Last updated: 15 November 2026 · Entitas AS, org. no. 937 433 654
Entitas AS takes privacy seriously. This policy explains what information we collect, why we collect it, and what rights you have. This is a translation of the Norwegian version at entitas.no/personvern, which prevails in case of discrepancy.
Entitas AS (org. no. 937 433 654), Møllevannsveien 22, 4616 Kristiansand, Norway, is the controller for personal data processed in connection with our service.
Contact: hei@entitas.no
Partners can order and manage LEI codes for their clients through our partner portal. Entitas AS is an independent controller for the data we receive this way. The partner is not our processor, and we are not the partner's processor.
The data comes from the partner, the Brønnøysund Register Centre and GLEIF. The partner only sees its own clients and the status of its own orders.
If you reach the website through an ad or an email from us, we may record click identifiers (for example Google's gclid/gbraid/wbraid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_content) from the link you clicked. These may be linked to a unique reference (click_ref) that lets us see which ad or email led to an order or enquiry.
| Purpose | Legal basis |
|---|---|
| Provide LEI registration and renewal | Performance of a contract (GDPR art. 6(1)(b)) |
| Send invoices and receipts | Legal obligation (GDPR art. 6(1)(c)) |
| Send LEI expiry reminders | Legitimate interest (GDPR art. 6(1)(f)) |
| Customer support and communication | Performance of a contract (GDPR art. 6(1)(b)) |
| Analyse website use (cookieless analytics) | Legitimate interest (GDPR art. 6(1)(f)) |
| Meet bookkeeping requirements | Legal obligation (GDPR art. 6(1)(c)) |
| Market LEI services to Norwegian businesses by email | Legitimate interest (GDPR art. 6(1)(f)) |
| Give the partner's users access to the partner portal | Performance of the contract with the partner (GDPR art. 6(1)(b)) and legitimate interest in documenting who did what (GDPR art. 6(1)(f)) |
| Show the partner which clients have or lack a valid LEI | Legitimate interest (GDPR art. 6(1)(f)) |
| Obtain and document the company's confirmation of an order placed by a partner (the client's contact person) | Legitimate interest (GDPR art. 6(1)(f)): we must be able to document that the company approved the registration |
| Measure which ads/emails lead to orders (attribution) | Legitimate interest (GDPR art. 6(1)(f)) and, where a cookie is used, your consent |
We only share data to the extent necessary to deliver the service:
We do not sell personal data to third parties, and we do not share data for marketing purposes without consent.
We enter into data processing agreements with suppliers that process personal data on our behalf:
Entitas AS processes contact and business data about Norwegian legal entities to market our LEI services by email to businesses likely to need an LEI code, for example businesses with a lapsed LEI code, newly registered companies or companies in the LEI target group such as holding companies. The legal basis is our legitimate interest in marketing our services to relevant businesses (GDPR art. 6(1)(f)), cf. the Norwegian Marketing Control Act § 15. Sole proprietorships are not contacted, and we do not send to private email addresses. Enquiries are addressed to the business as such.
The data is not collected from you but from public sources: the Brønnøysund Register Centre, the GLEIF Global LEI Index and the entity's own public website. We process company name, organisation number, business address, email address and website, and the LEI code with its status and renewal date. In some cases the email address may identify a person, for example firstname@company.no.
| Category | Retention period |
|---|---|
| Customer data (agreement and order history) | 5 years after the last transaction (Norwegian Bookkeeping Act) |
| Documentation for the LEI registration: signed letters of authorisation, ownership (Level 2) documentation and the result of our check of the authorisation | At least 10 years after the most recent update of the LEI registration, and in any case for as long as our agreement with the LEI issuer runs and 5 years after it ends. The issuer requires this so the registration can be documented to GLEIF |
| Invoices and accounting data | 5 years (statutory) |
| Email correspondence | 3 years |
| Analytics data (Plausible) | Aggregated statistics without personal data |
| Contact form submissions | 2 years, or until the matter is closed |
| Leads for marketing to businesses | Kept while the business is in the target group for our services, and reviewed periodically for deletion or anonymisation |
| Suppression list (unsubscribes and objections) | Kept to prevent future contact (GDPR art. 21, cf. art. 17(3)(b)) |
| Click/campaign data without a subsequent order or enquiry | 90 days |
| Click/campaign data linked to a completed order | Up to 24 months after the order, then deleted or anonymised |
| The partner's users (portal access) | While the partner agreement runs, and up to 12 months after it ends |
| The partner's client list | While the partner is a partner. Archived clients are deleted 12 months after archiving. If the partner agreement ends, the list is deleted after 90 days |
| Contact person on a partner order that was not confirmed (expired, declined or stopped) | Deleted 90 days after the order was closed, together with the IP address and browser from any decline |
| Contact person, IP address and browser for a confirmed partner order | 10 years after the confirmation (evidence that the registration was approved, as required by the LEI issuer) |
Under the GDPR you have the right to:
Send your request to hei@entitas.no. We reply within 30 days.
You may also complain to the Norwegian Data Protection Authority (Datatilsynet): datatilsynet.no
The website uses cookies in line with the applicable cookie rules. It uses two cookies:
Our analytics tool (Plausible) is cookieless and does not require consent. You can withdraw or change your consent for the cr cookie at any time here:
We use HTTPS encryption for all communication. Access to personal data is limited to authorised personnel. We apply technical and organisational security measures in line with GDPR art. 32.
We may update this policy when the processing changes materially. The date at the top shows the latest revision. For material changes we will notify existing customers by email.
Questions about privacy? Get in touch:
Entitas AS
Møllevannsveien 22, 4616 Kristiansand, Norway
Email: hei@entitas.no
Org. no.: 937 433 654