Dated: 5th of August, 2026

Privacy policy - Comida

Comida is a commercial digital platform where suppliers manage the products Oda and Mathem purchase. This privacy policy describes the processing of personal data from users of Comida.

Data collection

Personal data

When we talk about personal data, we mean information that can be linked to an individual. In the context of this policy, that might include your name, phone number, email address, etc.

We will sometimes refer to this kind of information simply as “data” and we’ll make it clear in cases where the data has been anonymized, meaning it has been stripped of details that identify you individually.

How we collect data

We collect personal data that:

• you provide to us, for example when you register a user account with us with your email address.
• is automatically registered when you use the service.

Like many other websites, we use cookies and similar technologies on our platform. A cookie is a piece of text that is stored on your device that helps us determine which parts of our websites users visit, and for how long. When you visit our platform we’ll ask for your consent on the data we collect. You can change your consent at any time in the cookie settings in the account management section.

What we collect

We collect personal data in the following categories:

• Basic information such as your name, and ways to contact you such as your email address and phone number.
• Technical information about devices you use to access our services.
• Information about your Comida settings and preferences, like whether you prefer light or dark color mode as a default.
• Information that is based on your pathway through our platform, like how long you took to submit a product.

How we use data

We use data that we register about you for the following purposes:

• To provide services: When you log in, we process your e-mail address and password for authentication and access management. This processing is necessary for the performance of our contract with you or your employer in providing platform access to our business partners.
• Development and analysis: We process data to understand your needs and to improve and expand the services we provide. The legal basis for this is our legitimate interest in improving our platform, as we consider the consequences of this processing not to be significant for you. We limit the personal data processed, consider the impact of the processing, and apply security measures to limit the impact of such processing.
• Complying with laws and regulations: We process personal data to comply with accounting laws and similar regulations, including presenting information to authorities when the law requires it.

Retention of data

We will keep your personal data for as long as we are required to. For example, we may require it for our legitimate business purposes, to carry out our contractual obligations, or when the law or regulations oblige us.

When we delete your user account, we will delete all your personal data except for any data we are required or allowed to store for a longer period according to relevant laws and regulations (e.g. local accounting regulations). That means that we may keep some personal data for a longer period after your relationship with us ends. We would then expect to delete your personal data at the latest when there is no longer any legal or regulatory requirement or legitimate business purpose for retaining it. Note that anonymized data is not subject to these kinds of retention requirements.

Third parties and data sharing

We disclose personal data to:

• Service providers who may access personal data so that they can perform services for us. In such cases, we have data processor agreements in place to ensure data protection; our partners may not use the data for any purpose other than to provide the agreed service.
• Companies within the Oda Group. We might, for example, need to do this so that we can deliver our services to you, or in connection with corporate changes.

We might also disclose personal data:

• In statutory cases, for example by court order, the police or other public authorities, in accordance with strict predefined processes.
• In connection with transactions, restructurings or other corporate changes, e.g. as part of a merger, acquisition, sale of Oda’s assets or transfer of services to another company.

Data transfers outside the EU/EEA

We mainly process personal data in Norway and within the EU/EEA. In some cases, we work with partners located outside the EU/EEA (sometimes referred to as “third countries”), and in these situations we take extra precautions to ensure that your data is processed to our standards through measures like:

• Using the European Commission’s standard agreement that ensures the transfer of data to third countries (Standard Contractual Clauses); and
• Transferring data to countries pre-approved by the European Commission.

Our precautions include organizational, contractual and technical measures incorporating risk assessments, access management, archiving routines, data handling routines, and more.

Sub-processors processing data on behalf of Oda

ODA Group affiliate sub-processors

Your rights

You always have the right to ask for access to your data, rectify any incorrect information, object to data processing, ask for deletion of data, request the restriction of processing, and request data portability. If any processing is based on your consent (such as certain cookies), you have the right to withdraw your consent at any time. If you wish to enforce any of these rights, you can do this by contacting us at privacy@oda.com.

If you believe that the way we process personal data doesn’t match up with what we have described here, or that we are in violation of data protection legislation, you can also get in direct contact with your local data protection authority. You can find information on how to contact your local data protection authority on their website (www.datatilsynet.no in Norway, www.imy.se in Sweden).

Changes to this policy

Our latest Privacy Policy is always available on our webpage, and we will always state the date of the most recent change. We might update our Privacy Policy when there are changes in legislation, our practices, or when needed for any other reason. We will share information about any significant changes, which will apply from the time and date of the announcement.

Data controllers and data protection officer

For partners in Norway Oda Norway AS is the data controller for personal data (contact information: Oda Norway AS, Kjølberggata 31, 0653 Oslo).

For partners in Sweden Mathem i Sverige AB is the data controller for personal data (contact information: Mathem i Sverige AB, Slottsbacken 10, 111 30 Stockholm)

If you disagree with how we process your personal data or have questions, please feel free to send us an email at privacy@oda.com or write a letter to us: Oda Norway AS, Solheimveien 3, 1461 Lørenskog, Norway. You can also send an email to the appointed data protection officer for Oda at dpo@oda.com.