Compliance with Norwegian rules

For messages, calls, recordings, transcripts and letters, the business is the controller and telkit the processor. Article 28 of the GDPR requires the processing to be governed by an agreement, the processor to follow only the controller's instructions, and no new subprocessor to be engaged without the controller being able to object.

telkit's duties as processor are set out in the terms of service. What we process and for how long is in the privacy policy.

The subprocessors page lists each supplier, what it does, and where it processes data where we have documented it. Two suppliers process data in the United States:

• ElevenLabs turns text into speech and speech into text.
• Resend sends email from its EU region but stores account data such as logs and metadata in the United States.

Transferring personal data out of the EEA needs a basis under Chapter V of the GDPR, for example an adequacy decision (Article 45) or standard data protection clauses (Article 46).

Files such as recordings, audio files and letters are stored under a key. A link to a file is created only when someone opens it, and it expires soon after.

Section 15 of the Marketing Control Act (markedsføringsloven) forbids marketing to private individuals by email, SMS or automated calling systems without their prior consent. Under that section, SMS counts as electronic mail.

The exception is existing customers. If the business obtained the email address or number in connection with a sale, it may market its own goods and services similar to those the customer relationship is based on. The customer must then be able to opt out easily and free of charge, both when the address is collected and in every message.

Forbrukertilsynet, the Norwegian Consumer Authority, publishes guidance on marketing by email and SMS (in Norwegian).

In telkit a recipient can reply to an SMS with one of the words STOPP, STOP, AVMELD. The profile then sends no more SMS to that number until the recipient replies START, and attempts to send are refused. The business must collect consent for marketing itself and be able to document it.

In Reservasjonsregisteret, run by Brønnøysundregistrene, private individuals can opt out of telemarketing and addressed advertising (in Norwegian). Businesses, including sole proprietorships, cannot register.

• Telemarketing to consumers who have registered is forbidden (section 12 of the Marketing Control Act). The same applies to addressed advertising by post (section 13), including letters sent on paper through telkit.
• The business must check its address register against Reservasjonsregisteret before the first contact, and in the month the marketing takes place (section 13 a).
• Telemarketing to consumers is forbidden on Saturdays, Sundays and public holidays, and before 09:00 and after 21:00 on weekdays. Calling from a hidden number, or from a number that is not registered and searchable in directory enquiry services, is also forbidden (section 14).
• Existing customers may be contacted about similar goods and services even if they have registered (section 12).

telkit does not check Reservasjonsregisteret for you. The business must do that check before it calls or sends advertising.

Datatilsynet treats the content of a call, and even how a voice sounds, as personal data. There are no special rules on audio recording, so the general data protection rules apply (Datatilsynet on audio recording, in Norwegian). Datatilsynet states that businesses must, as a rule, ask for consent before recording calls with customers.

Secretly recording a conversation between others is a criminal offence (section 205 of the Penal Code). The person recording must take part in the conversation.

In telkit a call is recorded only when the business asks for it on that call. The business is the controller of the recording and must make sure the participants know about it.

Nkom, the Norwegian Communications Authority, describes spoofing as manipulating a number so that a call appears to come from someone else. For SMS, the sender can also be a text rather than a number (Nkom on digital fraud, in Norwegian). telkit prevents this as follows:

• A call goes out only from an active number the business has obtained through telkit, and only to Norwegian numbers.
• SMS sender names, email senders and letterheads are approved by us before they can be used.
• Phone numbers and dedicated SMS numbers are approved by us before they are put to use.

• At registration we look the organisation number up in Enhetsregisteret at Brønnøysundregistrene.
• Before a business can send letters, make calls or get its own SMS number, we verify it with a certificate of registration (firmaattest), who can sign for it, its beneficial owners and what the services will be used for.
• As part of verification, the business accepts the rules of use and a statement on the emergency number (112).
• An organisation number can belong to only one verified account.

• API keys, invitation links and national identity numbers from BankID are stored only as checksums.
• Events sent to the business's system are signed.
• A telkit employee who opens a customer's data must give a reason. Access lasts a limited time and is logged.
• If there is a security breach, we notify the business without undue delay, as Article 33 of the GDPR requires of a processor.