How we process personal data.

Controller

Desken AS is the controller for personal data collected through PRM.no. Privacy enquiries go to kontakt@prm.no.

Enquiries from the website

The contact form stores your name, email address, any phone number and organisation, the topic and your message in our database, and additionally assembles a pre-filled email in your own email program. Both, so that the enquiry is not lost if you do not send the email.

The basis is legitimate interest in answering enquiries you initiated yourself, cf. GDPR article 6(1)(f). We keep the data for as long as it is necessary to follow up the enquiry.

The proofreading tool

The text you paste in is not sent anywhere. The whole check runs in your own browser. An unpublished press release never leaves your machine, and we can neither read it nor store it.

The tool is free to use once a day. If you want to use it more, we ask for company name, email address, website, phone number and postal address. That information is stored with us and used to get in touch if you might be relevant as a client. It is not shared, and you will not be sent anything you did not ask for.

The basis is legitimate interest in following up organisations that have shown interest in the service, cf. article 6(1)(f). You may object to this at any time by writing to kontakt@prm.no, and we will delete the entry. The data is deleted in any case after two years without contact.

Whether you have used the tool today is remembered locally in your own browser. It is not a cookie and is not sent to us. If you clear your browser storage, the counter is reset.

Journalists in the media register

In order to distribute press releases we maintain a register of newsrooms and journalists. The register contains named individuals in a professional capacity: name, work address, job title and which subject areas they cover.

The basis is legitimate interest, cf. article 6(1)(f). The balancing of interests rests on the data concerning the professional role and not private life, on it being collected from publicly available sources, and on journalists receiving press enquiries as a normal part of their work.

Journalists who sign up themselves via prm.no/en/for-journalists/ are processed on the basis of consent, cf. article 6(1)(a). The address is not used until it has been confirmed from the inbox, and consent can be withdrawn at any time via the link at the bottom of every press release. An address that has unsubscribed or deleted itself can only be registered again through a new confirmation sent to that same address.

Newsrooms that register via prm.no/en/for-newsrooms/ are processed on the same basis. We store the media outlet, the name of the person who registered, the departments, the addresses and the topics. No address is used until it has been confirmed from its own inbox. If the newsroom asks for the account to be deleted, sending to every address stops immediately. Once we have confirmed the deletion, the information is removed, and the addresses stay on the suppression list until they are registered and confirmed again.

We record where the information came from

For every entry we store the source, the time of collection and when it was last confirmed. That is not administrative decoration: without it we can neither document the basis nor know when a piece of information has become too old to rely on.

You are to know that you are listed

When data has been collected from sources other than yourself, you are entitled to be informed, cf. article 14. We therefore give notice before an entry is put to use, and record when the notice was sent.

If you ask to be left alone, you are left alone

You may object to the processing at any time, cf. article 21. You are then removed from all sendings immediately, and the address is placed on a block list so that you cannot be added again by a client or by a later update. The block is technically enforced, not a routine somebody has to remember.

Retention

Entries not confirmed within 24 months are deactivated and deleted. On deletion we keep only a cryptographic checksum of the address, with no way to read it back — precisely to prevent you from being added again in a later collection.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object. Enquiries are answered without undue delay, and at the latest within one month. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe the processing breaches the rules.

Sharing and processors

Data is not sold. It is shared with the processors below, which have a data processing agreement with us and process the data only on our instructions. In addition, search terms are sent to Google, which processes them as an independent controller (see below).

Transfers outside the EEA. Data is stored in the EEA, with one exception: Anthropic stores it in the US. Our contracting party there is Anthropic Ireland, and the transfer to the US is based on the EU standard contractual clauses (SCC) in Anthropic's data processing agreement. Supabase (contracting entity in Singapore, and server functions that run in the region nearest the user), AWS and Brevo may give access from outside the EEA through their own affiliates and sub-processors, based on SCC, or the EU–US Data Privacy Framework where the recipient is certified. If you would like to know more about the basis, write to kontakt@prm.no.

The coverage search sends search terms to Google News and Google's search API: the release's headline, the organisation's name and keywords from the text, before and after sending. Google is not our processor. The searches are processed by Google as an independent controller under Google's own terms and privacy policy. Google LLC is certified under the EU–US Data Privacy Framework.

Our clients get to see which newsrooms a sending went to, but not the email addresses in the media register themselves. The register cannot be exported by clients.

The client portal

Clients sign in at prm.no/portal/ with an email address and password, or with a sign-in link sent by email. Sign-in is handled by our processor (Supabase). The session is stored in the browser's local storage until you sign out; it is not a cookie, and it is not sent to anyone but us.

Contact persons, logos, photos and press files uploaded in the portal are meant for the newsroom, and become public when the release is published. The client is responsible for having consent from the people who are pictured and named.

The coverage search fetches results from Google News and Google's search API, before sending to show what has already been written about the topic, and after sending to show whether the press release has been used. The search is sent from our servers and contains the release's headline, the organisation's name and keywords from the text, never personal data about journalists.

Recipients of press releases can unsubscribe with the link at the bottom of every email. The unsubscribe is technically enforced and takes effect immediately.