Privacy statement

Data controller

The data controller for the personal data is the company listed below. Privacy enquiries can be directed to the contact address.

PARADISO NTENGA TECH SOLUTIONS
820 208 242
Enebakkveien 25B, 0657 Oslo
personvern@mwafaka.com

What data we process

• Account data: name and email address. If you register with email and password, the password is stored only as a hash by our authentication provider — accounts created via Google sign-in have no password with us. If you sign in with Google, your Google account's profile picture is also stored.
• Profile data you provide yourself: phone number and address. These are used when entering into contracts.
• Organisation data: company name, organisation number, legal form, address, purpose and country. For sole proprietorships the address may be a private address.
• Content you create: projects, contracts, contract clauses and signatures, including the content hash and the time of signing.
• Royalty agreements and royalty payments linked to you as a rights holder, including amount, period and status.
• Contract activity log: who signed or unsigned a contract, and when. The log is retained even if the signature is removed.
• Invitations: the name and email address of the people you invite, and when the invitation was created. If the recipient declines, we also store when they did, the reason they picked if they picked one, and any message they wrote themselves. The reason and the message are shown only to the people who can send a new invitation: the owners and administrators of the organisation, or whoever created the contract. Everyone else sees that the invitation was declined, but not what was written.
• Police certificate: for engagements involving minors, we may process information about whether a police certificate (barneomsorgsattest) has been submitted, its due date, and the contact person for the certificate. This may include information about criminal offences, cf. GDPR Article 10 and section 11 of the Norwegian Personal Data Act.
• Contract contacts: the name and email address of contact persons entered into a contract, for example a contact for engagement, agreement, invoicing or privacy matters. These people are not necessarily themselves users of the service.

Information about people other than you

When you enter contract contacts, a contact person for a police certificate, or other information about people who are not themselves users of the service, those people are also data subjects under data protection law, cf. GDPR Article 14. They have the same rights as described under "Your rights", including the right to access and erasure. You, as the person entering the information, are responsible for informing them about the processing. Requests for access or erasure on behalf of such people can be directed to the contact address below.

Purpose and legal basis

We process the data to deliver the service you have entered into an agreement for. The legal basis is contract, cf. GDPR Article 6(1)(b).

We also process data to secure the service against misuse and unauthorised access. The legal basis is legitimate interest, cf. Article 6(1)(f).

We do not use the data for marketing, profiling or automated decision-making.

Data processors

We use the following data processors to deliver the service:

• Supabase — database and authentication.
• Resend — delivery of transactional email, such as invitations and confirmation links. The content includes the recipient's name and email address.
• Vercel — hosting of the application.

Other recipients

In addition to the processors above, we share data with the following recipients. These are not our data processors: they process the data for their own purposes, we are not the controller for their use of it, and no data-processing agreement is in place for these transfers.

• Google — if you sign in with a Google account, Google receives your IP address, browser type and the fact that you are authenticating to Mwafaka, and returns your name, email address and profile picture to us. Google LLC is based in the United States and is certified under the EU-U.S. Data Privacy Framework (DPF), which is the basis for the transfer.
• Brønnøysundregistrene — when you provide an organisation number to verify an organisation, we send the organisation number to Brønnøysundregistrene's open lookup service (data.brreg.no) to retrieve publicly registered information about the organisation. Brønnøysundregistrene is a public Norwegian register.

Storage and retention

Account data and content are stored for as long as the account is active. Personal data associated with the account is deleted on request to the contact address below. Contracts and signatures may be retained longer where required by law or by agreement between the parties.

For people who are invited to the service but do not create an account themselves, the name and email address from the invitation, along with any decline and the reason and message that came with it, are stored. A declined invitation is deleted 90 days after the refusal, and an invitation that is never answered is deleted 30 days after its link expires. The details are also deleted if the organisation or contract they belong to is deleted. They may request erasure at any time by contacting us at the address below.

Access

Access to content is governed by which organisation you are a member of, and your role in it. You only get access to projects and contracts belonging to organisations you are a member of, projects you have been added to as a member, or contracts you are a party to.

Your rights

You have the right to access your own data, to rectification of inaccurate data, to erasure, to data portability, and to object to the processing. Enquiries can be directed to the contact address below.

You may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe the processing breaches the regulations.

Contact

personvern@mwafaka.com