Sign in
Sign in

Privacy

Privacy policy

Last updated 21 September 2026

In short: the website sets no cookies until you accept analytics. In the OnSite app we store your name and email address to identify you, plus the information you register yourself to join a project. We never sell your data, and you can ask us to delete it at any time.

1. Who is the data controller

On-Site AS (org. no. 828 410 172), Standardveien 1, 0581 Oslo, Norway, is the controller for personal data processed on the website https://onsite.no and in the OnSite app (“OnSite”). For any privacy question, contact us at contact@onsite.no.

2. What this policy covers

This policy describes how we process personal data about visitors to the website and about users of the OnSite app. If you use OnSite on behalf of an employer or a project, that employer or project owner may additionally be a controller for its own processing of your data.

3. What data we process

On the website

The website is static and does not collect personal data unless you accept analytics in the consent banner. If you accept, we use Google Analytics 4 to see how many people visit, which pages are read, and the device, browser and approximate location (country/city) of the visit. IP addresses are anonymised. Your choice is stored locally in your browser, not with us.

In the OnSite app

  • Account data (required): name and email address, used to identify you and sign you in. If you sign in through a third party (for example Vipps, Microsoft or Google), we receive your name and email from them.
  • Profile data (optional): phone number, employer/company, HSE card and any certificates or competence documents you choose to upload.
  • Project data: which projects you are a member of, and confirmations that you have reviewed project information, HSE training and similar.
  • Technical data: sign-in and usage logs needed for operation, troubleshooting and security.

4. Purposes and legal basis

  • Providing the service: creating and managing your account, letting you join projects and sharing your registered information with them. Basis: our contract with you (GDPR Article 6(1)(b)).
  • Documenting access and training: giving the project documentation that only qualified personnel have access to the construction site and that mandatory information has been reviewed. Basis: the legitimate interests of the project and of us (Article 6(1)(f)) and the legal obligations projects have under Norwegian construction and working-environment regulations (Article 6(1)(c)).
  • Operation and security: troubleshooting, preventing abuse and securing the service. Basis: legitimate interest (Article 6(1)(f)).
  • Website analytics: understanding how the website is used. Basis: consent (Article 6(1)(a)), which you can withdraw at any time.
  • Contact: answering enquiries you send us. Basis: legitimate interest.

We do not use your data for marketing, profiling or automated decision-making.

5. Who we share data with

  • The projects you join: when you join a project, its administrators (typically the general contractor, a subcontractor or the owner) get access to your name, contact details, HSE card, certificates and the confirmations you have registered.
  • Processors: suppliers that run the service for us, such as cloud hosting, email delivery and analytics. They process data only on our instructions and under data processing agreements.
  • Authorities: where we are legally required to.

We never sell personal data. Data is stored within the EU/EEA. If a supplier processes data outside the EEA, we ensure a valid transfer mechanism such as the EU standard contractual clauses.

6. How long we keep data

  • Account data is kept for as long as your account is active.
  • Project data is kept for as long as the project needs the documentation, and thereafter for as long as statutory retention requirements apply.
  • Website analytics data is kept for up to 14 months.
  • Technical logs are deleted or anonymised on a rolling basis, normally within 90 days.

7. Your rights

You have the right to:

  • request access to the data we hold about you,
  • have inaccurate or incomplete data corrected,
  • have your data erased,
  • request that processing is restricted,
  • receive the data you have provided in a machine-readable format (data portability),
  • object to processing based on legitimate interest, and
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Send your request to contact@onsite.no and we will respond without undue delay and within 30 days at the latest. If you believe we process your data unlawfully, you can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet.

8. User data deletion

Please contact us at contact@onsite.no if you for any reason would like to have your user data deleted. We will then remove all data that identifies you in OnSite, except documentation a project is legally required to retain.

9. Cookies

The website sets no cookies of its own. If you accept analytics, Google Analytics sets cookies (_ga and _ga_*) used to distinguish visitors. You can change your choice at any time via “Cookie settings” at the bottom of the page. The OnSite app uses only cookies that are necessary for sign-in and security.

10. Security

We protect your data with technical and organisational measures, including encrypted transport, access control and logging. Access to personal data is limited to those who need it to provide the service.

11. Changes

We may update this policy when the service or the law changes. The current version is always available on this page, with the date of the last update at the top.

12. Contact

On-Site AS, Standardveien 1, 0581 Oslo, Norway · contact@onsite.no. See also the terms of use.