Data Protection

Mayfair Consulting Group complies with the Norwegian Personal Data Act (Personopplysningsloven) and the Norwegian Freedom of Information Act (Offentleglova). This Policy outlines our procedures to ensure that personal information about clients is processed fairly and lawfully.

At Mayfair Consulting Group, we are committed to safeguarding the personal information of our clients while providing ISO consultancy services. To ensure a high standard of service and professionalism, we collect and process personal data in compliance with the Norwegian Personal Data Act (Personopplysningsloven) and the General Data Protection Regulation (GDPR).

Personal Data We Collect

We may collect and hold personal information about you, which includes but is not limited to:

• Personal details: Your name, age, address, telephone numbers, and email address.
• Professional details: Your business address, role within the company, and relevant qualifications (if applicable).
• Service-specific information: Information about the ISO consultancy services provided, including reports, audits, and recommendations.
• Correspondence: Emails or other communications related to our consultancy services.

Purpose of Collecting Personal Data

We collect and retain personal data to:

• Deliver effective and tailored ISO consultancy services.
• Maintain accurate and comprehensive records of the services provided.
• Fulfill contractual and legal obligations, including billing and compliance reporting.

Retention of Personal Data

• We will retain personal data for as long as you are an active client.
• Once services have concluded, we will securely store your records for at least ten years, unless a longer retention period is required by Norwegian law.

Data Security

• Your personal data is stored securely in our digital systems and/or manual filing systems.
• Our digital systems are equipped with secure audit trails and data encryption.
• Access to personal data is restricted to authorized personnel only.

Disclosure of Personal Data

To provide effective services, we may need to share your information with:

• External auditors or certification bodies involved in your ISO compliance process.
• Relevant government or regulatory agencies, when legally required.
• Other third parties as necessary to deliver our services, always on a need-to-know basis.

Disclosure will only occur when:

1. It is necessary to provide services.
2. It is required by law or a court order.
3. You have given explicit consent.

Your Rights

As our client, you have the right to:

• Access your data: Request a copy of the personal data we hold about you.
• Request corrections: Ensure any inaccurate or incomplete data is rectified.
• Withdraw consent: Object to the processing of your data under certain circumstances.

Requests for access, corrections, or objections should be made in writing to our Data Protection Officer at [email protected].

Handling Data Requests

• We will provide a copy of your records within 30 days of receiving a written request.
• For extensive or complex requests, a reasonable administrative fee may apply.

Changes to This Policy

This Data Protection Policy is reviewed regularly to ensure compliance with Norwegian laws and GDPR. Any updates will be communicated promptly.

If you have concerns about how your personal data is used, please contact us to discuss further. We remain committed to addressing your privacy needs while delivering the highest standard of service.