1.Introduction

This privacy statement explains which personal data Mandora AS collects and why, and how we handle, protect, store, export and delete it. Personal data is any information relating to an identified or identifiable natural person, such as an email address, street address or telephone number.

2.Contact us

For questions or privacy enquiries, contact us at privacy@mandora.no.

Address: Mandora AS, Karenslyst allé 56, 0277 Oslo, Norway

3.Processing activities

3.1Newsletters and marketing

Mandora AS uses email to distribute marketing communications. The personal data processed is your name and email address. Legal basis: consent, see GDPR Article 6(1)(a), in line with Section 15 of the Norwegian Marketing Control Act, which requires consent for electronic marketing. You can withdraw your consent and unsubscribe at any time via the unsubscribe link in the communication or by contacting hei@takiregnskap.no.

3.2Recruitment

We process personal data in connection with recruitment to handle applications, assess documentation, conduct interviews and contact references. This includes contact information (name, address, telephone, email), CV, application and other submitted documentation, as well as any personality and aptitude tests. Legal basis: legitimate interest, see GDPR Article 6(1)(f), in finding the right candidate; for candidates we proceed with, Article 6(1)(b) (steps taken prior to entering into a contract). The data is deleted when the recruitment process ends, normally no later than six months after the application deadline unless otherwise agreed.

3.3Security

We process personal data to detect, limit and prevent security threats and misuse, and to carry out maintenance and error correction. This includes name, email address and user and traffic data such as login ID, username, IP address and device information. Legal basis: legitimate interest, see GDPR Article 6(1)(f), in maintaining a secure environment. Security logs are retained for up to 12 months.

3.4Delivery of products and services to customers

We process personal data to handle orders, agreements and payments. This includes basic information (name, address, telephone, email) and invoice-related information. Legal basis: legitimate interest, see GDPR Article 6(1)(f), in facilitating delivery to the customer’s contact person. The data is not stored longer than necessary, in most cases no longer than three years after the last recorded activity.

3.5Service improvement

We improve the quality, functionality and user experience of our products, services and websites. This includes name, email address and user and traffic information such as login ID, username and IP address, as well as usage statistics. Legal basis: legitimate interest, see GDPR Article 6(1)(f). After three years, the data is deleted or anonymised for statistical use.

3.6Handling enquiries and support

When you contact us through a contact form, a chatbot or similar, we process the personal data you provide (at a minimum, contact details) in order to offer communication and support. Legal basis: legitimate interest, see GDPR Article 6(1)(f). Enquiries and related correspondence are not stored longer than necessary, and no longer than three years after the last correspondence.

3.7Traffic measurement and analytics

We measure aggregate traffic on the website to count visits, see which pages are popular, measure page load times and record the use of buttons and forms. This is done using a cookie-free analytics tool (Vercel) that does not set cookies, does not use localStorage and does not build personal profiles. IP addresses are hashed and deleted shortly after each request. Legal basis: legitimate interest, see GDPR Article 6(1)(f), in measuring and improving the website. Vercel acts as our processor. Transfers to the United States take place primarily on the basis of the EU-US Data Privacy Framework (DPF), under which Vercel is certified, with the EU Standard Contractual Clauses (SCCs) as an additional safeguard.

3.8Requesting access

Taki is currently available by invitation only. When you request access via the form on the website, we process the contact details you provide (such as name, email and business) to follow up on the enquiry and administer the access list. The information is registered in our CRM system Pipedrive, provided by Pipedrive OÜ (Estonia), which acts as our processor. Pipedrive stores the information in the EU/EEA. Certain information may be transferred to Pipedrive’s group companies and sub-processors in the USA; such transfers are safeguarded by the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF). Legal basis: steps taken at your request prior to entering into a contract, see GDPR Article 6(1)(b), and legitimate interest in administering potential customer relationships, see Article 6(1)(f). The information is stored for up to 12 months after the last contact, or until you ask us to delete it.

4.How your personal data may be shared

4.1Within the Visma group

Mandora AS is part of the Visma group. We may share your personal data across companies in the Visma group, but only where there is a valid legal basis under applicable data protection law, and limited to what is necessary for the stated purpose.

4.2Outside the Visma group

Mandora AS may also share your personal data with external third parties in the following contexts:

Processors. Mandora AS uses processors, typically providers of cloud-based or other IT services. We enter into a data processing agreement with each of them. Where processors are located outside the EU/EEA, we ensure a valid transfer mechanism (the EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework). An up-to-date list of the sub-processors, including processing location and transfer mechanism, is set out in Appendix B to the Data Processing Agreement in the Terms of Service, available at takiregnskap.no/vilkar.
Business partners. Mandora AS has partner agreements with Contér Services AS and Lumi Accounting, which provide accounting services to Taki customers. To facilitate and maintain these services, we may share personal data with the relevant accounting partner. The accounting partners may also, on behalf of Mandora, access the personal data necessary to respond to accounting-related enquiries (for example via the case management system); such access is limited to that purpose. Beyond this, we only share personal data with business partners where justified from a business perspective and in accordance with applicable data protection law.
Public authorities. The police and other authorities may request access to data from us. In all such cases, we follow internal guidelines and procedures for assessing the request. We only disclose what is strictly required by law, and only on the basis of valid legal orders, such as a court order. To prevent unauthorised access to the data we process, we implement technical measures such as encryption and access control, and Visma’s security programme ensures high standards of security and confidentiality. We also require, in our agreements with our sub-contractors, that they implement equivalent organisational and security measures. If we receive access requests from authorities outside the EEA, we ensure compliance with Article 32 of the EU Data Regulation (Data Act), and our internal procedures are aligned with this.

5.Cookies

takiregnskap.no uses necessary cookies and, with your consent, Google Ads cookies to measure the effectiveness of our marketing. Information about your visits, including page URLs, IP addresses and cookie identifiers, is shared with Google for this purpose. Ad personalisation is disabled. You can withdraw consent using Cookie settings in the footer. Vercel traffic measurement remains cookie-free (see section 3.7).

See the cookie statement at takiregnskap.no/cookies for a complete overview, including which cookies are used.

6.Your rights

You have the following rights in connection with our processing of your personal data:

Access: you can request a copy of the personal data we process about you.
Rectification: you can ask us to correct inaccurate or incomplete data. If you have an account, this can often be done via your account settings.
Erasure: you can request that personal data about you be deleted.
Restriction: you can ask us to restrict the processing of your data.
Data portability: you can request to receive your data in a structured, commonly used and machine-readable format, or to have it transferred to another party.
Objection: you can object to processing based on legitimate interest, and to direct marketing.

Certain exceptions or limitations may apply. Send requests to privacy@mandora.no. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

7.Changes

We encourage you to review this privacy statement regularly. If we make material changes that significantly alter our privacy practices, we will notify you.

Last updated: 4 October 2026.