Benford Revisjon AS (org. no. 838 070 442), Tordenskiolds gate 2, 0160 Oslo, Norway. Effective 21 September 2026.
This notice explains what personal data Benford Revisjon AS ("we") processes when you enquire about an audit, while we assess whether we can act, and during the engagement, including on our audit platform. Our public websites are run by Benford Technologies Limited, the group's technology company, under its own Website Privacy and Cookie Notice.
Benford Revisjon AS is the data controller. The platform at portal.benford.no is owned by Benford Technologies Limited (company no. 17325156, London), the group's technology company, and operated for us by Benford Teknologi AS (org. no. 937 951 612, Oslo), which employs the Norwegian platform team and holds the Maskinporten access used to retrieve data from Altinn, Skatteetaten and Brønnøysundregistrene on the client's authorisation. Benford Teknologi AS is our processor and Benford Technologies Limited its sub-processor, each under a written agreement; neither may use audit data for its own purposes. Benford Technologies Limited is the controller only of your platform account data (login, settings, usage statistics), as described in the Website Privacy and Cookie Notice.
We process data about people who enquire through the "Start your audit" form; directors, owners, beneficial owners and contacts of clients and prospective clients; client employees, customers and suppliers who appear in the accounting records; and platform users. It comes from you, from the client's records and systems, from public registers and screening providers, and from public systems where the client authorises retrieval.
| Purpose | Legal basis under the GDPR as implemented in Norway by the Personal Data Act |
|---|---|
| Answering your enquiry, checking independence and conflicts, and deciding whether we can act | Steps before a contract, Article 6(1)(b); legal obligation under the Auditors Act (revisorloven), Article 6(1)(c) |
| Client due diligence: identity, ownership, sanctions and politically exposed person screening, and the retention and reporting duties that follow | Legal obligation under the Anti-Money Laundering Act (hvitvaskingsloven), Article 6(1)(c); the specific authority for criminal offence data given to firms subject to that law |
| Performing the audit or other engagement and communicating with management and the board | Legal obligation under the Auditors Act (revisorloven), together with the auditing standards, Article 6(1)(c); the engagement contract, Article 6(1)(b) |
| Running the client relationship, quality reviews, regulatory inspections, complaints and claims | Contract, Article 6(1)(b); legitimate interests in running and defending our practice, Article 6(1)(f) |
| Securing and improving the platform, including usage statistics | Legitimate interests, Article 6(1)(f); optional analytics only with your consent, Article 6(1)(a) |
We make no automated decisions with legal or similarly significant effects.
Only where necessary: our processors (section 1) and the third parties in our Sub-Processors notice, which forms part of this notice; Finanstilsynet, and other authorities where the law requires, including anti-money laundering reports we may not tell you about; group, component or successor auditors where auditing standards require; external quality reviewers bound by confidentiality; our lawyers and insurers where needed for advice, cover or a claim; and a purchaser of the practice that is itself an authorised audit firm. We never sell personal data or share it for others' marketing. Audit data is stored on Amazon Web Services in Stockholm, Sweden.
| Data | Retention |
|---|---|
| Engagement files, including audit evidence | five years after the end of the financial year concerned (revisorloven) |
| Client due diligence records | five years after the end of the client relationship, or after the checks where no engagement follows (hvitvaskingsloven) |
| Enquiries that lead to no engagement | Twelve months after last contact |
Statutory retention overrides a request for erasure while it runs. Afterwards we delete or anonymise.
The platform uses large language models to extract data from documents, draft working papers and flag anomalies for the audit team. The models are accessed through Amazon Bedrock in EU regions only; the model service keeps no copy of prompts or outputs, shares nothing with the model developer and uses nothing for training. Every judgement and conclusion is the auditor's.
Data is encrypted in transit and at rest; access is role-based, logged and limited to the engagement team and those who need it for quality control; everyone working on an engagement is bound by confidentiality; every processor is bound by contract. We store personal data in the EEA and do not transfer audit data outside it in the ordinary course. Staff of Benford Technologies Limited may access data from the United Kingdom for platform support, under the EU adequacy decision for the UK and limited to the task. Any other transfer outside the EEA relies on an adequacy decision or standard contractual clauses.
You may ask for access to your data and a copy, correction, erasure, restriction, portability of data you gave us, and you may object to processing based on legitimate interests or withdraw a consent. We answer within one month. Two limits apply: our statutory duty of confidentiality under revisorloven may prevent disclosure about a client relationship without the client's consent, and statutory retention overrides erasure while it runs. We tell you when a limit applies, as far as the law allows.