Your privacy, in plain language.

Who's behind the policy.

ScoutDI AS — Sluppenvegen 25, N-7037 Trondheim, Norway. Org. nr. 920 197 744.

For any privacy question, write to contact@scoutdi.com. We're the controller for everything covered here.

What we collect.

• What you give us — name, work email, company, role and phone number when you submit a form, book a demo, subscribe, or contact support.
• Scout Portal account data — identifier, role, organization, authentication metadata and audit-log entries from actions you take in the platform.
• Technical data from your visit — IP address, browser, device, pages viewed, referring URL. Set via cookies (see our cookies policy).

We collect this directly from you. We do not buy or enrich your data from third-party brokers.

Why we use it.

Under GDPR Article 6(1), every purpose has a legal basis. Here's how that maps for us:

• Respond to enquiries, schedule demos, deliver requested services — legitimate interest and contract where you're an existing customer.
• Operate Scout Portal and provide support — contract.
• Send product updates and event invitations — consent. Unsubscribe any time.
• Analytics and marketing cookies — consent, captured via the cookie banner.
• Counting cookie-banner answers — when you answer the cookie banner, the page tells our server only which answer was given (accept all, analytics only, marketing only or reject) and whether it was your first answer. The server adds one to a counter for that day. No identifier, cookie, IP address or page address is stored with it, so the count cannot be linked to you. It tells us what share of visitors decline measurement.
• Meet legal and regulatory obligations — legal obligation.

We do not sell your personal data. We do not buy or enrich personal data from data brokers. We use a LinkedIn Pixel to retarget visitors who have already engaged with us on LinkedIn — this is opt-in via the cookie banner (Marketing category) and you can withdraw consent at any time.

Measuring and targeting our advertising. To understand which advertising leads to real business, and to reach organisations similar to our customers, we share business contact and company records from our CRM with LinkedIn — name, work email, job title, employer, and whether an enquiry became a signed order, including its value. The purpose is measurement and business-to-business targeting; the legal basis is legitimate interest, and you can object at any time using the contact details below. We do not share private addresses, and we never share special-category data.

Matching a qualified enquiry to the advertising that produced it. When an enquiry you sent through a form on scoutdi.com is qualified by our sales team, we send Google Ads your email address and phone number in hashed form (SHA-256, an irreversible fingerprint, never the details themselves), together with the Google advertising click identifier if your visit had one. If you have given Marketing consent, the Google tag on the form also sends the same hashed email address (and phone number, if you gave one in international format) at the moment you send the form, hashed in your browser before it leaves the page, so that Google can recognise the enquiry when we report it as qualified. Without Marketing consent the page sends nothing of the kind. Google uses this only to tell us whether an advertising click led to a qualified sales enquiry; it is not used to build a profile of you. We do this only for enquiries made through our website forms. The legal basis is legitimate interest in measuring which advertising works, and you can object at any time by emailing contact@scoutdi.com. The recipients are Google Ireland Limited and Google LLC, acting under the Google Ads Data Processing Terms and Google’s customer data terms, and Google retains the data in line with those terms. A hashed email or phone number is still personal data under the GDPR.

Not showing our ads to customers and partners, and finding similar organisations. We send Google Ads the hashed work email address and phone number (SHA-256) of business contacts in our CRM in three groups: people at companies that already buy from us, people at our distributors and resellers, and people at companies in the industries we serve. Google matches the fingerprints against its own accounts and keeps lists we use to not show our advertising to customers and partners, and as a hint for which kind of organisation our advertising should reach. Contacts that do not match are discarded by Google. Your name, message and company are never sent, and we do not use these lists to follow you around the web. The legal basis is legitimate interest in advertising our products to businesses efficiently; you can object at any time by emailing contact@scoutdi.com, and we then remove you from every list. The recipients and terms are the same as above (Google Ireland Limited and Google LLC, Google Ads Data Processing Terms and Customer Match terms).

Inside ScoutDI.

Access is limited to employees who need the data for their role. All employees are bound by confidentiality. We may share data with public authorities when we're legally required to.

Processors we work with.

Each of these is bound by a Data Processing Agreement with ScoutDI AS:

• HubSpot — CRM and marketing automation. Hosted in the United States.
• Microsoft 365 — email, collaboration, file storage. Hosted in the EU.
• Microsoft Azure — Scout Portal hosting, scoutdi.com website delivery, and chat/feedback backend. Hosted in the EU.
• Google Analytics 4 — aggregated website analytics. Hosted in the United States. Runs on Google’s default configuration; full IP is processed at collection and not pseudonymised before transmission.
• LinkedIn (LinkedIn Pixel) — retargets visitors who have engaged with our LinkedIn presence. Activated only after Marketing consent is given. Hosted by LinkedIn Ireland (EU) and LinkedIn Corporation (US).
• LinkedIn (CRM Sync) — a one-way transfer of business contact, company and order records from our CRM to LinkedIn, used to report which advertising contributed to signed orders and to build business audiences. Separate from the LinkedIn Pixel and not dependent on cookie consent. Hosted by LinkedIn Ireland (EU) and LinkedIn Corporation (US).
• Google Ads — measures which advertisements produce enquiries. Receives the advertising click identifier and the fact that an enquiry happened, activated only after Marketing consent is given. With Marketing consent, receives your hashed email address (and phone number) when you send an enquiry form, and again when the enquiry is qualified, as described above. Business contacts in our CRM are also sent in hashed form to keep our audience lists (Customer Match), as described above — never your name or message in any form. Provided by Google Ireland Limited and Google LLC; hosted in the United States.
• Microsoft Clarity — anonymised recordings of how pages are used, to find layout and usability problems. Activated only after Analytics consent is given. Hosted in the United States.

When data leaves the EU.

Some of our processors operate outside the EU/EEA. We rely on the following safeguards:

• HubSpot LLC (United States) — certified under the EU-US Data Privacy Framework. Standard Contractual Clauses apply where the framework does not cover a transfer.
• Google LLC (United States) — certified under the EU-US Data Privacy Framework. Standard Contractual Clauses for transfers not covered by the framework.
• LinkedIn Corporation (United States) — certified under the EU-US Data Privacy Framework. Standard Contractual Clauses apply where the framework does not cover a transfer.

Your rights.

Under the GDPR you have the right to:

• Ask us what data we have on you
• Correct inaccuracies
• Ask us to delete your data
• Restrict or object to certain processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where processing is based on consent

To exercise any of these, email contact@scoutdi.com. We respond within 30 days.

One thing worth being explicit about. Where we have shared your record with LinkedIn or a Google Ads audience list as described above, deleting it in our CRM does not remove it there automatically. When you ask us to delete your data, we remove it from all of them as part of the same request: the Google Ads lists follow our CRM within a day, and LinkedIn is removed by hand.

If you believe we're not respecting your rights, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

How long we keep it.

We keep personal data only as long as we need it for the purpose it was collected for, then delete or anonymize it.

• Contact data from website forms: up to 24 months from last interaction.
• Scout Portal account data: for the duration of the active commercial relationship. On termination or extended inactivity, data is removed in line with the customer's deletion request or during periodic account review.
• Analytics data: anonymized after 14 months.
• Financial and contractual records: 5 years, per the Norwegian Bookkeeping Act (bokføringsloven).

Automated decision-making.

ScoutDI does not make automated decisions that produce legal or similarly significant effects on you (GDPR Art. 22). A human is always in the loop.

Children's data.

Our services are aimed at industrial customers. We don't knowingly collect personal data from children under 16.

Security.

ScoutDI is ISO 9001 and ISO/IEC 27001 certified. We use appropriate technical and organizational measures to protect your data.

Our forms are protected against automated abuse by Cloudflare Turnstile, running in invisible mode: it verifies silently in the background and processes limited technical signals from your browser and device solely to distinguish people from bots — it does not track you across sites and is not used for advertising. Details in Cloudflare’s Turnstile Privacy Addendum.

Changes to this policy.

When we update this policy, we change the “last updated” date at the top. Check back periodically if it matters to you.