Privacy Policy

1. Introduction

Turfpal AS (“Turfpal”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit our website (www.turfpal.com), use our web platform (app.turfpal.com), use our mobile application (“Turfpal”), or otherwise interact with us (together, the “Services”).

It also explains your rights under the EU General Data Protection Regulation (“GDPR”), as incorporated into Norwegian law through the Norwegian Personal Data Act (personopplysningsloven), and how to exercise them.

2. Who we are – controller and processor roles

Turfpal as controller. For personal data we collect about website visitors, account holders, prospects and users of the Services (for example account and contact details, usage and device data), Turfpal AS is the data controller.

Turfpal as processor. When a customer (for example a golf club or facility) uses the Services, staff and other individuals may enter operational and personal data into the platform. For that customer content, the customer is the data controller and Turfpal acts as a data processor, processing the data on the customer’s documented instructions under a Data Processing Agreement (see Section 12).

Contact details of the controller:

• Turfpal AS, Gamle Forusveien 1, 4031 Stavanger, Norway
• Company registration number (organisasjonsnummer): 932 910 365
• Data protection contact: support@turfpal.com

3. Personal data we collect

3.1 Information you provide to us

• Account information: name, email address, phone number, job title, employer/club, and login credentials.
• Profile information and communication preferences.
• Content and operational data you enter into the Services, such as task records, inspections, HSE logs, equipment and inventory records, turf assessments and related notes, documents and photographs.
• Correspondence and support requests, including information you provide when contacting us or subscribing to our newsletter.

3.2 Information collected automatically

• Device and technical information (device type, operating system, browser type, app version, unique identifiers, IP address).
• Log data, usage patterns and analytics about how you use the Services.
• Error, performance and diagnostic data. Where you have consented to analytics, this may include a recording of your interactions with a page or screen, which we use to diagnose faults and improve usability.
• Push notification identifiers, where you enable notifications on a mobile device.
• Approximate or precise location data – only where the feature requires it and, for precise location on mobile, only with your consent. Where your employer enables location, working-time or equipment-tracking features, your employer is the data controller for that data and decides how it is used (see Section 12).
• Cookies and similar technologies (see Section 6).

3.3 Information from third parties

Where you enable an integration (for example weather data, or third-party soil, turf or equipment sensor systems), we receive data from those sources as configured by you or your organisation. We may also receive limited information from service providers that help us operate, secure and market the Services.

4. Why we process your data and our legal bases

Under the GDPR we must have a legal basis for each processing purpose. The table below sets out the main purposes and the corresponding legal basis.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more detail about this balancing at any time.

5. How we use your information

• Providing, operating and improving the Services.
• Personalising your experience and remembering your preferences.
• Communicating with you about the Services, including service, security and administrative messages.
• Analytics, troubleshooting and optimisation.
• Marketing, where permitted and subject to your choices.
• Security, fraud prevention, and legal and regulatory compliance.

5.1 AI-assisted features

Some features of the Services use artificial intelligence to search, summarise and generate suggestions from content held in the Services – for example turf assessments, task records and documents you upload. To deliver these features, the relevant content is sent to AI service providers that act as our sub-processors under written agreements, on terms that do not permit them to use your content to train their own models. This may involve a transfer of data outside the EEA, subject to the safeguards described in Section 8.

AI-generated output is advisory only, may be inaccurate or incomplete, and does not replace professional judgement. We do not use it to make decisions about you by automated means alone that would have legal or similarly significant effects.

6. Cookies and similar technologies

We use cookies and similar technologies on our website and web platform. Non-essential cookies are only set with your consent, which you can give or withdraw at any time through our cookie banner or your browser settings.

Change your cookie preferences

7. Sharing your data and sub-processors

We do not sell your personal data. We share it only as described below:

• Service providers and processors who help us run the Services (hosting, infrastructure, analytics, communications, support), under written agreements.
• Integration partners and data sources you choose to connect.
• Professional advisers, auditors, and potential acquirers in the context of a corporate transaction, subject to confidentiality.
• Public authorities, courts or law enforcement where required by law or to protect our rights.

We engage the sub-processors listed below to provide the Services. We keep this list current, and customers are notified of changes in accordance with our Data Processing Agreement.

Integrations that you or your organisation choose to connect – for example messaging, automation, sensor, robotic equipment or weather systems – transfer data to those providers on your instruction. They are not Turfpal sub-processors, and their own terms and privacy policies apply.

8. International data transfers

We aim to keep personal data within the EEA. Where data is transferred to countries outside the EEA that are not covered by an adequacy decision, we put appropriate safeguards in place, such as the European Commission’s Standard Contractual Clauses together with any supplementary measures required. You can request a copy of the relevant safeguards by contacting us.

9. Data security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit and at rest.
• Access controls, authentication and role-based permissions.
• Regular security assessments and monitoring.
• Staff training and confidentiality obligations.

No system is completely secure. If a personal data breach affects your rights, we will notify the relevant supervisory authority and, where required, affected individuals, in line with the GDPR.

10. Data retention

We keep personal data only for as long as necessary for the purposes described in this Policy, and to comply with legal obligations (for example accounting records under Norwegian law), resolve disputes and enforce our agreements. When data is no longer needed, it is deleted or anonymised. Customer content is retained and deleted in accordance with the customer agreement and Data Processing Agreement.

11. Your rights

Subject to conditions in the GDPR, you have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing, including direct marketing.
• Data portability.
• Withdraw consent at any time, without affecting prior processing.

To exercise your rights, contact us at support@turfpal.com. We will respond within the time limits set by the GDPR (normally one month). Where Turfpal acts as a processor on behalf of a customer, we will refer your request to that customer or assist them in responding.

You also have the right to lodge a complaint with a supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no).

12. Customer content – our role as processor

Where we process personal data on behalf of a customer as part of the Services, we do so only on the customer’s documented instructions and under a Data Processing Agreement (DPA) that meets the requirements of Article 28 GDPR. The DPA governs the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, security measures, use of sub-processors, assistance with data subject requests, and deletion or return of data at the end of the engagement. Customers can request our standard DPA by contacting support@turfpal.com.

13. Children’s privacy

The Services are intended for professional use and are not directed to children under 15. We do not knowingly collect personal data from children under 15. If we learn that we have done so, we will delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, where changes are material, notify you through the Services or by email. Continued use of the Services after an update constitutes acceptance of the revised Policy.

15. Contact us

• Data protection matters: support@turfpal.com
• General enquiries: post@turfpal.com
• Postal address: Turfpal AS, Gamle Forusveien 1, 4031 Stavanger, Norway