Already On

Privacy policy

Last updated: 16 April 2026

Data controller

Already On AS is the data controller for personal data collected via our websites and services.

  • Company: Already On AS
  • Organisation number: 990 958 971
  • Address: Vollsveien 21, 1366 Lysaker
  • Email: post@alreadyon.com
  • Phone: +47 21 42 06 00

What personal data do we collect?

We may collect the following categories of personal data:

  • Contact information: Name, email address, phone number and organisation name — when you fill in forms or get in touch.
  • Usage information: IP address, browser type, operating system, visited pages and timestamps — via analytics tools and logs.
  • Cookies: Strictly necessary cookies and analytics cookies. See our cookie policy for details.

For users of our products (AlonLearn and AlonSkills), additional personal data is processed in accordance with separate data processing agreements with each customer.

Why do we process personal data?

We process personal data for the following purposes:

  • Delivering services: To operate and improve our products and websites.
  • Communication: To respond to enquiries and provide customer support.
  • Analytics: To understand how the websites are used and improve the user experience.
  • Marketing: To send relevant information, if you have consented to it.
  • Legal obligations: To comply with applicable laws, such as accounting and tax legislation.

Legal basis

The processing of personal data takes place on the following legal bases:

  • Consent (GDPR art. 6(1)(a)) — for analytics cookies and marketing.
  • Contract (GDPR art. 6(1)(b)) — to deliver services you have ordered.
  • Legitimate interest (GDPR art. 6(1)(f)) — for operation, security and improvement of services.
  • Legal obligation (GDPR art. 6(1)(c)) — for statutory requirements.

Sharing information

We do not share personal data with third parties for marketing purposes. Information may be shared with:

  • Subprocessors: Service providers that help operate the websites and services (e.g. hosting, email delivery). These are bound by data processing agreements.
  • Authorities: If we are legally required to disclose information.

Storage and deletion

Personal data is not stored longer than necessary for the purpose for which it was collected. Contact form enquiries are deleted after 12 months. Analytics data is anonymised after 26 months.

Your rights

You have the following rights under GDPR:

  • Access: You can request to see what information we hold about you.
  • Rectification: You can request that incorrect information be corrected.
  • Erasure: You can request that information be deleted.
  • Restriction: You can request that processing be restricted.
  • Data portability: You can request to receive your data in a structured format.
  • Objection: You can object to processing based on legitimate interest.

To exercise your rights, get in touch at post@alreadyon.com.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or deletion. Our services run on AWS infrastructure with a European data centre, encryption in transit and at rest, and regular security audits.

Contact

Have questions about our processing of personal data, or want to exercise your rights? Get in touch:

  • Email: post@alreadyon.com
  • Phone: +47 21 42 06 00
  • Post: Already On AS, Vollsveien 21, 1366 Lysaker

You can also lodge a complaint with the Norwegian Data Protection Authority if you believe we are not processing your personal data in line with the regulations. See datatilsynet.no.