Privacy Policy

Creavid Live is used by organisations to broadcast their own events. That creates two distinct roles, and which one applies depends on the data in question. Creavid is the data controller for data the platform processes on its own behalf: accounts for administrators and customer-portal users, enquiries sent through the contact form on creavid.no, error monitoring, and technical logging to prevent abuse. Creavid is a data processor for data belonging to an individual event: registrations, Q&A questions, viewer statistics, recordings and transcripts. There the organiser — the company holding the broadcast — is the controller and decides the purpose. We process that data on the organiser's instructions, under a data processing agreement. If you registered for an event and want to know how your data is used beyond what is described here, the organiser's own privacy policy applies. Contact details: - Company: Creavid AS - Organisation number: 931 868 543 - Privacy email: personvern@creavid.no - General contact: post@creavid.no Data protection officer: We have assessed that we are not required to appoint a data protection officer under Article 37 — we are not a public authority, and our core activities consist neither of regular and systematic monitoring on a large scale nor of large-scale processing of special categories of personal data. Privacy enquiries go to personvern@creavid.no.

Event registration: Name, email address and company (optional). Required to give you access to the broadcast and to send your confirmation. Questions and answers (Q&A): Your name, and your email address if you provide one, when you submit a question. Approved questions are shown publicly with your name — the email address is never shown. Viewer statistics: That one browser watched a broadcast, when it started and how long it lasted. We do not store country, we do not store browser type, and we do not link a viewing session to your registration. A viewing session therefore describes no particular person, and is used only to count how many watched. User accounts: Email address, name and role for administrators, moderators and customer-portal users. Contact form enquiries: Name, email address, company and the message you write. See the section on the contact form below. Recordings and transcripts: Broadcasts are recorded. If you are visible or audible in a broadcast, that is personal data, and the organiser is responsible for it. Audio may be transcribed automatically to generate chapter markers. IP address: Your IP address is processed briefly to limit the number of requests per sender and prevent abuse of the registration and Q&A forms. It is not stored in the database.

If you send us an enquiry through the contact form, the company name and the message are sent to a language model at Anthropic, which produces a short summary of the organisation. We use that summary internally to prepare a reply. Your name and email address are not sent there, and we do not ask the model to say anything about you as a person. No decision is made automatically: a person reads the enquiry and answers it. The legal basis is legitimate interest (Article 6(1)(f)) in being able to respond professionally to an enquiry we invited. You may object to this processing under Article 21. If you would rather contact us without this, email post@creavid.no directly instead of using the form.

Processing	Legal basis
Event registration	Contract (Art. 6(1)(b)) — necessary to give you access
Q&A questions	Contract (Art. 6(1)(b)) — you initiate the action
Confirmation and reminder emails	Contract (Art. 6(1)(b))
Counting viewers (no personal data)	Outside the scope of the GDPR — the data identifies nobody
Admin and customer-portal accounts	Contract (Art. 6(1)(b))
Product analytics (Vercel Web Analytics)	Legitimate interest (Art. 6(1)(f)) — knowing which pages are used. The tool sets no cookies and stores no identifier on your device
Error monitoring (Sentry)	Legitimate interest (Art. 6(1)(f)) — detecting and fixing faults that affect broadcasts
Rate limiting per IP address	Legitimate interest (Art. 6(1)(f)) — preventing abuse and keeping the broadcast available
Transcription of broadcast audio	On the organiser's instructions — the organiser is responsible
Contact form enquiries	Legitimate interest (Art. 6(1)(f)) — responding to an enquiry

Are you required to provide this data? No, but for events that require registration, your name and email address are a condition of access to the broadcast. If you do not provide them, you cannot watch. Automated decision-making: We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22).

We do not ask for cookie consent, because we do not use any cookies that require it. Everything we store in your browser is strictly necessary for the platform to work, and is exempt from the consent requirement. This is what is stored: - Sign-in (administrators, moderators and portal users only) — keeps you signed in. - Language preference — remembers whether you want Norwegian or English. - Your own registration — your name, email and registration ID are stored locally in your browser for that specific event, so you do not have to register again if you reload the page, and so your questions can be linked to your registration. This leaves your browser only when you submit a question yourself. We use no marketing cookies, no cross-site tracking and no third-party advertising tools. Vercel Web Analytics, which we use to see which pages are visited, sets no cookies and stores nothing on your device. You can clear this at any time by clearing browser data for creavid.no. You will then need to register for events again.

We never sell personal data and do not share it for marketing purposes. We use the following processors to deliver the service:

Provider	What they do	Where
Supabase	Database, authentication and file storage	EU (Ireland)
Vercel	Website hosting and product analytics	EU region, US company
Cloudflare Stream	Video delivery and recording	Global network, US company
Mux	Video delivery and recording (newer broadcasts)	Global network, US company
Resend	Email delivery	USA
OpenAI	Automatic transcription of broadcast audio	USA
Anthropic	Summarising the organisation behind an enquiry (no name or email sent)	USA
Sentry	Error monitoring	EU (Frankfurt)
Microsoft	Office document preview in the customer portal	USA

About Office preview: When a portal user previews a Word, Excel or PowerPoint document, a time-limited link to the document is sent to Microsoft's viewer service, which fetches the file in order to display it. This happens only for documents that are already released. An unreleased document cannot be previewed — it must be downloaded, so that it never leaves the platform. Data may also be disclosed where we are legally required to do so. Data processing agreements: Everyone who processes personal data on our behalf does so under a data processing agreement, as Article 28 requires. To find out which agreement applies to a specific provider, contact personvern@creavid.no.

Several of the providers above are American. Transfers there rely on the EU Standard Contractual Clauses (Article 46(2)(c)) and/or the provider's certification under the EU–US Data Privacy Framework, combined with technical measures such as encryption in transit. You have the right to obtain a copy of the safeguards used. Request it at personvern@creavid.no.

Data	Retention
Registrations	For as long as the organiser needs them to document the event, or until you request deletion
Q&A questions	As above — approved questions form part of the event record
Viewing sessions	Kept as statistics. They identify nobody, so they are not deleted
Recordings and transcripts	Determined by the organiser
User accounts	Until the account is removed
Contact form enquiries	Up to 24 months after the last contact
Consent log	The log has been discontinued. It documented consent to processing that no longer exists, and those rows have been deleted. We still log completed erasures, as evidence that the request was fulfilled

On deletion, data is anonymised so that it can no longer be linked to you. Aggregate statistics that identify nobody are retained.

You have the following rights under the GDPR: - Access (Art. 15) — find out what data we hold about you - Rectification (Art. 16) — have inaccurate data corrected - Erasure (Art. 17) — have data deleted - Restriction (Art. 18) — ask us to restrict processing - Portability (Art. 20) — receive your data in a machine-readable format - Objection (Art. 21) — object to processing based on legitimate interest, including product analytics and the summarising of contact enquiries If your request concerns data we process on behalf of an organiser — your registration, your questions or the recording of an event — we must pass it to the organiser, who is responsible for answering. We will help you get to the right place.

Self-service: Go to My data to view, download or delete data linked to your email address. Self-service covers registrations, Q&A questions and viewing sessions. Email: For anything else — including user accounts, enquiries sent through the contact form, rectification, restriction and objection — contact us at personvern@creavid.no. We respond within 30 days. If we need longer because the request is complex, we will tell you within that deadline.

If we change this policy, we update the date and version number at the top. For significant changes to how we process data, we will notify you where practicable.

If you believe we are processing your personal data unlawfully, you may complain to the supervisory authority. We would appreciate hearing from you first so that we can put it right. Datatilsynet (Norwegian Data Protection Authority) Postboks 458 Sentrum 0105 Oslo, Norway Phone: +47 22 39 69 00 Email: postkasse@datatilsynet.no Website: www.datatilsynet.no