1. Roles and contact
Spring Agency AS, Norwegian organisation number 928 605 221, is the data controller for personal data processed for sales, support, payment and administration of Brreg Sync.
When Brreg Sync processes information from a customer's HubSpot account to provide search and synchronisation, Spring Agency normally acts as a data processor on behalf of the customer. The customer is then the data controller and determines the purposes and legal basis. A data processing agreement is available where required.
Contact: thomas@springagency.com.
2. Data we process
- HubSpot portal ID, account domain and the email address of the user who installs the app.
- OAuth access and refresh tokens required to connect the app to HubSpot.
- Selected settings and property mappings between Brreg and HubSpot.
- HubSpot company ID and Norwegian organisation number used in searches and synchronisation.
- Usage data such as the number of searches and updates, source, status and timestamp.
- Stripe customer, subscription and payment status. Stripe processes card details; Spring Agency does not store them.
- Technical logs, error descriptions and tracking IDs.
- Information you submit through the support form.
Business data and available annual accounts are obtained from public registers maintained by the Brønnøysund Register Centre. The data is used for the current request and may be written to the HubSpot properties selected by the customer. Brreg Sync is designed for business records, not personal contact records.
3. Purposes and legal basis
We use the information to provide the integration, authenticate the HubSpot account, perform synchronisation, administer subscriptions, provide support, prevent misuse and improve service stability.
Where Spring Agency is the controller, processing is primarily necessary to perform the Brreg Sync agreement. Security logging and limited product analytics rely on our legitimate interest in providing a secure and reliable service. Payment and subscription records are retained where required by Norwegian bookkeeping law. Where Spring Agency is the processor, processing follows the customer's documented instructions.
4. Processors and service providers
We use providers required to deliver the service, including HubSpot for CRM and the app platform, Stripe for payments and subscriptions, and providers of server, database, backup and monitoring services. We share information only to the extent necessary for the relevant purpose.
Data may be processed outside Norway. Where a provider processes data outside the EEA, we use a valid transfer mechanism, such as the European Commission's Standard Contractual Clauses.
5. Retention and deletion
- OAuth tokens are retained while the app is installed and are deleted or revoked upon uninstall.
- Settings and installation data are normally deleted or anonymised no later than 90 days after the customer relationship ends.
- Technical webhook and error logs are normally retained for up to 30 days unless longer retention is required to investigate a security incident.
- Aggregated usage statistics may be retained for up to 24 months.
- Payment and transaction records are retained for as long as required by Norwegian bookkeeping law.
- Data already written to the customer's HubSpot account is controlled and deleted by the customer.
6. Information security
We use access controls, encrypted transport, signature verification for webhooks and HubSpot requests, logging, backups and restricted access to the production environment. No online service can be guaranteed to be entirely risk-free.
7. Your rights
You may request access, correction, deletion, restriction or data portability where applicable. You may also object to processing based on legitimate interests.
Send your request to thomas@springagency.com. You may complain to the Norwegian Data Protection Authority if you believe the processing infringes applicable data protection law.
8. Changes
We may update this policy when the service or applicable law changes. We will provide reasonable notice of material changes.