How Independent Consultants handles your personal data.
Independent Consultants AS, organisation no. 832 872 652, Nakkeknausen 4, 6014 Ålesund, Norway, is the controller for its member accounts, its own services to independent consultants and its own administration. When your consulting house registers a profile and instructs IC to process it for the house, the house is the controller and IC is its processor. The house is identified through your employer/principal and the registration; contact IC if you need to know which house registered you. Privacy contact: richard.gulbrandsen@ic.no, +47 91 31 25 77.
We process names, email, phone, company, account information, optional profile photos, CVs, titles, skills, experience, availability, preferences, expressions of interest and assignment follow-up. Data comes from you, your consulting house, its Flowcase account or contact during an assignment process. Registration, consent, information and access logs may include actor, time, version, IP address and browser information. Privacy requests are stored with their content and case status. Do not upload unnecessary data, special-category data or criminal-offence data.
Data is used to administer accounts/profiles, identify assignments, follow up interest and submissions, send selected notifications, protect security and handle rights. IC follows the house's documented instructions for house profiles. CRM uses Anthropic for CV analysis and matching support and Voyage for embeddings/search. Data is minimised before analysis where supported by the function. AI may produce incorrect or biased assessments; staff assess suggestions before submission decisions. This flow does not make solely automated decisions with legal or similarly significant effects. IC does not opt into general model training with content; Voyage is used with opt out.
Where IC is the controller, consent under Article 6(1)(a) covers optional CV use and selected notifications. Processing necessary to provide a service you have contracted for or requested is based on Article 6(1)(b). Handling statutory privacy rights and necessary records may rely on Article 6(1)(c). Necessary security and abuse prevention are assessed under Article 6(1)(f); the interest is protecting accounts, data and the service, with limited access and retention. This is not a general basis for marketing or new CV use. For house profiles, the house determines and documents its basis. The current registration flow requires evidence of the consultant's consent to CV use. The house's information confirmation and agreement acceptance are not your consent.
The house must inform you adequately before registration or explicitly ask IC to send the information. Sender, time, text version, choice and affected profiles are recorded separately from consent. Selected IC messages enter a daily queue; missing addresses and delivery failures are followed up. No reply or click is required. A signed contact link lasts 30 days and opening it alone changes no data. You can always contact richard.gulbrandsen@ic.no.
Authorised IC staff receive necessary access. CVs and contact details are shared with the relevant client following your or the house's submission/instruction. Other houses cannot access the profile. Providers include Supabase (database, authentication and CV storage), Vercel (hosting), Cloudflare (files, backup and Turnstile), Resend (email), Anthropic (AI), Voyage (embeddings) and GitHub (backup execution). Google is used for optional Google sign-in and Sanity for site content and agreement texts. Primary storage in Europe does not exclude processing/access in the USA or Singapore by relevant providers. Transfers outside the EEA must be covered by applicable Standard Contractual Clauses or a covering adequacy decision and necessary supplementary measures. Contact IC for relevant recipient details and copies of safeguards. New countries for house data require documented instructions.
CV consent lasts 12 months. Submissions stop on expiry, and deletion/archiving is processed after a 90-day grace period. Profiles without a CV are archived after 30 days. You can withdraw consent and request earlier erasure; the grace period does not authorise processing without a valid basis. Account information is retained while the account is active and necessary. Access logs have a 24-month retention period. CRM cases, ongoing assignments, documentation and legal duties are assessed individually; open cases and restrictions may pause automatic erasure of data necessary for the case. On request, IC explains what is retained and why.
Restricted-access daily backups are retained for up to 35 days, monthly copies for 400 days, and deleted/overwritten files in deletion mirrors for 90 days. Encrypted GitHub backup artifacts are retained for up to 7 days. Time runs from creation in the relevant backup class. Live mirrors must follow source deletions. Backups support recovery and continuity, not ordinary matching. Subsequent erasures and restrictions must be reapplied before restored data enters production. Different binding agreements and statutory requirements are assessed separately; new backup terms do not amend earlier agreements without acceptance.
You may request access, rectification, erasure, portability and restriction, and object to processing based on legitimate interests. You may withdraw consent without affecting lawfulness before withdrawal. Contact richard.gulbrandsen@ic.no; IC assists the house with responses about house processing. We record receipt dates, follow applicable deadlines and explain exceptions. The house receives minimised automatic case status, not your personal reasoning; necessary case content may be shared separately. We use access controls, encrypted transport, protected storage and logs. You may complain to Norway's Data Protection Authority, datatilsynet.no.
Material changes to purposes, agreements or information are communicated to affected users. Agreements and consent records are versioned. Last updated: 6 September 2026.
You can contact IC at any time about access, objection or restriction, including after an email link expires.
post@ic.no