:
LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland

The service may process:

• IP address;
• browser and device information;
• page visits;
• timestamps;
• referral information;
• campaign interactions;
• cookie and advertising identifiers;
• conversion events;
• LinkedIn account information where the user is logged in.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

The service is not activated before the relevant marketing consent is provided. Consent may be withdrawn through the cookie settings.

17. Meta Pixel for Facebook and Instagram

Subject to your consent, we use the Meta Pixel for advertising and conversion measurement relating to Facebook and Instagram.

The references to Facebook Pixel and Instagram Pixel in this Privacy Policy concern the Meta Pixel and the associated Meta advertising infrastructure. They are not treated as two technically separate pixel providers.

Service provider for users in the EEA:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

The service may process:

• IP address;
• browser and device information;
• page visits;
• website interactions;
• campaign and referral information;
• cookie and advertising identifiers;
• conversion events;
• information concerning the Facebook or Instagram account where the user is logged in.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Where the Meta Conversions API is used, selected conversion events may also be transmitted through the server-side tagging infrastructure. This processing remains subject to the relevant marketing consent.

18. TikTok Pixel and conversion measurement

Subject to your consent, we use the TikTok Pixel to measure the effectiveness of TikTok campaigns and determine whether users perform defined actions after interacting with TikTok advertising.

Service provider for users in the EEA:
TikTok Technology Limited
10 Earlsfort Terrace
Dublin 2
Ireland

The service may process:

• IP address;
• browser and device information;
• page visits and interactions;
• advertising and campaign information;
• cookie and advertising identifiers;
• conversion events;
• referral information;
• TikTok account information where the user is logged in.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Where a TikTok conversion or events API is used, selected events may be transmitted through the server-side tagging infrastructure. This processing also remains subject to marketing consent.

Further information for users in the EEA is available in the TikTok EEA Privacy Policy.

19. Embedded YouTube videos

The website may contain videos hosted by YouTube.

YouTube content is not loaded before you provide the relevant consent. Before consent is provided, a placeholder or consent message may be displayed.

When YouTube content is activated, the following information may be processed:

• IP address;
• page visited;
• date and time of access;
• browser and device information;
• interaction and playback information;
• cookie and online identifiers.

If you are logged into a Google or YouTube account, the provider may associate the interaction with your account.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. You can withdraw your consent through the cookie settings at any time.

20. Embedded Vimeo videos

The website may contain videos hosted by Vimeo.

Vimeo content is not loaded before you provide the relevant consent. Before consent is provided, a placeholder or consent message may be displayed.

When the content is activated, Vimeo may process:

• IP address;
• page visited;
• date and time of access;
• browser and device information;
• playback and interaction information;
• cookie and online identifiers.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

Vimeo explains that embedded videos allow Vimeo-hosted content to be displayed on external websites and that privacy and embedding controls may be applied to this content.

You may withdraw your consent through the cookie settings.

21. Contact forms through Jotform

Contact forms on the website are provided through Jotform. Native Webflow contact forms are not used.

The forms may collect:

• name;
• company and position;
• email address;
• telephone number;
• country and location;
• selected product or service;
• selected business area;
• message content;
• attachments, if enabled;
• form and submission metadata;
• date and time of submission;
• technical information necessary to deliver and secure the form.

The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps. For other general enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to receive, allocate and respond to enquiries.

Jotform offers EU data hosting. According to its provider information, European form data may be stored on servers in Frankfurt, Germany, where the appropriate European data-storage option has been enabled.

Data submitted through Jotform is routed to the Heras company, CRM system or email inbox responsible for the selected country, location, product or service.

General contact requests, newsletter subscriptions and marketing consents are processed separately.

Contact-form data is deleted when the enquiry has been conclusively resolved and no contractual, statutory retention or legal-defence requirements justify further storage. Further processing within a customer or prospective-customer relationship is subject to the retention rules applicable to that relationship.

22. Distribution of enquiries to Heras Group companies

Contact enquiries received through the central website are collected centrally and routed to the relevant Heras Group company.

The recipient is determined according to factors such as:

• selected country;
• location;
• product;
• service;
• business area;
• type of enquiry;
• requested contact.

The receiving company may process the personal data as an independent controller for:

• responding to the enquiry;
• preparing an offer;
• initiating or performing a contract;
• documenting communications;
• managing the customer or prospective customer relationship;
• complying with legal obligations.

The relevant company will be identified in the contact form, confirmation message or subsequent communication where practicable.

23. CRM systems

Depending on the responsible country company or business area, contact and sales enquiries may be transferred to one of the following CRM systems:

• HubSpot;
• Pipedrive;
• Microsoft Dynamics 365; or
• a designated email inbox.

The CRM system may process:

• contact and company information;
• content of the enquiry;
• correspondence;
• selected products or services;
• internal allocation;
• status of the enquiry;
• offer and opportunity information;
• contractual and pre-contractual information;
• follow-up activities.

The legal basis is Article 6(1)(b) GDPR where the processing concerns a contract or pre-contractual steps. In other cases, the processing is based on Article 6(1)(f) GDPR.

23.1 HubSpot

HubSpot may be used to allocate, document and process enquiries and manage customer or prospective customer relationships.

HubSpot generally acts as a processor for customer data processed through its subscription services. Its DPA contains additional controller-to-controller terms where certain tracking, enrichment or intent-data functions are activated.

Further information is available in the HubSpot Data Processing Agreement.

23.2 Pipedrive

Pipedrive may be used to receive, allocate, document and process contact and sales enquiries.

Pipedrive states that the customer generally acts as controller and Pipedrive as processor for customer data processed through the service.

Further information is available in the:

• Pipedrive Privacy Notice
• Pipedrive Data Processing Addendum

23.3 Microsoft Dynamics 365

Microsoft Dynamics 365 may be used to allocate, document and process contact, customer and sales enquiries.

The service may contain:

• contact and company information;
• enquiry and communication history;
• sales and opportunity information;
• offers;
• contractual information;
• internal allocation and follow-up activities.

Microsoft provides privacy and data-subject-request documentation for Dynamics 365, including information about the EU Data Boundary.

Further information is available in the Microsoft Dynamics 365 privacy documentation.

24. Newsletter and Mailchimp

If you subscribe to a newsletter or other marketing communications, we process the data provided in the subscription form.

In particular, the following data may be processed:

• Email address;
• Name, if requested;
• Company;
• Country and language;
• Selected areas of interest;
• Date and time of subscription and confirmation;
• Consent information and proof of consent;
• Subscription status.

We use Mailchimp to manage and distribute our newsletters.

Provider:
The Rocket Science Group LLC d/b/a Mailchimp
675 Ponce de Leon Avenue NE
Suite 5000
Atlanta, Georgia 30308
USA

Mailchimp is part of the Intuit group of companies. Under the applicable Terms of Use, the agreement governing the processing of personal data forms part of the contractual arrangements with Mailchimp.

The processing carried out for the purpose of sending newsletters is based on your consent pursuant to Art. 6(1)(a) GDPR.

We generally use a double opt-in procedure to confirm your subscription. As part of this procedure, you will receive a message asking you to confirm your subscription. The subscription and confirmation data are stored so that we can demonstrate that consent has been given.

Where we analyse whether newsletters have been opened and whether links contained in them have been clicked, such processing is also based on your consent pursuant to Art. 6(1)(a) GDPR. This paragraph applies only if personalised open or click tracking is used.

You may withdraw your consent at any time with effect for the future by using the unsubscribe link contained in the relevant message or by contacting the responsible company. The lawfulness of the processing carried out before the withdrawal of consent remains unaffected.

As the provider is established in the USA, personal data may also be processed in the USA. Any transfer takes place only in accordance with the requirements of Art. 44 et seq. GDPR. In particular, the transfer may be based on an applicable adequacy decision, provided that the relevant recipient is validly certified under the EU-U.S. Data Privacy Framework, and, additionally, on the European Commission’s Standard Contractual Clauses included in the Data Processing Addendum. Mailchimp’s Data Processing Addendum contains provisions governing international data transfers and incorporates the Standard Contractual Clauses where applicable.

The data processed for the newsletter are generally stored for as long as the newsletter subscription remains active. Following the withdrawal of consent or unsubscribing, the data will be removed from the active newsletter distribution list, unless statutory retention requirements or requirements relating to proof of consent prevent their deletion. The email address may be stored on a suppression list where this is necessary to ensure that the withdrawal of consent is permanently respected and to prevent newsletters from being sent again.

Further information:

• https://www.intuit.com/privacy/statement/
• Mailchimp Data Processing Addendum (https://mailchimp.com/de/legal/data-processing-addendum/)
  

25. Careers and Teamtailor

Current vacancies may be displayed on the website. The central website receives only the information required to display a vacancy, such as:

• job title;
• department;
• country;
• location;
• job description;
• application link.

If you select a vacancy or click the application link, you will be redirected to an external recruitment environment provided through Teamtailor.

Applicant data is submitted and processed through Teamtailor.

Service provider:
Teamtailor AB
Östgötagatan 16
116 21 Stockholm
Sweden
Company number: 556936-6668

Teamtailor provides regional processing arrangements and privacy functionality including permissions, data requests and automatic deletion rules.

The company advertising the vacancy is responsible for the recruitment process. The applicable recruitment privacy information is provided within the Teamtailor career environment.

Further information is available in the Teamtailor Privacy Notice.

26. Whistleblowing system

The website provides a link to the Heras whistleblowing system.

The whistleblowing system is a separate service and is not operated as a native function of the website. When you select the link, you may be redirected to an external reporting environment.

The privacy information displayed within the whistleblowing system applies to reports submitted through that system. The identity of the responsible entity, service provider, processing purposes, legal bases, confidentiality safeguards and retention periods are explained there.

27. Artificial intelligence-assisted content

Artificial intelligence may be used to assist with content creation, editing and image generation on this website.

This concerns the creation and preparation of website content. It does not mean that visitors are subject to automated decision-making.

28. Recipients

Personal data may be disclosed to:

• Heras Group companies responsible for a country, location, product or service;
• website hosting and platform providers;
• website development and maintenance providers;
• consent-management providers;
• form providers;
• CRM providers;
• newsletter and communication providers;
• analytics and marketing providers, subject to consent;
• video and external-media providers, subject to consent;
• recruitment providers;
• IT and information-security providers;
• legal, audit and professional advisers;
• public authorities where required by law.

Processors are contractually required to process personal data only in accordance with our documented instructions and applicable data-protection requirements.

29. International data transfers

Some service providers, group companies or sub-processors may process personal data outside Norway or the European Economic Area.

Where personal data is transferred to a country without an adequacy decision by the European Commission, we use an appropriate transfer mechanism where required, such as:

• the European Commission’s Standard Contractual Clauses;
• the EU-U.S. Data Privacy Framework where the recipient is validly certified;
• Binding Corporate Rules;
• another legally recognised safeguard;
• a statutory derogation in an exceptional case.

Where required, we assess whether supplementary contractual, technical or organisational measures are necessary.

Information about the safeguards applicable to a particular service may be requested using the contact details provided in this Privacy Policy.

30. Retention and deletion

We retain personal data only for as long as necessary for the purposes for which it was collected, unless longer retention is required by law or necessary for the establishment, exercise or defence of legal claims.

The applicable period depends on:

• the purpose of processing;
• the nature of the information;
• the status of an enquiry or business relationship;
• legal retention obligations;
• security and incident-documentation requirements;
• whether consent has been withdrawn;
• whether an objection has been raised.

Consent records may be retained for as long as necessary to demonstrate compliance with legal requirements.

31. Your rights

Subject to the statutory requirements, you have the right to:

• request access to your personal data;
• request rectification of inaccurate or incomplete data;
• request erasure;
• request restriction of processing;
• receive data provided by you in a structured, commonly used and machine-readable format;
• request transmission to another controller where technically feasible;
• object to processing based on legitimate interests;
• withdraw consent at any time with effect for the future;
• lodge a complaint with a supervisory authority.

Right to object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation.

Where personal data is processed for direct-marketing purposes, you may object at any time. Following such an objection, personal data will no longer be processed for direct-marketing purposes.

Withdrawal of consent

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

32. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority.

The supervisory authority responsible for Heras Group Norway AS is:

Datatilsynet
The Norwegian Data Protection Authority
Postboks 458 Sentrum
0105 Oslo
Norway

https://www.datatilsynet.no/

For matters relating exclusively to a country-specific Heras company, you may also contact the supervisory authority competent for that company.

33. No solely automated decision-making

We do not use personal data collected through the central website to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

34. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, no internet transmission can be guaranteed to be completely secure. You should therefore avoid submitting sensitive or special-category personal data through general contact forms unless the form expressly requests such information.

35. Changes to this Privacy Policy

We may update this Privacy Policy where necessary to reflect changes to:

• the website;
• country pages;
• services and providers;
• our organisation;
• processing activities;
• legal requirements;
• regulatory guidance.

The current version is available on this website. The date of the most recent update is stated at the beginning.