Privacy Notice (External)
Date: 08.06.2026
1. Introduction
This privacy notice applies to Ekornes AS (org.no. 964 976 430) and its subsidiaries listed at the bottom of this privacy notice (hereinafter referred to individually and collectively as the “Ekornes Group”).
The Ekornes Group is committed to safeguarding your privacy and to processing personal data in accordance with applicable data protection legislation.
The Ekornes Group processes personal data relating to persons visiting our premises, using our website or sites on social media, end customers submitting warranty claims or surveys, (contact persons at) our customers, service providers and business partners, potential job candidates and others who contact us.
This privacy notice provides you with information about the Ekornes Group’s processing of personal data, including which personal data we collect, why we process your personal data, and your rights in connection with the processing of the personal data.
The data controller for the processing of your personal data is the Ekornes Group entity established in the country in which you are located and with which you interact. For the processing of personal data in connection with Ekornes Group’s websites and social media accounts, Ekornes AS is the data controller. Ekornes AS is a joint controller with the relevant local Ekornes Group entity for the processing of personal data in relation to marketing and customer surveys.
If you have any questions or requests regarding our processing of personal data or about this privacy notice, you may contact our Head of ESG by email: GDPR@ekornes.com.
Ekornes Möbelvertriebs GmbH and Ekornes Beds GmbH has a data protection officer who can be contacted by email at steffke@petersteffke.de in relation to inquiries on Ekornes Möbelvertriebs GmbH and Ekornes Beds GmbH’s processing of personal data.
2. Personal Data the Ekornes Group Collects About You
The table below lists the personal data that the Ekornes Group collects about you, and the typical sources for such personal data.
| Personal data category | Description | Source |
|---|---|---|
| Basic data. | Name, email address, country of residence and phone number. | From you or your employer. |
| Contractual and business relationship data. | Employer, title, personal data contained in contracts and commercial documents, ongoing commercial correspondence, invoices and minutes of meetings. | From you, your employer or our employees. |
| Applicant data. | CV, application, certificates, diplomas/school report, references, interview and reference notes, results from qualification tests and internal assessments. | From you, references, and public sources. |
| Admission and access data. | Information on access, including time and place of access. | From you and the Ekornes Group’s IT systems. |
| Camera surveillance. | Video and pictures from camera surveillance recordings on our premises. | From you and the Ekornes Group’s IT systems. |
| Social media interaction data. | Username, likes and comments. | From you. |
| Claim data. | Location, counterpart for purchase, product information and complaint description. | From you or the relevant distributor. |
3. How the Ekornes Group Uses Your Personal Data
The Ekornes Group will only process personal data about you where we have at least one of the following legal bases for the processing:
(i) You have given your consent to the processing, cf. GDPR Article 6(1)(a).
(ii) The processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract, cf. GDPR Article 6(1)(b).
(iii) The processing is necessary for compliance with a legal obligation to which the Ekornes Group is subject, cf. GDPR Article 6(1)(c).
(iv) The processing is necessary for the purposes of a legitimate interest pursued by the Ekornes Group or a third party, and such interests are not overridden by your interests or fundamental rights and freedoms which require protection of personal data, cf. GDPR Article 6(1)(f).
The table below sets out the purposes for which the Ekornes Group processes your personal data, the categories of personal data processed for each purpose, the legal bases relied on and the applicable retention periods:
| Purpose | Personal data categories | Legal basis | Retention period |
|---|---|---|---|
| To administer product warranty claims. | Basic data and claim data. | (iv) The Ekornes Group’s legitimate interest in administering product warranty claims and fulfilling its obligations in connection therewith. | To be retained for the duration of the claim and for up to five years following the closure of the claim, in order to comply with applicable statutory limitation periods. |
| To safeguard security in our office and factory premises. | Basic data and admission and access data. | (iv) The Ekornes Group’s legitimate interest in ensuring security on our premises. | To be deleted within 90 days from the date of access. |
| To prevent dangerous situations from arising and safeguard the safety of employees or others. | Camera surveillance. | (iv) The Ekornes Group’s legitimate interest in preventing dangerous situations from arising and safeguarding the safety of employees or others. | To be deleted within seven days of recording, unless the recording is required for follow-up in connection with a specific incident. |
| To manage our business operations and safeguard our contractual rights and obligations. | Basic data and contractual and business relationship data. | (iv) The Ekornes Group’s legitimate interest in managing our business operations and safeguarding our contractual rights and obligations. | To be retained for ten years after the relevant contractual relationship has ended. |
| Promotion and marketing of our business. | Basic data and contractual and business relationship data. | (i) Your consent to digital marketing. (iv) The Ekornes Group’s legitimate interest in promoting its products and services by phone and by SMS/email to existing customers. | To be retained until you withdraw your consent. To be retained until you are no longer a customer of ours. |
| For payment purposes. | Basic data and contractual and business relationship data. | (iv) The Ekornes Group’s legitimate interest in receiving payment and paying services and products. | To be retained for a minimum of five years after the end of the financial year, and until the statutory limitation period for the payment claim has expired. |
| For bookkeeping purposes. | Basic data and contractual and business relationship data. | (iii) Processing is necessary to perform the Ekornes Group’s legal obligations pursuant to the Bookkeeping Act. | To be retained for five years after the end of the financial year. |
| Have and administer social media account. | Social media interaction data. | (iv) The Ekornes Group’s legitimate interest in providing information about and promoting our services to reach out to a bigger audience. | To be retained until the personal data are no longer relevant to our followers. |
| Administer and respond to inquiries. | Basic data and other personal data included in the inquiry. | (iv) The Ekornes Group’s legitimate interest in providing support to answer and manage inquiries and other communication. | To be retained for up to one year from the date your inquiry was closed. |
| To improve products and services. | Basic data and response to surveys. | (iv) The Ekornes Group’s legitimate interest in improving its products and services. | To be retained for three months following customer response (then anonymised). |
| To recruit employees. | Basic data and applicant data. |
(ii) Processing is necessary to enter into an employment agreement with you (where relevant).
(iv) The Ekornes Group’s legitimate interest in finding a qualified person for the position.
|
To be retained for up to six months from the date the position was filled, unless you have consented to a longer retention period or it is necessary to retain the applicant data to establish, exercise, or defend legal claims. |
The Ekornes Group may also collect or receive additional categories of personal data where necessary to fulfil the purposes listed above.
On a case-by-case basis, the Ekornes Group may also use your personal data for purposes that are not incompatible with the purpose for which the data were originally collected or received, such as audits, analytics, reporting, innovation, dispute resolution, and mergers and acquisitions.
The Ekornes Group does not use your personal data for automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Please note that the Ekornes Group may not be able to assess your application, or fulfil or enter into the relevant contract, or satisfy the Ekornes Group’s or your legal rights and obligations, if you object to the Ekornes Group’s processing where the legal basis is (ii) contractual necessity or (iii) legal obligation.
4. Who the Ekornes Group Shares Your Personal Data With
The Ekornes Group may disclose your personal data with the following categories of recipients, to the extent necessary for the purposes mentioned above:
(i) To other Ekornes Group companies to the extent necessary for internal administrative purposes or where assistance is provided between the Ekornes Group entities;
(ii) To the Ekornes Group’s suppliers (such as IT suppliers) acting as processors for the purposes mentioned above. The Ekornes Group will enter into data processing agreements with relevant suppliers to ensure that they do not process the personal data for purposes other than those described in this privacy notice;
(iii) To authorities and third parties if required by law, such as financial institutions, or financial supervisory authorities; or
(iv) To the Ekornes Group’s advisors, owners and other business partners to the extent required to operate the Ekornes Group’s business in a manner common in our industry, which may also include third parties in connection with possible mergers or acquisitions of the Ekornes Group’s business.
When you “like” or join pages on social media, such activity will be visible to the relevant platform. The same applies to any activities on our social media accounts, such as content posted by you or posts that you like. The relevant social media platform has its own privacy notices, in which you can find more information about the processing of personal data in relation to such social media platforms.
5. Transfer of Personal Data Outside the EEA
The Ekornes Group may transfer your personal data outside the EU/EEA in certain situations, as some Ekornes Group companies, suppliers and business partners are located in countries outside the EU/EEA. This includes the transfer of personal data to Ekornes (Thailand) Limited that in certain instances will assist the Ekornes Group in claim handling and responding to inquiries.
The Ekornes Group will ensure that your personal data are protected by implementing appropriate safeguards, primarily through the European Commission’s Standard Contractual Clauses. The Ekornes Group will provide you with further details about such international data transfers upon request. If you would like to obtain a copy of the safeguards, please use the contact details above.
6. How Long the Ekornes Group Stores Your Personal Data
The Ekornes Group retains your personal data for as long as necessary for the purposes for which it was collected. The specific retention period, or the criteria used to determine it, is set out for each processing activity in the table above.
7. Your Privacy Rights
You have several rights in relation to the Ekornes Group’s processing of your personal data. Such rights include:
| Right | Description |
|---|---|
| Information | To receive further information on how the Ekornes Group processes your personal data. |
| Access | To receive a copy of the personal data the Ekornes Group has on you. |
| Rectification | To request rectification and completion of the personal data the Ekornes Group has on you. |
| Erasure | To request erasure of personal data if there are no applicable legal grounds for processing such personal data. |
| Restriction | To ask that the Ekornes Group restrict the processing of your personal data. |
| Data portability | To ask that your personal data be transferred to you in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the Ekornes Group. |
| Objection | To object to the Ekornes Group’s processing of your personal data. You also have the right to object to being subject to a decision based solely on automated processing (if relevant). |
| Withdraw your consent | Where the processing of your personal data is based on consent, you have the right to withdraw your consent at any time. Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. |
Please note that these rights are subject to conditions and limitations by law. If you would like to exercise your rights or would like more information about the conditions/limitations, please contact the Ekornes Group using the contact details above.
If you consider that the Ekornes Group processes your personal data in breach of applicable law, you may file a complaint with the competent local data protection supervisory authority. In Norway, the competent authority is the Norwegian Data Protection Authority (Datatilsynet). The Ekornes Group encourages you to contact us before making such a complaint, so that we may address your concerns and clarify any misunderstandings.
8. Changes to the Privacy Notice
The Ekornes Group may change this privacy notice from time to time, where deemed necessary or appropriate to ensure compliance with the GDPR and applicable data protection law. The Ekornes Group will notify you of changes if required under applicable data protection law.
9. List of Subsidiaries Covered by the Privacy Notice
- Ekornes AS
- Ekornes Lithuania UAB
- J. E. Ekornes ApS
- OY Ekornes AB
- Ekornes Möbelvertriebs GmbH
- Ekornes S.A.R.L
- Ekornes Iberica SL
- Ekornes Beds AS
- Ekornes Beds GmbH
- MG Holdco AS