Skip to main content

Privacy Statement — Origo BC Bifröst

Origo ehf., company registration number (kt.) 450723-1690, Dalvegur 30a, 201 Kópavogur, Iceland (“Origo”) provides Origo BC Bifröst (the “Service”, also called Bifröst). This page explains how personal data is handled in connection with the Service. It is a documentation summary; the binding terms are the Origo sources linked below.

Controller and processor roles​

  • Origo as controller. Origo’s public Privacy Policy applies when Origo is the controller of personal data (for example Origo’s own customer contacts, website visitors, and job applicants).
  • Origo as processor. That Privacy Policy does not cover processing Origo performs when providing IT services to business customers. In that context, the Customer is normally the controller and Origo is the processor, acting under a contract with the Customer (Origo’s Terms on processing of personal data / vinnslusamningur).
  • Service context. For personal data in the Customer’s Microsoft Dynamics 365 Business Central environment that is accessed or transferred via the Service, the Customer is normally the controller and Origo is the processor.

Processing description for the Service​

The following describes processing of personal data in connection with Origo BC Bifröst, based on Origo’s published processing description for this Service (with the product name Bifröst).

Purpose and nature of processing​

Origo ehf. (processor) provides the service customer (controller) with access to Origo BC Bifröst, a service layer (API layer) that enables the controller’s solutions — for example artificial intelligence solutions — to retrieve data and perform actions in the controller’s Microsoft Dynamics 365 Business Central environment.

The Service transfers data between Business Central and the controller’s chosen solution under the access rights of the authenticated user. The Service does not store this data and does not process it further. The controller’s data is not used to train artificial intelligence models. Substantive processing takes place in the solution chosen by the controller, with which the controller contracts directly.

Categories of data subjects and personal data​

Personal data that the controller enters into Business Central may be transferred through the Service. The information primarily concerned includes the following, as applicable:

Employees and/or contractors of the controller:

  • Email addresses and usernames

Customers and vendors of the controller:

  • Name
  • Address
  • National ID (kennitala)
  • Individuals’ financial information

Sections covering further topics (for example sub-processors) are published on Origo’s processing descriptions page where available for a given service. This Service’s published description currently covers purpose and nature, and categories of data subjects and personal data, as set out above. Do not assume unpublished sections for this Service.

Service data (Origo as controller)​

Under clause 9 of the Terms of Use, Origo also processes limited Service Data to provide, secure and administer the Service: licensing and entitlement data to authenticate and validate the Customer’s access, and a hashed identifier derived from the Customer’s Business Central tenant, used to allocate and track the Customer’s usage allowance. Origo acts as controller of this Service Data. The tenant identifier is stored in hashed form, so the underlying tenant is not directly readable from it.

Terms of Use​

Contractual use of the Service is governed by the Terms of Use (EULA).

Contact for privacy​

Where Origo acts as controller, privacy inquiries may be sent to:

Data-subject requests about processing in a Customer’s Business Central environment should normally be directed to the Customer as controller, in accordance with Origo’s Privacy Policy.

Last updated on