Gemensam inköpsinfrastruktur för Europas medelstora och stora företag.
Inköp hos medelstora och stora företag är omfattande, fragmenterat och svagt förhandlat, och inget enskilt företag kan lösa det ensamt. Aitenda samlar det i ett transparent system: aggregering, upphandling på artikelnivå, purchase to pay och en gemensam inköpsorganisation, med bas i Oslo, europeiskt perspektiv och global räckvidd.
Every enterprise buying as well as the world’s best.
Aitenda accelerates the transformation of procurement, from cost line to strategic advantage, through collaboration.
Ta kontakt.
Begär investerarpresentationen, eller berätta vad du vill veta. Vår CEO svarar personligen.
Aitenda använder cookies och liknande teknik. Nödvändiga cookies krävs för att webbplatsen ska fungera. Du väljer själv om vi får använda analyscookies för att förstå hur webbplatsen används. Marknadsföringscookies sätts endast med ditt samtycke. Du kan ändra eller återkalla ditt val när som helst via ”Integritetsinställningar” längst ner på sidan.
Aitenda Group AS (Foretaksregisteret no. 938 729 530) is the controller of the personal data described in this Privacy Policy.
Address: Seljeveien 1, N-0575 Oslo, Norway · E-mail: mail@aitenda.com (please mark your enquiry "Privacy").
The processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR), as incorporated into the EEA Agreement and implemented in Norwegian law by the Act of 15 June 2018 No. 38 relating to the processing of personal data (the Personal Data Act). As our establishment is in Norway, the Norwegian Data Protection Authority (Datatilsynet) acts as our lead supervisory authority for cross-border processing within the EEA.
This Privacy Policy applies to aitenda.com and aitenda.net. It also applies to our processing of personal data relating to contact persons at members, suppliers and business partners in Norway, Sweden, Denmark, Finland and other EEA countries.
Aitenda is a procurement organisation serving businesses. We primarily process personal data relating to individuals in their capacity as employees or representatives of an organisation. We do not request national identification numbers, and our services are not directed at children.
| Data subjects | Personal data | Purpose | Legal basis (GDPR) | Retention period |
|---|---|---|---|---|
| Contact persons at members and prospective members | Name, position, organisation, e-mail address, telephone number, correspondence | Entering into and administering membership agreements, conducting tenders, reporting and financial settlement | Art. 6(1)(f) (legitimate interest in managing the contractual relationship with the organisation) | Term of the agreement + 5 years |
| Contact persons at suppliers, bidders and prospective suppliers | As above, and information contained in bids | Maintaining our supplier register, conducting tenders, negotiating and administering framework agreements | Art. 6(1)(f) | 5 years after the most recent contact. Bid documents not resulting in an award: 3 years |
| Users of the procurement platform (aitenda.net) | Name, e-mail address, role, username, log-in records, activity log | Access management, security and traceability in ordering and approval workflows | Art. 6(1)(f) | Duration of the active user account + 12 months |
| Website visitors | IP address, device and browser data, cookies | Operation and security (strictly necessary). Statistics and improvement (optional) | Strictly necessary: Art. 6(1)(f). Optional: consent, Art. 6(1)(a) | As stated in the consent solution on the website |
| Persons contacting us | Name, contact details, content of the enquiry | Responding to and following up the enquiry | Art. 6(1)(f) | 12 months after the enquiry is closed |
| Recipients of newsletters and professional information | Name, e-mail address, organisation. Open and click data only with consent | Providing information about Aitenda, tenders and events | Distribution: Art. 6(1)(f), or consent under Art. 6(1)(a) for recipients in Denmark. Open and click tracking: consent, Art. 6(1)(a) | Until you opt out or withdraw your consent |
| Participants at events and supplier fairs | Name, organisation, contact details, attendance | Planning and conducting the event | Art. 6(1)(f) | 12 months after the event |
| Job applicants | CV, application, references, interview notes | Recruitment | Art. 6(1)(b) and (f) | 6 months after the recruitment process is concluded; longer only with consent |
| Invoice recipients and payment contacts | Name, contact details, transaction data | Accounting and payment | Art. 6(1)(c) (statutory bookkeeping obligations) | The periods required under the Norwegian Bookkeeping Act, currently up to five years after the end of the financial year |
Information about dietary requirements or allergies in connection with events is processed only with your explicit consent pursuant to Art. 9(2)(a) GDPR. It is deleted no later than 30 days after the event.
"Most recent contact" means the most recent communication between Aitenda and you or your organisation by e-mail, telephone, video conference, meeting or equivalent means. Newsletters and other one-way communications from Aitenda do not constitute contact. When we are informed that you have left the organisation, we delete or update your contact details.
Where we rely on legitimate interests, our interest is to operate and manage the procurement collaboration with the organisations we have agreements with. For suppliers, inclusion in our supplier register is also in the supplier’s own commercial interest. We have assessed that this interest is not overridden by your interests or fundamental rights and freedoms, because the data relate to you in your professional capacity and are limited to what is necessary.
Fonts, scripts and images on this website are served from our own domain. No request is sent to a third party unless you consent to analytics or marketing cookies. With your consent, we use Google Analytics 4 and Microsoft Clarity for statistics and improvement of the website. These services use cookies and online identifiers. The data are pseudonymised, not anonymised, and we do not use them to identify you.
We obtain personal data from you or from the organisation you represent, for example when your employer registers you as a user or contact person. We may also obtain data from public sources, such as the Brønnøysund Register Centre and equivalent Nordic registers, and from the organisation’s website.
Providing personal data to us is voluntary. Without contact details, however, we cannot enter into or administer agreements, conduct tenders, grant access to the procurement platform or respond to enquiries. Invoicing data are necessary for us to comply with our statutory bookkeeping obligations.
We never sell personal data. Personal data are disclosed to:
(a) Members and suppliers, to the extent necessary to conduct tenders and administer concluded agreements. Contact persons at a member may be visible to suppliers and to other members participating in the same tender or category collaboration.
(b) Processors providing services to us, including the procurement platform, cloud services and e-mail, website, customer relationship management, accounting and IT support tools, including tools based on artificial intelligence. Processors act solely on our documented instructions and are bound by data processing agreements pursuant to Art. 28 GDPR.
(c) Advisers and public authorities: auditors, where appointed; legal advisers; and public authorities where we are under a legal obligation to disclose.
An up-to-date list of our processors is available on request.
As a general rule, we store and process personal data within the EEA. Some providers may process personal data outside the EEA. Any such transfer takes place only where one of the following conditions is met:
(a) The European Commission has adopted an adequacy decision for the recipient country. For the United States, this includes transfers to organisations certified under the EU–US Data Privacy Framework.
(b) We have concluded the standard contractual clauses adopted by the European Commission, with supplementary measures where required.
Certain processing on the procurement platform is carried out on behalf of the member organisation, for example where the member’s own ordering and approval data are processed in the member’s internal workflows. In such cases, the member is the controller and Aitenda acts as processor under a separate data processing agreement. Enquiries concerning such data should be addressed to your employer, and we will assist them in responding.
We use analytics and artificial intelligence to conduct and follow up tenders and procurement data. We require providers of such services not to use personal data received from us to train their own models.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.
We protect personal data by means of technical and organisational measures appropriate to the risk, including:
(a) access control on a need-to-know basis
(b) two-factor authentication
(c) encryption in transit
(d) data processing agreements and supervision of providers
In the event of a personal data breach, we notify the supervisory authority unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where a breach is likely to result in a high risk, we also inform the data subjects concerned without undue delay.
You have the right to:
(a) access the personal data we hold about you
(b) have inaccurate personal data rectified
(c) obtain erasure
(d) obtain restriction of processing
(e) object to processing based on legitimate interests
(f) data portability where the processing is based on consent or contract
(g) withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal
You may object at any time to the processing of your personal data for direct marketing purposes, in which case we will cease such processing. You may also opt out via the link included in every e-mail.
Please send enquiries to mail@aitenda.com, marked "Privacy". We will respond without undue delay and in any event within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, in which case we will inform you within the first month. We may ask you to verify your identity before disclosing personal data.
We encourage you to contact us first. You nevertheless have the right to lodge a complaint with the supervisory authority in the country of your habitual residence, your place of work or the place of the alleged infringement:
(a) Norway: Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no
(b) Sweden: Swedish Authority for Privacy Protection (IMY), imy.se
(c) Denmark: Danish Data Protection Agency (Datatilsynet), datatilsynet.dk
(d) Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi
Aitenda has not designated a data protection officer, as the conditions set out in Art. 37 GDPR are not met. The CEO is responsible for data protection within the company.
We update this Privacy Policy in the event of changes to our services or to applicable law. The current version and its effective date are stated at the top. We notify members and suppliers directly of material changes.
The English version of this Privacy Policy is the governing version. Any translation is provided for convenience only. In the event of any discrepancy between the English version and a translation, the English version shall prevail.