Specific information – Customer

Last updated: February 2, 2026

Processing	Purpose of the processing	Legal basis	Categories of personal data processed	Retention period
Signing of insurance	Registration of insurance applications. Management of customer relationships and internal administration.	Performance of a contract.	Name, personal identity number, address, telephone number, registration number, bank account number, trade union affiliation.	At least 10 years after the expiry of the insurance period in accordance with the rules on limitation in the Insurance Contracts Act. In some cases, personal data may be retained for a longer period if required to establish, exercise or defend a legal claim. 7 years (financial information in accordance with the Bookkeeping Act).
Correspondence with authorities	Correspondence with authorities such as the National Board for Consumer Disputes (ARN) in the event that a dissatisfied customer submits a complaint.	Legitimate interest (defence of legal claims).	Information relevant to the claim. Name, address and, depending on the type of claim, information relating to health and income.	At least 10 years after the expiry of the insurance period.
Customer service	Management of customer contacts, onboarding, and matters relating to amendments and termination of insurance.	Performance of a contract.	Name, address, telephone number, email address.	1 year.
Archiving	Compliance with statutory documentation and archiving requirements.	Legal obligation.	Customer and insurance documentation. The personal data processed varies depending on the type of insurance.	At least 1 year after the insurance distributor’s obligations have ceased and thereafter for the entire period during which claims for damages may be asserted under the rules on limitation, which in total results in a retention period of 11 years.
Complaints handling	Handling of complaints from customers.	Legal obligation.	Name, address, telephone number, email address.	At least 10 years after the expiry of the insurance period.
Legal case management	Handling of legal matters related to claims handling and customer service cases.	Legitimate interest (establishment, exercise and defence of legal claims).	Name, telephone number, email address.	At least 10 years after the expiry of the insurance period.
Customer surveys	Customer surveys following completed contact or finalised claim.	Legitimate interest.	Name, telephone number, email address.	1 year.
Recovery (regress)	Exercise of rights of recovery against other insurance companies.	Legitimate interest.	Name, address, telephone number, email address and, depending on the insurance: account details, trade union affiliation, unemployment fund, income data, health data and personal identity number.	At least 10 years after the expiry of the insurance period.
Claims handling – Protection & Travel	Claims handling for income insurance, payment protection insurance, personal accident insurance and insurance products aimed at the travel industry.	Performance of a contract.	Name, address, telephone number, email address, account details, trade union affiliation, unemployment fund, income data, health data, personal identity number.	At least 10 years after the expiry of the insurance period.
Claims handling – Assistance	Claims handling for roadside assistance and vehicle guarantees.	Performance of a contract.	Name, address, personal identity number, telephone number, email address.	At least 10 years after the expiry of the insurance period.
Claims handling – Product	Claims handling for bicycles, consumer electronics, household appliances, garden equipment, glasses, watches, jewellery, hunting dogs and musical instruments.	Performance of a contract.	Name, address, personal identity number, telephone number, email address.	At least 10 years after the expiry of the insurance period.
Receipt of insurance notifications via API	File transfer and receipt of insurance notifications via API calls from insurance intermediaries.	Performance of a contract.	Name, address, personal identity number, telephone number, email address, product information and registration number.	At least 10 years after the expiry of the insurance period. 3 months for prospective customers who did not enter into an insurance contract.
Anti-money laundering in Norway	Compliance with requirements to collect and retain minimum information on customers/policyholders in Norway.	Legal obligation.	Name, date of birth, identification number, address. For legal entities: company name, legal form, organisation number and address, as well as information on board members.	5 years in accordance with Norwegian anti-money laundering legislation.
Customer insight	Use of anonymised vehicle registers to identify potential new customers and to avoid targeting existing customers.	Legitimate interest.	Registration number, insurance number.	3 months.
Bicycle register	Provision of a theft protection register for bicycles. The service is used solely for searches.	Legitimate interest.	Name, telephone number, address, personal identity number.	25 years or until deletion is requested by the data subject.
Customer communication – active customers	Marketing of similar products and services and service reminders.	Legitimate interest.	Name, email address, telephone number, address, personal identity number, insurance number, registration number.	At least 10 years after the expiry of the insurance period.
Customer communication – prospective customers	Presentation of offers and marketing.	Legitimate interest.	Name, email address, telephone number, address, personal identity number, insurance number, registration number.	3 months.
Renewal of insurance	Reminders regarding renewal of open-ended insurance policies.	Performance of a contract.	Name, email address, telephone number, address, personal identity number, insurance number.	At least 10 years after the expiry of the insurance period.
Testing and verification during system development	Testing and verification of information flows during system development.	Legitimate interest.	Name, email address, telephone number, address, personal identity number, insurance number, registration number.	Data deletion in test environments follows the respective production environment. Email addresses and telephone numbers are anonymised within 24 hours.
Suppression list	Ensuring the right to be erased from marketing communications.	Legal obligation.	Name, address, personal identity number.	Stored indefinitely.
My Pages	Customer portal with secure login for communication with customer service and presentation of offers.	Performance of a contract.	Name, personal identity number, address, telephone number, email address, registration number, bank account number, trade union affiliation.	At least 10 years after the expiry of the insurance period.
Reporting of data and statistics to intermediaries	File transfers between insurance intermediaries/suppliers and the insurance company.	Performance of a contract.	Name, personal identity number, telephone number, email address, address, insurance number, payment details, registration number.	1 month.