Legal
Privacy Policy and Retention Schedule
Last Updated: July 2026
1. Introduction
Pinetree Group AS and its corporate affiliates (“Pine59,” “we,” “us,” or “our”) values individuals’ (“you” or “your”) privacy. This Privacy Policy (“Policy”) describes how Pine59 affiliates collect, use, store, and disclose personal information in connection with:
- Our Services - the aggregated mobility and location insights products and services that we provide to our business customers (“Customers”); and
- this website, www.pine59.com (the “Website” or “Site”).
The Pine59 entity responsible for your personal information under applicable privacy laws generally depends on the company with which you have a contractual relationship or otherwise interact.
Our Partners are companies that collect location information from mobile devices and provide that information to us as location data for our Services. Individuals who access or use our Services on behalf of a Customer are referred to in this Policy as “Users of Services.”
This Policy explains your rights under applicable privacy laws and refers to specific laws, such as the CCPA and GDPR, where relevant.
2. Who We Are
Pine59 provides aggregated mobility and location insights to business customers. Our Services help Customers understand foot traffic, visitation patterns, travel patterns, trade areas, and other mobility trends.
The Services provide statistical information about places, areas and ways and provides statistical information like visits, and other broader statistical patterns. They focus on aggregated insights, not on individual people, households, or devices. We do not sell personal information.
3. Description of Services
Services
Pine59 produces aggregated mobility and location insights products. Our Services provide statistical insights about groups of people, places, visits, and movement patterns.
We work with different types of data partners, including providers of data collected through mobile apps and telecommunications operators. The data and processing arrangements depend on the source.
In some cases, a Partner makes location-based location data available to Pine59 for the limited purpose of producing aggregated statistics. In other cases, the Partner processes the underlying data in its own environment and provides Pine59 with aggregated results without any identifiable information.
Where Pine59 processes location data, it may include precise geolocation coordinates, timestamps, mobile advertising identifiers, and limited technical information, such as device type. The categories of data vary between Partners.
Pine59 uses location data only to create, validate, and improve aggregated mobility statistics. This may involve filtering, quality checks, deduplication, counting, and statistical modelling. We may also combine the data with information about places and geographic areas, such as points of interest and geographic boundaries.
Device identifiers are used only where technically necessary to perform these operations. Pine59 does not use location data to create or retain profiles about particular individuals or devices, for targeted advertising, or to make decisions about individuals. Device-level intermediate data is deleted or aggregated after a limited period.
Website
Through our Website, we provide information about our company and Services, offer product demonstrations, and communicate with prospective and existing Customers.
Users of Services
Individuals who access or use our Services on behalf of a Customer may provide personal information to us in connection with their use of the platform, including contact information, account credentials, and usage data. We process this information to provide, maintain, and improve the Services, to communicate with Users of Services, and to administer Customer accounts.
4. Our Data Practices
Information We Collect
We collect information from three distinct sources:
A. Information collected from Partners (Services location data)
We may receive the following categories of personal information from our Partners for the purpose of producing our Services:
| Information Category | Description |
|---|---|
| Identifiers | Mobile advertising ID (MAID/ADID); IP address |
| Geolocation Data | Precise geolocation data, including latitude/longitude coordinates derived from GPS, cell tower triangulation, WiFi data, or other techniques |
| Device User Agent Data | Device type |
B. Information collected from Users of Services
We collect the following information from individuals who access or use our Services on behalf of a Customer:
| Information Category | Description |
|---|---|
| Identifiers | Name, email address, phone number, job title, company name |
| Customer Records | Account credentials, role and permissions within the Services |
| Internet or Network Activity | Usage data, including log-in times, features accessed, queries submitted, and configuration changes |
| Billing and Transaction Information | Billing address, payment method details, and transaction history (where the User of Services is involved in billing for the Customer’s account) |
| Communications Preferences | Preferences for receiving communications from Pine59 |
C. Information collected through our Website
We collect the following information when you browse our Website, submit an inquiry, contact us about our services, or apply for a job:
| Information Category | Description |
|---|---|
| Identifiers | Name, email address, phone number, IP address (to the extent you provide these when you contact us or submit a form) |
| Device Information | Browser type, operating system, time zone setting, browser plug-in types and versions |
| Internet or Network Activity | Web pages you view, links you click, length of visit, referring webpage |
| Communications Preferences | Your preferences for receiving marketing communications |
| Professional or Employment Information | If you apply for a job, current or past employment history |
How We Use Your Information
Services - location data. We use the location data we receive from our Partners exclusively to produce, quality-assure, and improve our aggregated Services. Pine59 processes precise geolocation and pseudonymous device identifiers solely as technical inputs to create, validate, and improve aggregate mobility statistics concerning groups, locations, and time periods. Pine59 does not collect or process sensitive personal information for the purpose of inferring or retaining characteristics, preferences, interests, behaviour, or profiles about a particular consumer.
Any device-level processing is limited to operations necessary to filter, validate, deduplicate, count, and aggregate signals. Device-level intermediate data is deleted or aggregated after a short, defined period. Individual records cannot be queried or exported for commercial purposes. We do not create or retain persistent profiles over specific devices. We do not use location data to build individual interest profiles, categorize device users into audience segments, track advertising campaign performance, or determine employment, credit, insurance, or underwriting eligibility. We do not use information collected through our Website or from Users of Services to produce our Services.
Users of Services. We use information collected from Users of Services to provide, maintain, and improve the Services; to administer Customer accounts and manage access permissions; to communicate with Users of Services about the Services, including updates, support, and administrative matters; to process billing and transactions; to monitor and analyze usage of the Services for security, quality assurance, and product improvement; and to comply with legal and regulatory obligations.
Website. We use information collected through our Website to provide, improve, and personalize our Website and services; to communicate with you about our services, respond to inquiries, provide customer service, and send newsletters and promotional materials; to understand how visitors access and use our Website; to protect safety, rights, property, and security, detect and prevent fraud, and enforce this Policy; and to comply with legal and regulatory obligations, including responding to legal process.
How We Share Your Information
Services - Customer deliverables. We share only aggregated, de-identified data products with our Customers. We do not share device-level data, mobile advertising identifiers, individual location histories, or any data that could identify a specific person, household, or device with our Customers. Because our Customer deliverables consist solely of aggregated and anonymized data, the provision of Services to Customers does not constitute a “sale” or “sharing” of personal information under applicable U.S. state privacy laws.
We may share location data or personal information with service providers - third-party vendors and contractors who perform functions on our behalf, subject to contractual restrictions limiting their use to our business purposes and prohibiting further sale or sharing - and with our corporate affiliates, subject to this Policy.
Users of Services. We may share information collected from Users of Services with service providers who perform functions on our behalf (such as hosting, analytics, and customer support), and with affiliates, in each case subject to contractual restrictions consistent with applicable privacy laws.
Website. We may share information collected through our Website with our affiliates, subject to this Policy; with service providers who perform functions on our behalf; with analytics providers to evaluate Website usage; and in the form of aggregate and de-identified information shared with third parties for marketing, research, or similar purposes.
General. We may also share information to protect us and others where necessary to investigate or prevent illegal activities, fraud, or threats to safety; in response to legal process to comply with the law, court orders, or other legal process; with your consent; and in connection with a merger, acquisition, asset transfer, or other business transfer.
Legal basis for processing
Under the GDPR, we must have a legal basis for processing your personal information. The legal basis we rely on depends on the type of data and the purpose of processing. For location data we receive from our Partners, we rely on app providers and data suppliers to obtain consent from individuals whose data is collected. We contractually require our Partners to comply with all applicable laws and to only provide us with data they have the right to share with us for our specific purposes.
For Users of Services, we process your personal information as necessary to perform a contract we have entered into with you, or to communicate with you regarding our Services. This includes processing your contact information, account credentials, billing data, and usage data to provide and administer your access to our Services.
In some cases, we rely on our legitimate interests as the legal basis for processing personal information. This includes processing to analyse the use of and improve the Services, maintain the security of our Services, detect fraud, ensure that bugs are detected and fixed, protect our systems and information from unauthorized persons, and comply with legal obligations. In determining our legitimate interests, we consider and balance any potential impact on you and your rights before processing your personal information to ensure that our interests do not override your rights.
For Website visitors, we process your personal information based on our legitimate interests to operate, maintain, and improve our Website, including processing IP addresses, log data, and interaction data for analytics, security, and performance monitoring. Where we use cookies or similar technologies for purposes other than those strictly necessary for the functioning of our Website, we rely on your consent, which you can withdraw at any time through the choices described in this Privacy Policy.
International data transfers
When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to countries that have not been recognized as providing an adequate level of protection, we do so using appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, or under other lawful transfer mechanisms recognized under applicable law.
5. Supplementary Information for Individuals Residing In Select U.S. States
Under various U.S. state privacy laws, you have certain rights with respect to your personal information. This section provides additional information required by these laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, “CCPA”), the Oregon Consumer Privacy Act, and other applicable state privacy laws.
Personal Information
The following table discloses the categories of personal information we have collected in the last twelve (12) months:
| Category | Collected from Website | Collected from Users of Services | Collected from Partners |
|---|---|---|---|
| Identifiers (e.g., name, address, device identifier, IP address, account name) | Yes – name, email, phone, IP address (when provided) | Yes – name, email, phone, job title, company | Yes – MAID/ADID, IP address |
| Customer Records (Cal. Civ. Code § 1798.80(e)) (e.g., name, signature, physical characteristics, address, telephone number, insurance policy number, employment, bank account number, credit card number) | Yes – name, phone number | Yes – account credentials, role and permissions | No |
| Protected Classification Characteristics under California or Federal Law (e.g., race, color, national origin, religion, gender, age, disability) | Yes – age and gender | No | No |
| Commercial Information (e.g., records of products or services purchased, obtained, or considered) | No | Yes – billing and transaction information | No |
| Biometric Information (e.g., genetic, physiological, biological, or behavioral characteristics) | No | No | No |
| Internet or Other Network Activity (e.g., browsing history, search history, interaction with website, application, or advertisement) | Yes – browsing history, interaction data | Yes – usage data, log-in times, features accessed | No |
| Geolocation Data (e.g., physical location or movements) | No | No | Yes – precise geolocation data |
| Sensory Data (e.g., audio, electronic, visual, thermal, or olfactory information) | No | No | No |
| Professional or Employment-Related Information (e.g., current or past job history) | Yes – if you apply for a job | Yes – job title, company name | No |
| Non-Public Education Information (e.g., education records) | No | No | No |
| Inferences Drawn from Other Personal Information (e.g., profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudes) | No | No | No |
Sensitive Personal Information
The following table discloses the categories of sensitive personal information we have collected in the last twelve (12) months:
| Sensitive PI Category | Collected from Website | Collected from Users of Services | Collected from Partners |
|---|---|---|---|
| Identifiers (e.g., Social Security number, driver’s license, passport number) | No | No | No |
| Account Log-In or Financial Account Credentials | No | No | No |
| Precise Geolocation | No | No | Yes – precise geolocation data |
| Racial or Ethnic Origin, Religious or Philosophical Beliefs, Union Membership | No | No | No |
| Contents of Communications | No | No | No |
| Genetic Data | No | No | No |
| Biometric Data for Identification | No | No | No |
| Health Data | No | No | No |
| Sex Life or Sexual Orientation | No | No | No |
Disclosure for a Business Purpose
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose to our affiliates and service providers: Identifiers; Precise Geolocation Data; Internet or Network Activity; and Device User Agent Data. The following are categories of third parties to whom we have disclosed personal information for a business purpose: our affiliates and service providers.
Sale of Personal Information
Pine59 does not sell personal information and we provide only location insights products. Customers receive only aggregated, de-identified data products that cannot be used to identify individuals, households, or devices. The provision of our Services to Customers does not constitute a “sale” or “sharing” of personal information under applicable U.S. state privacy laws.
Use of Sensitive Personal Information
Precise geolocation data is classified as “sensitive personal information” under the CCPA and certain other U.S. state privacy laws. Pine59 uses precise geolocation data and pseudonymous device identifiers only as technical inputs to create, validate, and improve aggregated mobility statistics about groups, places, and time periods. We do not use this information to create or retain profiles, preferences, interests, behaviours, or other characteristics about individual consumers.
Device-level processing is limited to the technical steps needed to filter, validate, deduplicate, count, and aggregate signals. Device identifiers are used only where necessary for these steps. Pine59 does not create or retain persistent profiles of specific devices. Device-level intermediate data is deleted or aggregated after a short, defined period and cannot be searched or exported for commercial purposes.
Further, we do not use device-level data for targeting, advertising, or decisions about individuals. Customer outputs do not allow an individual, household, or device to be identified or singled out. These limits ensure that sensitive personal information is used only to produce and improve aggregated statistics, not to understand or act on individual consumers. Until the information has been aggregated, it remains personal information for purposes of the other rights and obligations described in this Policy.
6. Your Rights
Depending on where you live, you may have certain rights regarding your personal information under applicable privacy laws, including the CCPA and the GDPR. Subject to certain exceptions, you have the following rights:
Right to Know and Access. You may request the categories of personal information we have collected, sold, or disclosed for a business purpose in the preceding 12 months; the categories of sources; the business or commercial purposes for collecting; and the categories of third parties to whom we have disclosed personal information. You may also request a copy of the specific personal information we have collected about you in the preceding 12 months.
Right to Delete. You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., where retention is required to comply with legal obligations or detect security incidents).
Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
Right to Object. Where we process your personal information on the basis of legitimate interests, you may object to such processing. You also have the right to object to the processing of your personal information for direct marketing purposes.
Right to Data Portability. Where applicable, you may request that we provide your personal information in a structured, commonly used, and machine-readable format, and you may have the right to transmit that information to another controller.
Right to Opt-Out of Sale or Sharing. We do not sell or share your personal information, so an opt-out is not applicable to our current practices.
Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights.
If our processing of your personal information is subject to the GDPR, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or with the data protection authority in the EEA country where you habitually reside or work, or where you believe an infringement of the GDPR has occurred.
How to Exercise Your Rights
To exercise any of the rights described above, please contact us using the contact information provided in Section 13 (Contact Us).
We may need to request specific information from you to confirm your identity before processing your request. We will respond to your request within the timeframes required by applicable law.
You may authorize an agent to submit a request on your behalf, provided they have written permission signed by you. For access and deletion requests, we may require you to verify your identity directly with us.
If we decline to act on your request, you may appeal our decision by contacting privacy@pine59.com. We will inform you of the appeal process and outcome within the timeframes required by applicable law.
Shine the Light
California’s Shine the Light Law (Civil Code § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to third parties for direct marketing purposes. To make such a request, please contact us using the methods above.
7. Our Use of Cookies and Other Tracking Mechanisms
We and our third-party service providers may use cookies and other tracking technologies in our Services and on our Website to track information about your use of the Site. We may combine this information with other information we collect from you.
Cookies are small text files placed on your device through your web browser. We use session cookies, which are temporary cookies that expire when you close your browser and are used to identify you during a session and process transactions, and persistent cookies, which remain on your device after you close your browser and are used to track aggregate and statistical information about user activity.
We may also use clear GIFs (web beacons), pixel tags, and similar technologies to track user behaviour, manage content, and compile statistics. We and our service providers may also use these technologies in HTML emails to track response rates and email views.
Most browsers allow you to control cookies through their settings, including by blocking or deleting them. Some features of our Website or Services may not function properly if cookies are disabled.
We do not currently use third-party cookies for marketing or targeted advertising. If we introduce cookies or similar technologies that require consent under applicable law, we will obtain your consent before using them and provide an easy way for you to withdraw that consent.
8. Third-Party Links
Our Website may contain links to third-party websites. Access to and use of such linked websites is governed by the privacy policies of those third parties, not this Policy. We are not responsible for the information practices of third-party websites.
9. Security of Your Information
We have implemented appropriate organizational, technical, and physical safeguards to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction.
10. Privacy Choices
Location Data (Services)
Individuals who wish to limit the use of their precise geolocation data in our Services can disable location services on their mobile device. Because we receive location data from our Partners, we work with our Partners to ensure that your request takes effect in our active processing systems and data feeds. We do not receive data from our Partners about individuals who have opted out through the Partner’s own mechanisms. Your opt-out will be specific to the device for which you submit the request. If you use multiple devices, you will need to submit a request for each device. If you reset your mobile advertising ID, you will need to submit a new request.
Website - Cookie and Advertising Choices
We do not currently use third-party cookies for marketing or targeted advertising. For general information about interest-based advertising and to manage choices relating to participating advertising companies, you may use the Digital Advertising Alliance’s WebChoices tool if you are in the United States or the European Interactive Digital Advertising Alliance’s Your Online Choices service if you are in Europe. These third-party tools apply only to participating companies and do not block all advertising or cookies.
Website - Marketing Opt-Out
You may opt out of receiving promotional communications from us by following the opt-out instructions in our emails. It may take up to 10 business days to process your request. If you opt out of promotional emails, we may still send you emails about your account or services you have requested.
11. Retention
We retain personal information only as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law.
For location data used in our Services, we retain device-level location data only as long as necessary to produce, quality-assure, and improve our aggregated products. Device-level intermediate data is deleted or aggregated after a short, defined period.
For information collected from Users of Services and through our Website, we retain personal information for the period necessary to fulfill the business purposes described in this Policy, including providing services, administering accounts, resolving disputes, and enforcing agreements.
Our retention practices consider factors such as your relationship with Pine59, the nature of the information, compliance with legal obligations, and the defense of legal claims.
12. Children
Our Services are not designed for children under 16. If we discover that a child under 16 has provided us with personal information, we will delete such information from our systems.
13. Contact Us
If you have any comments, concerns, or questions about this Privacy Policy or our privacy practices, please email us at privacy@pine59.com or write to:
Pinetree Group AS
Attn: Privacy
Vardeheimveien 7 B
1088 Oslo
Norway
14. Changes to the Privacy Policy
This Policy is current as of the date set forth above. We will post any changes to this Policy on our Website. If we make material changes that affect our practices regarding information we have previously collected from you, we will provide notice by highlighting the change on our Site.
Transparency
Privacy Request Statistics
These metrics reflect privacy requests received from all individuals, regardless of jurisdiction, between January 1, 2025 and December 31, 2025.
Requests to opt-out or delete, received and complied with
0 denied
Requests for right to know or access, received and complied with
0 denied
Time to respond to consumer requests
Median
Mean
