Privacy notice

Controller and contact

Infruvo is operated by NOVARDA AS, organisation number 938 346 208, registered at Benbergvegen 16, Heimdal, Norway. NOVARDA AS is the controller for the personal data described in this notice unless a separate notice says otherwise. Privacy requests can be sent to kontakt@infruvo.com.

Infruvo is normally operated remotely from Norway. A country may still require a local privacy representative, registration or other contact even when NOVARDA AS has no local office. Where such a requirement applies, the required representative/registration must be completed and the contact details published before that market is publicly enabled.

Brazil — LGPD

NOVARDA AS acts as controller for Infruvo account, marketplace and public content-reporting data. Privacy requests can be sent to kontakt@infruvo.com. We process data to provide the service, prevent abuse, review reports and communicate decisions.

Brazilian users may exercise applicable access, correction, deletion, portability, information and objection rights and may contact the ANPD. Processing is performed from Norway and through the subprocessors listed in this notice. Where sharing between processing agents qualifies as an international transfer, an applicable LGPD/ANPD transfer mechanism must be used. Direct collection by a foreign controller is not described here as an international transfer merely because the data subject is in Brazil.

We apply access controls, encryption in transit, least-privilege service credentials, rate limiting and audit logging. No Brazilian representative details are published until NOVARDA AS has supplied verified company name, CNPJ, Brazilian address and contact.

Marketplace visibility and access

Infruvo is a digital marketplace. Employers publish opportunities themselves; workers create profiles and apply themselves; and employers decide whom to contact and hire. Infruvo does not manually match or select candidates. Worker profiles and supporting competence data are visible only according to the account, market and privacy controls implemented in the service, and employer access is limited to the platform purposes described here.

Employment contracts are directly between employer and worker. Infruvo is not the employer, staffing provider or labour supplier, does not pay wages, and does not provide immigration or visa services.

Personal data we process

• Account data: name, email, account role, preferred language and authentication identifiers.
• Market and location data: country/home market and locations you choose to add to your profile or organisation.
• Contact data: phone number and other contact details you choose to provide.
• Worker profile data: trades, experience, availability, languages, certificates, competence records, CV information and uploaded documents.
• Company/training-provider data: organisation information, memberships, invitations, jobs, courses and related administration.
• Platform activity: applications, saved items, conversations, messages, notifications, reports, appeals and support interactions.
• Billing/tax data where paid services are enabled: plan, market, billing interval, subscription state, payment references, tax profile and refund/withdrawal records. Payment-card data is handled by Stripe rather than stored by Infruvo.
• Security/audit data: sign-in, abuse-prevention, moderation and administrative records needed to protect the platform and demonstrate important actions.
• Consent/preferences: acceptance of terms/privacy notice, language, optional marketing choice and privacy settings.

Do not upload medical records, national identity documents or other sensitive information unless a specific Infruvo feature explicitly asks for it and explains why it is required. Infruvo is not a patient-record or general identity-document storage service.

Purposes and legal bases

We process data to create and secure accounts; provide profiles, jobs, applications, candidate search, courses, messaging and organisation tools; perform subscriptions and support; prevent fraud/abuse; meet legal obligations; and establish or defend legal claims. Depending on the activity and applicable law, the basis may be performance of a contract, legitimate interests, consent or a legal obligation. Where consent is used, it can be withdrawn for future processing.

Recruitment-related processing is not permission to ignore employment, discrimination or work-seeker-fee rules. Where a country requires separate authorisation for employment placement, the relevant feature remains disabled until that requirement is completed.

Sales Agent / Referral Agent activity

Sales Agents / Referral Agents may submit or receive referral attribution when they market and explain Infruvo or help a person or business find registration. This role does not select candidates, match workers to jobs, submit applications for workers, negotiate employment or represent an employer. Referral and commission records are used for attribution, accounting, fraud prevention and audit purposes.

Who receives data

Core infrastructure providers currently include:

• Supabase — database, authentication and storage.
• Vercel — application hosting and delivery.
• Stripe — subscription/payment processing where paid services are enabled.
• Resend — transactional email delivery.

Worker information is shared with employers only according to the product's access and privacy rules. Messages are shared with their conversation participants. Information may also be disclosed when legally required, to protect users or the service, or in a lawful business reorganisation. NOVARDA AS does not sell personal data to advertisers.

Canada-specific privacy and cross-border processing

For the initial Canada scope, Infruvo is offered outside Quebec while French-language and Quebec Law 25 requirements are assessed. NOVARDA AS processes data from Norway and may use the infrastructure providers listed above. This cross-border processing, the purposes, safeguards and available rights are explained here before Canada access is enabled.

Marketing consent is recorded separately from service terms where required. Each record includes the consent choice, purpose, time, version and source. Commercial messages identify NOVARDA AS and include a functioning unsubscribe route. Job reports and moderation decisions are retained with the applicable policy version for three years.

International transfers and hosting

NOVARDA AS is established in Norway, which is in the EEA. Data may be processed by service providers in other countries. Transfers from the EEA to a country outside the EEA use an applicable adequacy decision or another lawful transfer mechanism where GDPR requires one. The same principle is applied to country-specific transfer rules such as Brazil's LGPD, Colombia's data-protection regime, the Philippine Data Privacy Act and Uganda's Data Protection and Privacy Act where those laws apply.

Retention and account deletion

Active account/profile data is kept while the account is used and as needed to provide the service. Users can request/download their account data and can initiate account deletion from the Account & privacy area. Private storage objects are removed as part of the deletion flow.

Deletion does not require NOVARDA AS to erase records that must legally be retained, such as accounting/tax evidence, payment/refund records, security evidence, fraud/abuse records or information needed for an active dispute or legal claim. When retention is required, data is limited to what is necessary and deleted or anonymised when the retention basis expires. Market-specific statutory retention for real-money billing must be fixed before Stripe Live is enabled.

Your rights

Depending on the law that applies, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint to a data protection authority. Rights can be exercised through available account tools or by contacting kontakt@infruvo.com. We may need to verify identity before fulfilling a request.

Privacy authorities by supported market

• Norway — GDPR/Personal Data Act; Datatilsynet.
• Sweden — GDPR; Integritetsskyddsmyndigheten (IMY).
• Denmark — GDPR; Datatilsynet.
• Poland — GDPR; Urząd Ochrony Danych Osobowych (UODO).
• Lithuania — GDPR; Valstybinė duomenų apsaugos inspekcija (VDAI).
• United Kingdom — UK GDPR/Data Protection Act; Information Commissioner's Office (ICO). A UK representative will be published if required before UK public launch.
• Brazil — LGPD; Autoridade Nacional de Proteção de Dados (ANPD). Brazil remains subject to its additional internet-platform/local-presence requirements before launch.
• Colombia — Ley 1581 de 2012 and related rules; Superintendencia de Industria y Comercio (SIC).
• Philippines — Data Privacy Act of 2012; National Privacy Commission (NPC). Applicability of DPO/data-processing-system registration or an exemption filing is assessed against NPC Circular 2022-04 and the actual operating and processing facts.
• Uganda — Data Protection and Privacy Act, 2019; Personal Data Protection Office (PDPO). Applicable controller/processor/collector registration must be completed before launch.
• United States — privacy rights depend on federal sector rules and applicable state law; relevant state attorney general/regulator and the FTC may have jurisdiction depending on the issue.
• Canada — applicable federal or provincial privacy authority, including the Office of the Privacy Commissioner of Canada where PIPEDA applies; Quebec remains outside the initial scope.
• Nigeria — Nigeria Data Protection Commission (NDPC); any applicable controller, DPO, registration and cross-border requirements must be completed before market activation.

Cookies and local storage

Infruvo currently uses storage needed for authentication, security, language preferences and installable-app functionality. See the cookie information. Non-essential analytics or advertising technologies must not be enabled in a market that requires prior consent until a compliant consent mechanism exists.

Updates

This notice will be updated when processing, providers or legal requirements materially change. A country-specific notice or representative detail will be added before a market is enabled where local law requires it.