Who We Are
Rogue is operated by Kickflip Grødahl, a company registered in Norway under organisation number 937 657 269, with its registered address at Nils Bays vei 18, 0876 Oslo, Norway (“Rogue”, “we”, “us”).
We are the data controller for the personal data described in this policy. Questions about it go to dpo@rogue.no.
What This Policy Covers
This policy covers personal data we process for our own purposes:
- visitors to rogue.no and its subdomains,
- people who sign in to the Rogue platform on behalf of a customer organisation,
- people who contact us, request a demo or receive our emails.
It does not cover the security and device data customers connect to Rogue. For that data the customer is the controller and Rogue acts as processor, under the Data Processing Agreement.
Data We Collect
- Account data: name, work email, organisation, role and sign-in identifiers.
- Usage data: technical logs of requests and errors, timestamps, IP address, browser and device type.
- Communications: messages you send us, demo requests and support conversations.
- Website data: technical data from your visit.
You need to give your name and work email to have an account. Without them we cannot give you access to the platform. You sign in with your organisation’s Microsoft account. We receive your name and email from it.
We do not ask for special categories of personal data and do not knowingly collect data from children.
How We Use It
We use personal data only where we have a legal basis under the GDPR:
- Run the platform, using account and usage data. Basis: our legitimate interest in providing the service your organisation signed up for to the people it gives access (Art. 6(1)(f)).
- Set up your account, using your name, email and sign-in identifier. When you first sign in, we create your account before your organisation has signed up, and keep only what onboarding needs. Basis: our legitimate interest in setting up the account your organisation asks for (Art. 6(1)(f)).
- Keep the service secure and reliable, using usage data and logs. Basis: our legitimate interest in protecting the platform and our customers from misuse and outages (Art. 6(1)(f)).
- Answer requests and provide support, using communications and account data. Basis: our legitimate interest in supporting our customers and the people who contact us (Art. 6(1)(f)).
- Improve the service, using usage data. Basis: our legitimate interest in making Rogue work better for the organisations that use it (Art. 6(1)(f)).
- Meet legal obligations, using account and billing records. Basis: legal obligation (Art. 6(1)(c)).
We do not sell personal data and do not use it to train AI models.
Your Right to Object
Where we rely on legitimate interest, you can object at any time to that use of your data, and we will stop unless we have compelling grounds to continue.
Who We Share It With
We share personal data only with:
- Service providers that host and run Rogue for us, listed at rogue.no/legal/subprocessors,
- Professional advisers such as lawyers and auditors, under confidentiality,
- Authorities where the law requires it,
- A buyer or successor if Rogue is merged or sold, under the same protections.
International Transfers
We host Rogue in the EU/EEA. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision, the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. The transfer mechanism for each provider is listed on the subprocessors page. You can ask us for a copy of the safeguards at dpo@rogue.no.
How Long We Keep It
- Account data: for as long as the account is active, then deleted within 60 days.
- Accounts that do not finish sign-up: if your organisation does not complete sign-up, we delete your account within 60 days.
- Usage data and logs: up to 12 months.
- Communications: 24 months after the last contact.
- Billing records: 5 years after the end of the financial year, as the Norwegian Bookkeeping Act (bokføringsloven) requires.
Security
We protect personal data with appropriate technical and organisational measures. If a breach affects your personal data, we will tell you as the law requires.
Your Rights
Under the GDPR you can ask us to:
- give you a copy of your personal data,
- correct data that is wrong,
- delete your data,
- restrict how we use it,
- hand your data over in a portable format,
- withdraw consent you have given.
You can delete your account and your organisation’s data at any time in Settings. If you have not finished sign-up, email dpo@rogue.no and we delete your account.
Email dpo@rogue.no and we will reply within one month. If you use Rogue through your employer, requests about connected security data go to your organisation first.
You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority where you live.
Cookies and Local Storage
We only store what the site and platform need to work. We do not use analytics or advertising cookies; if we ever add them, we will ask for your consent first. The website stores nothing in your browser.
- Sign-in: our identity provider sets cookies, and the platform keeps your sign-in tokens in your browser’s local storage, so you stay signed in.
- Preferences: a cookie and local storage remember the layout and theme you choose, such as whether a sidebar is open, its width, and light or dark mode. The cookie expires after 7 days.
- Connecting a platform: session storage remembers where you were while you connect a platform, and is cleared when you close the tab.
Changes to This Policy
When we change this policy we update the effective date above. If a change is significant, we tell account holders by email before it takes effect.
Contact
Kickflip Grødahl
dpo@rogue.no