Privacy policy
Last updated:
This page explains which personal data we process on our website, what happens when you sign in to Revios, and what rights you have.
Who is the controller
Revios is developed and operated by Halifax AS, org. no. 927 383 780, Dalen hageby 9, 7044 Trondheim, Norway. Halifax AS is the controller for personal data we process on this website and when you contact us.
Send questions about privacy to the address below.
What we collect on the website
The website is open. You need no account to read it, and we do not ask for personal data to show the content.
- Technical server logs: the website is hosted by Netlify, which records IP address, time, which page was requested and which browser requested it. The logs are used to run and secure the service, based on our legitimate interest (GDPR Article 6(1)(f)).
- The “Request access” form: organisation number, company name, name, email address, phone number, any message and which language you used. We process this to reply and follow up on your request, based on our legitimate interest in communicating with people who contact us (Article 6(1)(f)). Submissions are stored in Netlify Forms. We delete the request when the matter is closed, at the latest after 12 months.
- The content of emails you send us: your name, email address and what you write. We process it to reply and follow up, based on our legitimate interest in communicating with people who contact us (Article 6(1)(f)). We delete the enquiry when the matter is closed, at the latest after 12 months.
We do not use data from the website for marketing or profiling.
Entity register lookup and spam protection
When you enter a valid organisation number in the form, your browser fetches the company name from the Norwegian entity register (data.brreg.no). The lookup goes straight from your browser to the Brønnøysund Register Centre and contains only the organisation number.
The form is protected by Cloudflare Turnstile, which assesses browser signals to distinguish people from automated submissions. Cloudflare acts as our processor when providing the security service, and as an independent controller when using the data to improve bot detection. Turnstile loads only on the form page.
Cookies and local storage
The website sets no cookies of its own. Two choices are stored locally in your browser, and neither identifies you:
- revios-theme: your choice of light or dark appearance.
- revios-access-sent: the time of your last request, so the same request is not sent twice in a row.
Both are needed to deliver what you have chosen, so we do not ask for consent (the exception in section 3-15 of the Norwegian Electronic Communications Act covers necessary storage). We use no analytics and no tracking. Fonts are served from our own domain. The only third-party script is Cloudflare Turnstile on the form page.
Signing in to Revios
Microsoft sign-in uses Entra ID. We receive your name, email address and a user reference from the identity provider. Access to a firm depends on membership and approval in Revios, not on the email domain alone. The sign-in page shows which sign-in methods are available.
When you are signed in, a session cookie is set on the application's domain. It keeps you signed in, and it is not set by this website.
Personal data in the product
The audit firm that uses Revios is the controller for the personal data in its own engagements. Halifax AS is the processor and processes the data only on the firm's instructions under a data processing agreement.
- Most personal data is stored in a separate, encrypted store, apart from the rest of the working data.
- The data about one person can then be erased on its own, without breaking the audit trail.
- Content the auditor writes or pastes into workpapers, and documents retained as originals, may be outside this store. Deletion must be assessed separately against retention obligations and technical constraints. The audit firm receives the details in its data processing agreement.
- The signed audit trail stores events and pseudonymous user references, not names, email addresses or document content. The link to an individual is kept outside the trail. A user reference may still be personal data.
- Some data must be kept for as long as the law requires audit documentation to be retained. Erasure can then be postponed until the retention period ends, and the person who asked for erasure is told.
The audit firm receives the full description of storage, erasure and retention periods in the data processing agreement.
Accounting-system integration (PowerOffice Go)
The audit firm can fetch a client's accounting directly from the client's accounting system instead of uploading a SAF-T file. The first integration is with PowerOffice Go, which is being rolled out gradually. PowerOffice Go is provided by PowerOffice, part of Visma. Revios is an independent service from Halifax AS. Revios is not made, sponsored or endorsed by Visma or PowerOffice.
- Authorisation: at the audit firm's request, the client itself authorises the connection in PowerOffice Go. Without the client's authorisation, Revios fetches nothing.
- Read only: Revios reads data from PowerOffice Go. Revios never writes, changes or deletes anything there.
- What is read: chart of accounts, trial balance, postings with their text, customer and supplier balances, customers and suppliers (name, organisation number, postal address and bank account number), departments, projects, custom dimensions, VAT codes and number series, and the company's organisation and financial settings. For customers and suppliers we do not request the national identity number, date of birth, e-mail address or telephone number. The company's own settings are fetched whole, including its e-mail address and telephone number (for a sole proprietorship, the owner's). An organisation number or text the client typed in can contain personal data.
- Purpose: the audit of this client, carried out by the audit firm the client chose. The data is not used for anything else.
- Roles: the audit firm is the controller, and Halifax AS is the processor. PowerOffice is the client's own system provider and not a subprocessor of Revios. The connection is technical access the client gives its auditor under the Norwegian Auditors Act § 2-2, not consent under the GDPR.
- Retention: the data is kept as audit documentation for as long as the law requires: five years in Norway and Denmark, seven in Sweden and ten in Finland, and longer where the audit documentation must be kept longer after the audit report. For technical reasons the unchanged original can remain stored, unused, for at least ten years after we received it before it is deleted.
- How the client removes access: in PowerOffice Go, under Meny → Innstillinger → Utvidelser (Menu → Settings → Extensions). At the latest 20 minutes later, Revios can fetch no more. Accounting already fetched stays in the engagement and follows the retention above.
- No other use: the data is not used to train models, and not for comparisons or benchmarks across customers. We do not share it with third parties beyond our sub-processors and where the law requires it. It is stored in Microsoft Azure in Norway (see "Where data is stored" and "Subprocessors").
Artificial intelligence
Revios uses a language model to suggest text and summaries. Suggestions are labelled as AI-generated, and they have no effect until an auditor has reviewed and approved them.
The language model runs at Microsoft within the EEA. We send only what the model needs for the task, and keep personal data out where we can. Microsoft may retain requests for up to 30 days to detect abuse. We are working to obtain an exemption from this for audit data.
Where data is stored
Revios uses Microsoft Azure. The development environment is in Norway East, and the language model is configured for an Azure region in the EU. Before a firm uses the service with client data, the agreements must identify the applicable hosting and backup locations. EEA hosting does not by itself exclude supplier access from other countries requiring a separate assessment. The data processing agreement and subprocessor list describe processing locations and the terms for that access.
The revios.no website is hosted by Netlify, and form submissions are stored at Netlify. Netlify and Cloudflare are US companies. Netlify’s published data processing agreement uses the EU–US Data Privacy Framework where applicable, with the EU Standard Contractual Clauses as a fallback. Cloudflare’s published data processing agreement includes the EU Standard Contractual Clauses and supplementary measures. The applicable basis depends on the processing and supplier agreement; the published supplier terms alone do not document our specific transfer assessment.
Subprocessors
In the Revios product, we use Microsoft as a subprocessor for Azure hosting, Entra sign-in and Azure OpenAI. The website uses Netlify for hosting and form submissions. Cloudflare Turnstile provides website spam protection in the roles described above. Website suppliers are not thereby subprocessors for the audit firm’s client data. New suppliers and applicable processing locations must be documented in the agreements for the service in which they are used.
Audit firms that use Revios receive the full and current list of subprocessors in the data processing agreement.
Your rights
For personal data we process about you, you have the right to:
- access: to know which data we hold about you
- rectification: to have incorrect data corrected
- erasure: to have data deleted that we no longer have grounds to keep
- restriction: to ask us to stop using the data while a matter is resolved
- data portability: to receive the data you gave us in a machine-readable format
- objection: to object to processing based on legitimate interest
To use one of these rights, contact us at the address below. If your request concerns an audit engagement, we refer you to the audit firm, which is the controller there. You can also complain to the Norwegian Data Protection Authority (Datatilsynet). We make no decisions about you based solely on automated processing, and we do no profiling.
Changes
We update this policy when the service or the processing changes. The date at the top shows when it was last changed. Our customers are told directly about changes that matter to them.