Privacy notice

Data controller and privacy contact

Synheim AS, organisation number 938 423 091, is responsible for this website. Its registered address is Opsalvegen 148, 2008 Fjerdingby, Norway. Privacy questions and rights requests can be sent to info@synheim.com.

Information we may handle

The contact form is designed for business enquiries. It may handle the name, work contact details, organisation, optional role, topic and message submitted by the visitor, together with limited technical information needed to protect and deliver the form.

The website is designed without advertising, fingerprinting, session replay or optional analytics in its baseline configuration. Hosting and security infrastructure may process limited request information needed to deliver the site, maintain security, diagnose errors and prevent abuse.

We normally receive contact information directly from the person who submits the form or sends an email to Synheim. We do not ask for special-category personal data through the public website, and the public contact channel is not intended for CVs, candidate records, confidential material, source code, credentials, proprietary seismic data or product datasets.

Why information may be used

Information may be used to respond to an enquiry, take steps requested before a contract, manage a business relationship, protect the website and contact channel, maintain necessary records, or meet legal obligations.

Depending on the context, this processing may be necessary to respond to a request, support a potential business relationship, comply with an applicable legal obligation, or pursue Synheim's legitimate interests in operating a secure website, preventing abuse and keeping appropriate business records. Synheim does not use contact-form information to sell advertising audiences or to build marketing profiles.

Contact form safeguards

The form accepts only a small set of fields and sends an enquiry only to an allow-listed Synheim mailbox. Server-side validation, request-size limits, duplicate controls and short-lived abuse controls are used to help protect the service. Abuse-control records are designed to use pseudonymous, HMAC-derived values rather than the original form fields, together with a counter and expiry time. They are not intended to identify a visitor directly.

No form submission is treated as sent unless the configured delivery provider confirms acceptance. The website does not create a public account, customer profile or recruitment record from a contact enquiry. Please use the form only for a high-level first conversation.

Providers, transfers and retention

Synheim uses AWS hosting infrastructure and Amazon SES in AWS Europe (Stockholm) for server-side delivery of website contact enquiries when that delivery is enabled. Microsoft 365 (Exchange Online) receives enquiries at info@synheim.com. Optional analytics and other non-essential technologies remain disabled unless their data flow, notices and consent requirements have been reviewed.

AWS and Microsoft may process information as service providers for the functions described above. Their service arrangements, locations and any relevant transfer safeguards are reviewed before a production processing arrangement is relied on. Synheim does not enable a new provider merely by mentioning it in this notice.

Synheim aims to delete or anonymise an enquiry that does not develop into an active business matter within 90 days of the last substantive communication. Short-lived abuse-control records expire on their operational schedule. Production technical and security records are intended to be retained for no more than 30 days, unless an investigated security incident, a legal obligation or an active business matter requires a documented longer retention period. Information needed for an agreed engagement is handled under the applicable contract and related records.

Who may receive information

Access is limited to people who need the information to respond to an enquiry, operate the website or meet a legal obligation. Synheim does not disclose contact-form information to unrelated third parties for their own marketing. Information may be disclosed where required by law or reasonably necessary to protect Synheim, visitors or the security of the website.

Your rights

Depending on the circumstances and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. Contact Synheim to raise a privacy question or rights request. You may also complain to the appropriate supervisory authority; in Norway, this is the Norwegian Data Protection Authority (Datatilsynet).

To help Synheim handle a request safely, describe the relationship to Synheim and the information or activity concerned. Synheim may need to verify identity before disclosing or changing personal information. This helps prevent information from being given to the wrong person.

Automated decisions

The corporate website is not designed to use contact-form information for decisions that produce legal or similarly significant effects. It does not accept candidate CVs, proprietary seismic data or product datasets through the public form.

Updates and contact

This notice will be updated when the website, providers or processing activities change. Send privacy questions and rights requests to info@synheim.com. This notice describes the public website and contact channel; an agreed client engagement may have separate contractual and data-processing terms.