1. GENERAL INFORMATION
This document describes the principles for the processing and protection of personal data on the website multinorfinans.no ("Website"), including for contact forms, telephone/SMS/email communication, digital tools (e.g., calculators), and the AI Assistant. The document meets the requirements of the General Data Protection Regulation (GDPR) and relevant national laws.
2. DATA CONTROLLER
The data controller is Inventive Logic spółka z ograniczoną odpowiedzialnością spółka komandytowa with its registered office at: ul. Lęborska 3B, 80‑386 Gdańsk, entered in the National Court Register (KRS) under number: 0000709320, NIP: 957‑09‑36‑720, email: finanse@multinorfinans.no, tel. +47 21 999 413 ("ILogic", "we").
3. SCOPE OF PROCESSED DATA AND SOURCES
• Contact and identification data: name, surname, email, phone number, language/country; when required by Partners – identifiers (e.g., PESEL/personal number) to prepare an offer.
• Inquiry data: area of interest (loans/insurance/refinancing), simulation parameters, message content.
• Interaction data: contact history, sending statuses, and possible call recordings (after a recording notification).
• Device/online data: IP address, cookies/SDK identifiers, technical logs (details in point 10).
• AI Assistant: conversation content, timestamps, and metadata necessary to provide a response and ensure security. The data source is primarily You, and also (if you share it with us) external tools that you use independently (e.g., data from Gjeldsmonitor).
4. PURPOSES AND LEGAL BASES (GDPR art. 6)
1. Handling inquiries and connecting with a Partner (including transferring data to the Partner at your explicit instruction) – art. 6 para. 1 lit. b GDPR (agreement/pre-contractual activities).
2. Monitoring/Subscription (periodic contact with information about available services) and direct marketing through electronic/telephonic channels – art. 6 para. 1 lit. a GDPR (consent) in conjunction with the Polish Act on the Provision of Electronic Services (UŚUDE) and the Telecommunications Law (PKE) (requirement of consent for commercial information/telemarketing).
3. Analyses, statistics, effectiveness measurement (only within the scope of cookie consents) – art. 6 para. 1 lit. a GDPR (consent).
4. System security, fraud prevention, claim assertion, maintaining documentation – art. 6 para. 1 lit. f GDPR (legitimate interest) and art. 6 para. 1 lit. c GDPR (legal obligation).
5. Recording calls (quality/evidence) – art. 6 para. 1 lit. f GDPR; no consent → alternative non-recorded channel.
6. AI Assistant – providing a response and ensuring security – art. 6 para. 1 lit. f GDPR; improving chat quality/analytics – only with separate consent (art. 6 para. 1 lit. a GDPR).
5. DATA RECIPIENTS
• Processors (based on data processing agreements): hosting/cloud providers, CRM systems, mailing/SMS, call-center, IT security, AI technology providers (language models).
• Independent controllers: Partners (financial/insurance intermediaries, banks, etc.). After data transfer, the Partner becomes the controller for the scope of its service and provides you with its own GDPR information.
• Public authorities – when required by law.
An updated list of the categories of subcontractors and the bases for transfers is published on the /subprocessors page.
6. DATA TRANSFER OUTSIDE THE EEA
Possible (e.g., when using services from US providers). We ensure the legality of the transfer in accordance with Chapter V of the GDPR, in particular through:
• EU‑US Data Privacy Framework (DPF) – for certified entities, or
• Standard Contractual Clauses (SCC) + transfer impact assessment and supplementary measures;
• exceptionally – art. 49 GDPR (when adequate).
Details and updates on the bases for transfer – on /subprocessors.
7. AI ASSISTANT – INFORMATION
You are talking to an AI system, not a human. The content is for informational and educational purposes and does not constitute advice (financial/legal/tax) or an offer. Do not enter sensitive data (e.g., health, beliefs, full document numbers). Chat data is not used to train our models; AI technology providers process it only as processors based on agreements and appropriate transfer bases.
8. MARKETING AND ELECTRONIC COMMUNICATION
The sending of commercial information by email/SMS/phone occurs only based on your prior consent in accordance with UŚUDE and PKE. You can withdraw your consent at any time (without affecting the lawfulness of processing before the withdrawal).
9. RETENTION PERIOD
Contact/inquiry data: up to 24 months from the last interaction or until consent is withdrawn – whichever occurs first.
Marketing consents and consent logs: for the duration of the service + up to 6 years (for evidentiary purposes/statute of limitations).
Technical and security logs: up to 12 months (unless incidents justify a longer period).
Call recordings: typically up to 12 months.
Data transferred to Partners: according to the policies of the respective Partner (separate controller).
10. COOKIES AND SIMILAR TECHNOLOGIES
We use necessary cookies (they ensure the Website's operation) and – with your consent – analytical and marketing cookies. You can give/withdraw consent in the Privacy Settings (CMP banner).
Example categories: Necessary (always active), Analytical, Marketing, Functional (e.g., video embeds, maps).
We use third-party plugins/elements (e.g., YouTube/Vimeo, advertising tools) that may use their own cookies in accordance with their privacy policies.
You have a real choice – you can accept or reject non-essential cookies; lack of consent does not restrict the Website's basic functions.
11. SERVER LOGS
Every request to the Website is recorded in logs (including IP address, timestamp, browser/OS headers). The logs are used for Website administration, security, and diagnostics – we do not identify users based on them.
12. PROFILING AND AUTOMATED DECISION-MAKING
We may conduct marketing profiling/segmentation (e.g., language, topic) to tailor content. We do not make decisions that produce legal effects based solely on automated processing (art. 22 GDPR).
13. YOUR RIGHTS
You have the right to: access your data (copy), rectification, erasure, restriction of processing, data portability, objection (including to marketing), withdrawal of consent at any time.
You can exercise these rights by contacting us: finanse@multinorfinans.no.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (PL) or Datatilsynet (NO). Current contact details are available on the websites of these authorities.
14. SECURITY
We use technical and organizational measures adequate to the risks (transmission encryption, access control, event logging, testing, training, data processing agreements). Access to data is granted only to authorized persons.
15. CONTACT
For privacy matters, please write to us at: finanse@multinorfinans.no. We have not appointed a Data Protection Officer (DPO).
16. CHANGES TO THE POLICY
We publish the current version on the Website. We will inform users with whom we have ongoing contact (e.g., by email) of significant changes.
***
APPENDIX A — FINANCIAL AND INSURANCE SERVICES (DETAILED INFORMATION)
1. Scope and Purpose
When you use our services in the financial/insurance sector, we collect data necessary for: verifying interest in a Product, connecting you with a Partner (financial/insurance intermediary), and providing Monitoring/Subscription (informing you about new opportunities).
2. Legal basis
• handling the inquiry and connecting with a Partner – art. 6 para. 1 lit. b GDPR;
• transferring data to the Partner and marketing contact – your explicit consent (art. 6 para. 1 lit. a GDPR + requirements of UŚUDE/PKE);
• for security/billing/claim purposes – art. 6 para. 1 lit. f GDPR and/or art. 6 para. 1 lit. c GDPR.
3. Data Transfer to Partners
We transfer your data only at your instruction and to a specific Partner. After the transfer, the Partner is an independent controller for the scope of its service.
4. Data from External Tools (e.g., Gjeldsmonitor)
We promote the Gjeldsmonitor tool as an external service for independently monitoring credit information in Norway. We do not intermediate access, and we do not retrieve data from this tool. If you voluntarily provide us with information you have obtained yourself from Gjeldsmonitor (e.g., values given in a conversation, a sent report), we will process this data:
• to fulfill your request (e.g., preliminary assessment of refinancing options, connecting with a Partner) – art. 6 para. 1 lit. b GDPR;
• as part of Monitoring – art. 6 para. 1 lit. a GDPR (consent to marketing contact).
5. Specific Information on Consumer Loans
Binding data and offer parameters (APRC, total cost, etc.) are prepared exclusively by the Partner/Institution. The Partner/Institution may require documents for a creditworthiness assessment. Ilogic does not perform a final creditworthiness assessment and does not guarantee the acquisition of a product.
This Privacy Policy is effective from the date of its publication on the Website.
Date of last update: September 4, 2025.