Privacy Policy

Freysta Portal is operated by Freysta AS.

Freysta AS, Ovre Holen 24B, 5163 Laksevag, Norway. Organisation number: 929 913 477 MVA. Email: post@freysta.com

Freysta AS is the controller for its own account administration, platform operation, security and support. Municipalities and customer organisations, including Lister Næringsforening, are controllers for their own dialogue with members and case management. Freysta is their processor under a data processing agreement.

Freysta Portal is used by Freysta members exploring jobs and communities, employers presenting businesses and job opportunities, municipalities working with settlement and integration, and Freysta administrators who operate and support the platform.

Different roles have access only to the information necessary for their interaction with the service.

Once you have completed joining a customer, your profile is visible to the customer's advisers and to the partner employers who have access to the Portal through that customer. They can see, among other things, your name, age, nationality, occupations, education and work experience. You cannot hide your profile, but you can delete it. Other members cannot see anything about you.

In Region Lister, this means the local guides, the municipalities and the companies that work with Region Lister.

Employers can also see your family situation, information in your partner's profile and information about children moving with you, including their years of birth and calculated ages.

Depending on how you use the platform, we may process the following categories of data.

We store the time of your most recent successful account sign-in across portals to identify accounts that are no longer used. This is a single timestamp, not a sign-in history, and does not include an IP address or device information. Support impersonation does not update it.

These logs are limited to what is necessary for system operation and security.

A person may have separate profiles in contexts such as Region Lister. These include household and child information, occupations, education, village interests and preferences you choose to provide. Information is displayed according to the active context and access permissions.

Documents include CVs, attachments and profile pictures. Notification preferences and delivery information are used to send requested notifications. Email sign-in links use short-lived tokens and sessions.

Employers can keep favourites and candidate lists for their own employer and context. Personal visit baselines tell an authorised employer user which matching candidates are new since their previous visit.

You can create a profile for your partner. This requires you to confirm that your partner has consented. For children, we only store that you are moving with a child and the child's year of birth.

Administrators may impersonate a user for necessary support. The administrator, the account being assisted and the support action are logged. Impersonation does not count as the user's normal activity or acknowledge employer visits.

Personal data is processed on the following legal bases.

Freysta uses external service providers to operate the platform.

These providers process personal data only on Freysta's instructions.

Some service providers may process data outside the European Economic Area (EEA).

When this occurs, Freysta ensures appropriate safeguards are in place, such as EU Standard Contractual Clauses or equivalent legal mechanisms.

Freysta Portal uses a secure session cookie to maintain user authentication.

The session cookie stores a signed session identifier, allows the platform to recognise logged-in users, and is not used for cross-site tracking.

Security settings include HttpOnly, SameSite protection, and secure transmission when HTTPS is used.

Company pages may contain YouTube or Vimeo videos. No player or video-provider preview is loaded before you click to play. YouTube uses youtube-nocookie.com; Vimeo uses its privacy option. After your click the provider receives technical data such as your IP address and processes it under its own privacy policy.

Personal data is retained only as long as necessary.

Where possible, data may be anonymised or deleted when no longer required.

Administrative audit logs, access changes and support impersonation records are retained for 12 months, except for the separate context validation log, which follows its own retention rules. Ordinary technical error, access and email-delivery diagnostic logs are retained for up to 30 days. These periods do not set the retention of customers' case records or journals. Records needed for a documented incident or legal obligation require a separate, justified retention decision.

Usage statistics are retained for 13 months. In the current activity report, account identifiers are retained for the same period to count distinct people across days, months and selected periods. Reports show totals to authorised users, not a public list of people. The separate legacy daily seen-user register is only a temporary counter: entries older than yesterday are removed daily after the daily total has been recorded. These registers are not used as browsing history.

When customer staff or employer users leave, their accounts are deactivated rather than erased. Portal access is blocked, while their names stay attached to their previous messages and actions. Their profile pictures, phone numbers and notification preferences are removed on deactivation.

An employer user's visit baseline and seen-candidate register are removed when that user loses access to the employer. Customers determine the retention of their dialogue and statutory case records. Backup copies expire through their separate retention cycle and are not used as active profiles.

If an account has not been used for 24 months, we send you an email saying that the profile will be deleted unless you log in within 30 days. If you do not log in, the account is deleted.

Conversations are retained when a local guide or adviser leaves. A new adviser must be given the appropriate access to the community or inbox and to the existing conversations; history is not transferred automatically just because a new account is created.

Inactive member accounts are reviewed manually. If login history is incomplete, the account is not deleted on the basis of presumed inactivity.

Under applicable data protection laws, you have the right to:

Requests can be sent to post@freysta.com.

Freysta Portal implements several security measures, including:

Access to personal data is restricted to what is necessary for each role.

We update this policy when the service or applicable rules change. Material changes may be announced in the Portal or by email. The customer's joining document refers to this shared policy.

If you have questions about this Privacy Policy or how your personal data is handled, please contact Freysta AS.

Freysta AS, Ovre Holen 24B, 5163 Laksevag, Norway. Email: post@freysta.com