How Independent Consultants handles your personal data.
Independent Consultants AS, organisation no. 832 872 652, Nakkeknausen 4, 6014 Ålesund, Norway, is the controller for its member accounts, its own services to independent consultants and its own administration. When your consulting house registers a profile and instructs IC to process it for the house, the house is the controller and IC is its processor. The house is identified through your employer/principal and the registration; contact IC if you need to know which house registered you. Privacy contact: richard.gulbrandsen@ic.no, +47 91 31 25 77.
We process names, email, phone, company, account information, optional profile photos, CVs and other documents you upload (e.g. certificates, references and diplomas), titles, skills, experience, availability, preferences, expressions of interest and assignment follow-up. Data comes from you, your consulting house, its Flowcase account or contact during an assignment process. If you write to us in the chat, we process the messages and whatever you provide there. Registration, consent, information and access logs may include actor, time, version, IP address and browser information. Privacy requests are stored with their content and case status. What the website stores in your browser is described in section 9. Do not upload unnecessary data, special-category data or criminal-offence data.
Data is used to administer accounts/profiles, identify assignments, follow up interest and submissions, answer chat enquiries, send selected notifications, measure use of the website where you have consented, protect security and handle rights. IC follows the house's documented instructions for house profiles. CRM uses Anthropic for CV analysis and matching support and Voyage for embeddings/search. Data is minimised before analysis where supported by the function. AI may produce incorrect or biased assessments; staff assess suggestions before submission decisions. This flow does not make solely automated decisions with legal or similarly significant effects. IC does not opt into general model training with content; Voyage is used with opt out.
Where IC is the controller, consent under Article 6(1)(a) covers optional CV use, selected notifications and cookies that are not strictly necessary (chat and analytics). Processing necessary to provide a service you have contracted for or requested is based on Article 6(1)(b). Chat content is processed to reply to you, under Article 6(1)(b) where the enquiry concerns a service you have requested and otherwise under Article 6(1)(f); the interest is being able to answer enquiries. Handling statutory privacy rights and necessary records may rely on Article 6(1)(c). Necessary security and abuse prevention are assessed under Article 6(1)(f); the interest is protecting accounts, data and the service, with limited access and retention. This is not a general basis for marketing or new CV use. For house profiles, the house determines and documents its basis. The current registration flow requires evidence of the consultant's consent to CV use. The house's information confirmation and agreement acceptance are not your consent.
The house must inform you adequately before registration or explicitly ask IC to send the information. Sender, time, text version, choice and affected profiles are recorded separately from consent. Selected IC messages enter a daily queue; missing addresses and delivery failures are followed up. No reply or click is required. A signed contact link lasts 30 days and opening it alone changes no data. You can always contact richard.gulbrandsen@ic.no.
Authorised IC staff receive necessary access. CVs and contact details are shared with the relevant client following your or the house's submission/instruction. Other houses cannot access the profile. Providers include Supabase (database, authentication and CV storage), Vercel (hosting), Cloudflare (files, backup and Turnstile), Resend (email), Anthropic (AI), Voyage (embeddings), GitHub (backup execution) and LiveChat (Text S.A., Poland) for chat. Google is used for optional Google sign-in and for analytics with Google Tag Manager and Google Analytics, and Sanity for site content and agreement texts. Primary storage in Europe does not exclude processing/access in the USA or Singapore by relevant providers. Transfers outside the EEA must be covered by applicable Standard Contractual Clauses or a covering adequacy decision and necessary supplementary measures. Contact IC for relevant recipient details and copies of safeguards. New countries for house data require documented instructions.
CV consent lasts 12 months. Submissions stop on expiry, and deletion/archiving is processed after a 90-day grace period. Profiles without a CV are archived after 30 days. You can withdraw consent and request earlier erasure; the grace period does not authorise processing without a valid basis. Account information is retained while the account is active and necessary. Chat conversations are deleted no later than 12 months after the last message unless they belong to an open case. Access logs have a 24-month retention period. CRM cases, ongoing assignments, documentation and legal duties are assessed individually; open cases and restrictions may pause automatic erasure of data necessary for the case. On request, IC explains what is retained and why.
Restricted-access daily backups are retained for up to 35 days, monthly copies for 400 days, and deleted/overwritten files in deletion mirrors for 90 days. Encrypted GitHub backup artifacts are retained for up to 7 days. Time runs from creation in the relevant backup class. Live mirrors must follow source deletions. Backups support recovery and continuity, not ordinary matching. Subsequent erasures and restrictions must be reapplied before restored data enters production. Different binding agreements and statutory requirements are assessed separately; new backup terms do not amend earlier agreements without acceptance.
You may request access, rectification, erasure, portability and restriction, and object to processing based on legitimate interests. You may withdraw consent without affecting lawfulness before withdrawal. Contact richard.gulbrandsen@ic.no; IC assists the house with responses about house processing. We record receipt dates, follow applicable deadlines and explain exceptions. The house receives minimised automatic case status, not your personal reasoning; necessary case content may be shared separately. We use access controls, encrypted transport, protected storage and logs. You may complain to Norway's Data Protection Authority, datatilsynet.no.
The website uses cookies and local browser storage in four categories. Necessary ones are used for sign-in, security (including Cloudflare Turnstile) and to remember your consent choice; the choice is also recorded in a separate consent log with time and selection. Everything else is used only if you consent, and you can change your choice at any time under "Manage cookies" at the bottom of the page. If you withdraw consent, the page reloads without the tool; cookies already set can be deleted in your browser.
The chat is provided by LiveChat and loads only once you allow functional cookies, either in the consent settings or with the chat button. LiveChat stores an identifier in your browser so the conversation can continue, and shows us your IP address, approximate location, browser and which pages on the website you visit while the chat is loaded. If you start a conversation, the messages and anything you provide, such as name and email, are stored. Do not share CVs, national identity numbers, health data or other special-category data in the chat; CVs are uploaded in the member area.
Google Tag Manager loads on every page, but with all consents set to "denied" until you choose. If you consent to analytics, Google Analytics measures how the website is used, for example which pages are visited and where visitors come from. Without consent, Google Analytics sets no cookies. Marketing cookies are not in use today; if we introduce them, it will only be with consent.
Material changes to purposes, agreements or information are communicated to affected users. Agreements and consent records are versioned. Last updated: 30 September 2026.
You can contact IC at any time about access, objection or restriction, including after an email link expires.
richard.gulbrandsen@ic.no