Privacy and Cookie Policy

Privacy Policy

Breeze is an identity and access management platform for ID cards, access cards and digital IDs. It is developed and operated by Sotera AS (org. no. 979 692 811). We take good care of the personal data we have access to and process it in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. This page explains how.

Our two roles

Sotera as data processor: When we produce cards and deliver Breeze, we process personal data on behalf of our customers. The customer is the data controller and decides what the data is used for. We only process the data according to the customer’s instructions, as set out in the data processing agreement.

Sotera as data controller: Sotera is the data controller for data about contact persons at customers, suppliers and partners, and about visitors to our website.

Data processing agreement

We always enter into a data processing agreement (DPA) with customers whose personal data we process on their behalf. Breeze customers receive our standard service agreement with a DPA. If a customer has their own DPA, it can be used instead, and any adjustments are agreed in a separate addendum.

If we have remote access to a customer’s own systems for operations and support, this is also covered by a data processing agreement.

Breeze through partners

Breeze is also delivered through partners, such as security and facility service companies, who offer Breeze to their own customers, sometimes under their own name and branding. In these cases the customer, usually your employer or organisation, is the data controller. The partner is the data processor, and Sotera is a sub-processor for the partner. The partner’s agreement with the customer applies, together with the data processing agreement between the partner and Sotera.

If you have received an ID card or digital ID through a partner, please contact your employer or the partner with questions about how your data is processed. They are responsible for responding to requests to exercise your rights, and we assist them when needed.

Sotera processes data about partners’ contact persons and about users who administer Breeze, as data controller, to manage the partner relationship and provide support.

What data we process

We only process the data needed to produce and manage ID cards and digital IDs. This typically includes name, photo, employee or membership number, organisation and department, card number and access information. We do not process health data or other special categories of personal data.

Where data is processed

Personal data is stored in the EU/EEA. Where certain services are provided by sub-processors outside the EU/EEA, we secure the transfer with a valid transfer mechanism, such as the EU Standard Contractual Clauses (SCC) or the EU–US Data Privacy Framework.

Sub-processors and data processors

In our deliveries to customers, we use a small number of sub-processors for hosting and operations, and for certain functions in Breeze. All of them are bound by agreements that provide at least the same level of protection as our own data processing agreement, and customers are notified before we engage new sub-processors.

For Sotera’s own administrative operations, such as accounting, invoicing, customer follow-up and email, we use data processors that process personal data on our behalf. We have data processing agreements with all of these suppliers.

Deletion and destruction

Personal data is deleted when it is no longer needed for its purpose, or as agreed with the customer. Misprinted and returned cards are securely destroyed.

Information security

We have an information security management system based on ISO 27001 and are working towards certification. Only employees who need access to personal data for their work have it. In the event of a personal data breach, we notify the customer without undue delay.

Data Sotera is responsible for

We process contact details of customers, suppliers and partners to fulfil agreements, follow up customer relationships and meet our accounting obligations. The legal basis is contract, legal obligation and legitimate interest. Accounting records are kept for as long as the Norwegian Bookkeeping Act requires.

Your rights

You have the right to access, rectification, erasure and restriction of processing, and you can object to the processing. If the data is processed on behalf of your employer or another customer, please contact them first. We are happy to help them respond. If you believe we process personal data in breach of the regulations, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Cookies

Our website uses cookies in accordance with section 3-15 of the Norwegian Electronic Communications Act. Essential cookies make the site work and do not require consent. We only use analytics cookies if you have given your consent in the cookie banner. You can change or withdraw your consent at any time via Cookie settings, and you can delete cookies in your browser.

Contact

Sotera AS, Strandveien 37, 1366 Lysaker, Norway
Phone: +47 67 11 90 00
Email: personvern@sotera.no

Last updated: 21 October 2026