Home
Solutions
Suppliers
About us
Contact

Privacy Policy for Lalyc Technologies AS

Last updated: 28.8.2025


1. About the Data Controller and Data Processors

This statement applies to Lalyc Technologies AS (org.no. 934412354), which is the data controller for personal data processed in the company, including via lalyc.no and related services. For accounting, payroll, and financial administration, the external accountant and data processor used is Revisjonsfirmaet Flattum & Co AS (org.no. 894934352), while Evelon AS (org.no. 825 558 772) provides IT services, cloud storage and related operational services as a data processor. Both process personal data in accordance with agreements and applicable privacy legislation (GDPR and the Personal Data Act).

Accounting systems Tripletex and Capego are used via Flattum. Employees and board members use paid Google and Microsoft cloud services (such as Google Workspace and Microsoft 365). The terms and conditions of these providers for their paid services apply.


2. What Personal Data is Collected – Purpose and Legal Basis

The following categories of personal data are collected and processed, with associated purposes and legal bases:

1. Name, contact details (address, phone, email), position and employment

    • Purpose: Accounting, communication, payroll administration, contact, and assignment processing
    • Legal basis: Fulfillment of agreement (GDPR art. 6(1)(b)); Legal obligation (accounting and labor law purposes, GDPR art. 6(1)(c)); Legitimate interest for administration/communication (GDPR art. 6(1)(f))

2. Owner information and personal ID number

    • Purpose: Regulatory reporting
    • Legal basis: Legal obligation (GDPR art. 6(1)(c), cf. Bookkeeping Act, Companies Act, etc.)


3. Salary details, bank account number, absences, deductions, tax base, etc.

    • Purpose: Accounting and payroll reporting
    • Legal basis: Legal obligation (GDPR art. 6(1)(c))


4. Health and insurance information

    • Purpose: Handling sick leave, occupational injury or insurance cases
    • Legal basis: Legal obligation (GDPR art. 6(1)(c)); Necessary to protect rights in labor law (GDPR art. 9(2)(b/h))


5. Communication data (email, contact form, technical logs, IP and MAC addresses)

    • Purpose: Responding to and documenting inquiries, technical operation, and security
    • Legal basis: Fulfillment of agreement for customer inquiries (GDPR art. 6(1)(b)); Legitimate interest (GDPR art. 6(1)(f))


6. Board and employee information (name, role, contact info, photo if applicable)

    • Purpose: Display on the website, presentation
    • Legal basis: Consent (GDPR art. 6(1)(a)); Legitimate interest (GDPR art. 6(1)(f)) if consent is not practical


7. Technical and operational data

    • Purpose: Operation, security, support, quality improvement
    • Legal basis: Legitimate interest (GDPR art. 6(1)(f))


8. User data in support of Microsoft and Google’s services

    • Purpose: Access to email, document processing, storage and office support solutions
    • Legal basis: Fulfillment of agreement (GDPR art. 6(1)(b)); Legitimate interest (GDPR art. 6(1)(f))


The purposes are:

  • Operating the business and fulfilling legal obligations (accounting, reporting, and payroll)
  • Ensuring operation, security, and improvement of services and the website
  • Managing and following up on customers, employees, the board, and suppliers
  • Complying with government requirements, including reporting and archiving as per the Bookkeeping Act
  • Submitting and responding to inquiries from the website or via email


3. Who Gets Access to the Data?

Personal data is processed only by authorized employees at Lalyc Technologies AS. Flattum & Co AS accesses accounting/payroll related data as the processor within accounting/payroll. Evelon AS processes data as a technical operations partner and provider of IT systems (including storage, CRM, operational support, security).

Google and Microsoft have access as providers of cloud services, and Tripletex (accounting) and Capego (annual financial statements) get access only when needed and as per data processor agreement.

Disclosure to others only happens when necessary to fulfill an agreement, comply with the law, at the order of public authorities, or to the auditor. All actors are subject to a data processor agreement and comply with GDPR and internal routines.


4. Where are the Data Stored and Processed?

Data is processed and stored mainly in Norway and the EU/EEA. Flattum uses Tripletex and Capego, which have all primary processing within the EU/EEA. Evelon AS stores data in its own data centers and offices in Norway.

Data may also be processed in data centers belonging to approved subcontractors (including Microsoft and Google’s European data centers), in accordance with the data processor agreement.

Transfer to countries outside the EU/EEA only takes place with specific consent and necessary guarantees under GDPR, for example when Google or Microsoft offers solutions that involve such transfer.


5. How Long is Data Stored?

Personal data is kept as long as necessary for the purpose, or to fulfill legal obligations, normally according to the Bookkeeping Act (5–10 years for accounting data). Data from website/contact forms is usually deleted within 12 months, unless there is a legal basis or need for longer retention. Data is deleted no later than six months after the end of the customer relationship if there is no longer a legal basis for retention.


6. Your Rights

You have the right to access, rectify, and delete your personal data, and you may request restriction, data portability, or object to processing. Contact us at ingvill.lyche@outlook.com to exercise your rights. Requests are handled as quickly as possible and normally within 30 days. We and our data processors will assist with such requests according to GDPR Chapter III and the agreements in effect.


7. Security and Audit

Organizational and technical measures have been implemented to safeguard your information from loss, misuse, and unauthorized access, including access control, backup, logging, and regular risk assessments. This covers our own staff as well as Flattum, Evelon, and subcontractors (including Microsoft and Google). Documentation of security measures can be provided upon request.


8. Use of Cookies

The website only uses necessary cookies to ensure basic functionality, such as session management or analytics. No cookies are used for marketing or third-party advertising without specific consent. Certain analytics tools (like Google Analytics) may be used if you specifically accept this.

You can control or delete cookies in your browser.


9. Contact Information

Data Controller: Lalyc Technologies AS
Org.no. 934412354
Email: post@langelyche.no


10. Complaints

If you believe your personal data is being processed contrary to this statement or applicable law, you have the right to complain to the Data Protection Authority.


11. Changes to the Policy

Changes are published here and apply from the date of publication.