Privacy policy

Last updated: 2026

This policy explains how Kvarven Tax Advisors AS ("we") processes personal data when you visit this website, submit an enquiry, or engage us as your adviser. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Who is responsible

Kvarven Tax Advisors AS, Lars Hilles gate 30, 5008 Bergen, Norway, is the data controller for personal data described in this policy. Questions can be sent to personvern@kvarventax.no.

What we collect

• Enquiry data: name, company, email, phone number and the description you provide in the contact form.
• Client engagement data: accounting records, payroll data, identity documents and correspondence necessary to deliver the agreed services.
• Technical data: IP address, browser type, pages visited and referring source, collected through cookies where you have consented.

Why we process it

• To respond to your enquiry and prepare a proposal (legitimate interest, and your consent for the contact form).
• To perform our engagement agreement with you (contract).
• To comply with statutory obligations, including bookkeeping, accountancy and anti-money-laundering rules (legal obligation).
• To improve the website, where analytics cookies have been accepted (consent).

How long we keep it

Enquiries that do not lead to an engagement are deleted within twelve months. Client records are retained for the periods required by Norwegian bookkeeping and anti-money-laundering legislation, normally five years after the end of the financial year, and then deleted.

Who has access

Access is limited to the engagement team and to service providers acting as our data processors, such as accounting software and secure document storage. All processors are bound by written data processing agreements and store data inside the EEA. We do not sell personal data.

Your rights

You may request access to your personal data, correction of inaccurate data, deletion where no statutory retention applies, restriction of processing, data portability, and withdrawal of consent. Requests are answered within thirty days. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

Security

We use access control, encryption in transit, logging and regular backups. Sensitive documents are exchanged through a secure upload link rather than email attachments.

Cookies

Cookie use, categories and how to withdraw consent are described in the cookie policy.

Changes

We may update this policy. Material changes will be announced on this page with a new date at the top.