Privacy Policy for Empower AS

Last updated: April, 2025

• About Empower AS

Empower is a company that aims to address the global plastic waste problem with blockchain as an alternative solution to the traditional recycling system (hereafter called “EMPOWER”). Empower promotes putting a value on plastic, hence creating incentives for people to actively recycle plastic waste.

The Empower Platform is a digital platform for all the plastic supply chain stakeholders which shows the data of plastic waste throughout the plastic value chain. Built to optimize transparency and traceability of the waste management sector, the Empower Platform enables any player or brand to set up a tailor-made supply chain with sustainable plastic suppliers and to show a verified journey their products.

This Privacy Policy is applicable to users of the Empower website, Empower app and Empower services in general, hereunder our suppliers and customers in general or if you otherwise are in contact with EMPOWER.

• Privacy Policy from Empower 

Empower is a Norwegian company with business registration number 920 572 553. EMPOWER adheres to relevant Norwegian privacy law, and GDPR, ensuring that our data processing meet the highest standards. 

EMPOWER offers the Empower Platform to our customers with additional services in accordance with GDPR requirements and as outlined in the EULA (End User License Agreement) from EMPOWER. 

We explain in this Privacy Policy what personal data EMPOWER collects and how, the purpose of collecting your personal data, disclosure of data to third parties, EMPOWER’s security measures when we process your personal data and your rights as the data subject in accordance with the GDPR.

• The Account and Empower Platform

Empower Platform are accessible for Customers and End Users via their Account available on the Empower Platform. EMPOWER may process personal data related to physical persons that may be identified by using the Account. 

EMPOWER may process personal data related to the End Users that a Customer chooses to connect to Empower Platform. 

As the controller, Empower collects and processes personal data as outlined here. Please read this privacy policy to understand your rights.  

• Contact Information 

For inquiries concerning your personal data or this Privacy Policy, or wish to exercise your rights as a data subject, please email us at privacy@empower.eco or contact us at: 

Empower AS

Martin Linges vei 25

1364 FORNEBU

3201 BÆRUM, Norge

• What personal data EMPOWER collects and how

• Empower Platform services 

We will use information about you for any of the following purposes:

- To manage the agreement between EMPOWER and you.

- To communicate with you, by answering service requests or providing any necessary and agreed upon assistance for the Empower Platform and services.

- To comply with any legal obligations, EMPOWER is subject to, such as bookkeeping and accounting legislation.  

• Register your corporate entity as a Empower Platform user
• Send you information or important updates related to your activities on the Empower Platform
• Give you suggestions on potential Empower Platform partners/suppliers that you can connect with based on your profile
• Send you related news or updates from Empower if you have subscribed to our newsletter.

We have a valid data processor agreement with our Customer, and we process mainly personal data only as a processor on behalf of the Customer. 

• Description of personal data 

EMPOWER collects different types of personal data; 

1. Personal data (Platform users)

We collect basic user information including name, surname, email address, and telephone number (if provided). This data is used solely for account setup, role assignment, and communication.

2. Organization & Facility data

We store organizational details (name, registered address) and associated facilities. Facility records may include the name, location, and linked End Users, each with a defined access level (member, facility manager, or org admin).

3. Supplier & Verification data

When End User onboard suppliers, we may collect verification documents such as company registrations, licenses, or tax IDs. This data is used exclusively for internal verification and is not made public, unless published by the user using a Digital Product Passport builder.

4. Transaction documentation

Users have the option to upload any supporting documents they deem to be related to their material transactions. These may include, but are not limited to: Receipts, contracts, purchase orders, invoices.

5. Plastic Credit documentation

Organizations participating in the Plastic Credit module are required to go through a Due Diligence process prior to being approved. As part of this, we may collect:

• Information about the organization's structure and operations
• Relevant policies and supporting documents (e.g. environmental policies, labor practices, licenses)
• Contact details of key personnel for verification purposes

For credit issuance, we collect:

• Photographic evidence (e.g. collection including waste pickers, cleanup, and scale photos) that is used for verification purposes and may be published on the marketplace.

• Organizations are responsible for ensuring that any individuals depicted in photographic or video evidence (e.g., waste pickers) have provided consent where required under applicable data protection laws, especially when such media is made public.
• Plastic Credit documentation, including photos and registration sheets, is retained for the period necessary to validate and audit issued credits. Media not made public is stored internally for verification purposes for up to 5 years, unless longer retention is required for audit or regulatory purposes
• Registration sheets containing names, surnames and payout amounts for informal waste collectors - these are used for verification and are not made public.
• Material flow documentation (e.g. contracts, delivery notes, invoices) that confirms where the collected material is sent - used internally for verification purposes only.

• It is the organization’s responsibility to flag any sensitive images or documentation as “for verification only” at the time of submission to prevent unintended publication

EMPOWER does not process special categories personal data or gather information about your age and does not purposely process information about children under 15 years of age.  

• Legal Basis for Processing 

EMPOWER must fulfil our agreement with you as the End User as described in our EULA. EMPOWER requires that you as the End User have read this Privacy Policy and accepted the End User License Agreement from EMPOWER (these two documents are the agreement between you as the End User and EMPOWER as the Supplier). The first time you log into the Empower Platform, you will be presented with a link to this Privacy Policy as well as End User License Agreement in order to make sure each End User has been informed about how and why EMPOWER processes personal data. 

EMPOWER’s legal basis for processing personal data is through the agreements between EMPOWER and the Customer. We have a Data Processing Agreement with the Customer called the DPA from Empower. EMPOWER processes personal data in order to make it possible to enter into and to fulfil the agreement we have with the Customer. It is the Customer that chooses which End Users are connected to the Platform, through authorization and access via the Account. 

Furthermore, EMPOWER may process your personal data when EMPOWER are legally obliged to do so, or if it is necessary to establish, exercise or defend a legal claim.

EMPOWER may process your personal data based upon your consent, for example if you want to receive our newsletter by e-mail or accept cookies for a specific purpose.

To prevent fraudulent activity in or in relation to the Empower Platform, EMPOWER’s legal basis for processing is our legitimate interest. Our security interest in keeping the Empower Platform and the website secure and maintaining the integrity and confidentiality of the underlying software, as well as the data related to the Empower Platform, whether personal data or data other data that is considered commercially sensitive, are deemed more important in our balance test than the interest of the data subjects that such Processing activities are not carried out.

• Disclosure of Data to Third Parties

Empower does not have any external data processors and Empower’s servers are located in Norway. 

EMPOWER may disclose user base demographics and similar non-personal data to third parties. Such aggregated data does not identify any individuals and will not constitute personal data. 

We may use suppliers or process personal data outside the EEA. In such cases, transfer and processing outside the EEA (third countries) will take place in countries approved by the European Commission or in accordance with a valid legal basis for the transfer of personal data under Chapter V of the GDPR. If a transfer to a country approved by the European Commission does not take place, the transfer will only take place in accordance with the guarantees set out in Article 46 (2) of the GDPR. You can find out which basis is used for the transfer if you contact us.

• Storage and Deletion  

We retain personal data for as long as is necessary for the purpose for which the personal data was collected and delete the data in line with regulatory requirements. 

This means, for example, that personal data that we process on the basis of your consent is deleted if you withdraw your consent. Personal data we process in order to fulfill an agreement with you will be deleted when the agreement has been fulfilled and all obligations arising from the contractual relationship have been fulfilled, such as legal obligations related to accounting, follow-up of the customer relationship related to complaints, etc. Personal data we process as a result of a legal obligation will be deleted as soon as we are not obliged to store the data.

• Your Rights as a Data Subject

This Privacy Policy is in accordance with Norwegian law and falls under Norwegian jurisdiction. As such, you are entitled to certain rights. 

Terminate the agreement with EMPOWER: If you wish to terminate the agreement with EMPOWER, or to terminate your right to use the Empower Platform, or to terminate your account, please send us an e-mail. EMPOWER will delete your account and related personal data (unless EMPOWER is legally required to store personal data longer due to legal obligations) without undue delay, after receiving an e-mail from you.

Consent: To the extent EMPOWER’s processing of your personal data relies on your consent, you may withdraw your consent at any time. If you wish to withdraw your consent, EMPOWER will stop any processing activities based on your consent and delete your related personal data without undue delay. 

Access: You can request access to the personal data EMPOWER stores and processes about you at any time. You can also request information about how EMPOWER collects personal data at any time.

Erasure and rectification: You can request that EMPOWER erases or rectifies your personal data that Empower has collected, at any time.

Objections: You may request a restriction of the processing of your personal data or object to the processing, but this may affect your use of the Platform or our services. 

Data Portability: In the event EMPOWER’s collection and processing of your personal data is based on automatic means and EMPOWER’s legal basis is your consent or an agreement with you, you may request that the personal data concerning you and which you have provided EMPOWER with, be transmitted to you or to another data controller.

Complaints: You have the right to lodge complaints with the Norwegian Data Protection Authority (Datatilsynet).

Please, refer to the contact details of EMPOWER provided in this Privacy Policy if you wish to exercise your rights or need assistance to do so.