Legal

Privacy Policy

Last updated: 13 May 2026

Kurs og Kompetansesystemer AS, org. no. 925 897 019 ("we", "us") is the data controller for the personal data you provide when using rettesteg.no. We take privacy seriously and process data in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).

1. What we collect

  • Account data: Name, email address and password (encrypted) upon registration.
  • Assessment data: Your answers in the RIASEC, Big Five and values assessments, and the computed results.
  • Usage data: IP address, browser type, device type and pages visited, via Supabase (stored in the EU).
  • Payment data: Card details are handled exclusively by Stripe Inc. We only store subscription status.

2. Purpose and legal basis

  • Providing the service (contract): We use account and assessment data to deliver career recommendations. Basis: Art. 6(1)(b) GDPR — performance of a contract.
  • Improving the service (legitimate interest): Anonymous, aggregated results are used to improve our recommendation algorithm. Basis: Art. 6(1)(f) GDPR.
  • Marketing emails (consent): Only if you have explicitly consented. You can withdraw at any time. Basis: Art. 6(1)(a) GDPR.
  • Legal obligations: Invoices and accounting data are retained for 5 years. Basis: Art. 6(1)(c) GDPR.

3. Third-party sharing

  • Supabase Inc. — database and authentication (data processing agreement in place, data stored in the EU).
  • Stripe Inc. — payment processing (PCI DSS certified, their own terms apply).
  • Vercel Inc. — website hosting (data processing agreement in place).
  • We never sell personal data and do not share data with advertisers.

4. Retention periods

  • Account data and test results are retained for as long as the account is active.
  • Upon account deletion: data is deleted within 30 days, except legally required accounting data (5 years).
  • Marketing emails: unsubscription requests are processed immediately.

5. Your rights (GDPR Art. 15–22)

  • Access: Request a copy of all data we hold about you.
  • Rectification: Request correction of inaccurate data.
  • Erasure ("right to be forgotten"): Request deletion of your data.
  • Data portability: Receive your assessment results in machine-readable format (JSON).
  • Objection: Object to processing based on legitimate interest.
  • Complaint: You may lodge a complaint with Datatilsynet (datatilsynet.no) if you believe we process data incorrectly.

6. Cookies

  • We use strictly necessary cookies for authentication and session management.
  • We do not use any third-party tracking or advertising cookies.
  • Analytics tools used are configured with anonymised IP.

7. Contact

  • Privacy enquiries: hei@rettesteg.no
  • Data controller: Rettesteg AS, Norway.
  • You may also contact the Norwegian Data Protection Authority directly: datatilsynet.no · +47 22 39 69 00.
This privacy policy applies to rettesteg.no and all associated services. For questions, contact us at hei@rettesteg.no.