Compliance
Legal basis
Compliance document
Legal basis
(English original)
Last reviewed: 2026-10-20 · Version: 1.4
Which law applies
- GDPR — Regulation (EU) 2016/679 (EUR-Lex). It applies across the EU/EEA, including in Norway through the EEA Agreement (EEA Joint Committee Decision No 154/2018).
- Every EU/EEA country supplements GDPR with its own national data-protection act and names its own supervisory authority; each of the fifteen countries Fundarem targets has its act and authority on its page in our country notes, sent on request. For example, for Norway that is Personopplysningsloven (LOV-2018-06-15-38, Lovdata) and Datatilsynet (our Norway note, sent on request).
- Some countries have rules that apply only where Fundarem is used to control or monitor employees (Germany, Austria, the Netherlands and France each have a specific statute; see each country's page). For example, in Norway Arbeidsmiljøloven chapter 9 (the Working Environment Act, LOV-2005-06-17-62, Lovdata) applies only where Fundarem is used as a control measure towards employees: the employer must then discuss its need, design and implementation with the employee representatives as early as possible. It is a duty to discuss, not a veto. Fundarem has no built-in check for this; whether a use is a control measure is the customer's decision.
The legal basis for the product
The customer, as controller, chooses and documents the legal basis for each purpose. For the typical uses of Fundarem:
| Processing | Usual basis | Why |
|---|---|---|
| Customer and supplier records, invoices, orders | Art. 6(1)(b) contract, and art. 6(1)(c) legal obligation for bookkeeping | Needed to deliver and bill what was agreed, and to keep accounts |
| Contact persons at customers and suppliers | Art. 6(1)(f) legitimate interests | Running an ordinary business relationship; the customer records its balancing test |
| Employee data | Art. 6(1)(b) employment contract, and art. 6(1)(c) where law requires it | Running the employment; the country's own employment and working-environment rules also apply |
| Dashboards, reports and AI-assisted routine work over that data | Art. 6(1)(f) legitimate interests | Efficient, overseen operation of the business; pseudonymisation and human approval reduce the impact on the people concerned |
| Anything outside the above, such as marketing to individuals | Art. 6(1)(a) consent, where required | Consent is freely given, specific and can be withdrawn at any time |
National identity numbers (fødselsnummer) may only be processed where there is an objective need for secure identification (personopplysningsloven § 12). The anonymiser is on by default: it runs before every model call, on every route, and masks the columns tagged for masking plus the names and patterned values it recognises (presets Strict / Standard). Your admin can switch it off per sensitive column class (person name, national id, email, phone, organisation number, bank account) per model route, as a logged change that follows your approval rule: on that route the switched-off classes are sent as they are, every other class stays masked, and every other route is unaffected. For a model inside the installation it can also be switched off entirely (the Standard preset). Tag the national id column for masking so it is replaced by a placeholder; whether to hold the numbers at all is the customer's decision.
Our own processing
As processor, we process customer data only on the customer's instructions (see Data processing agreement). For this public website, we rely on art. 6(1)(f) for ordinary request logs needed to run and secure the site.