Effective 2 November 2026

Privacy at Lab205

Lab205 (app.lab205.com) is the tool the teams, companies and partners at Raveien 205 use to plan work, log hours and report. This page explains what we store about you, why, who can see it and what your rights are.

Who is responsible

Each company is the controller for the data in its own projects and about its own employees: Qrlay AS, qbShield AS, ComSec Halo AS and Mimir Labs AS (and any new companies that join). If you are employed by a supplier (for example Aeger Group AS, Nxtech AS, TogetherTech AB or Trebjønn AS), your employer is responsible for what is sent to them. The platform is run by Lab205 on behalf of the companies.

Contact: post@lab205.com.

What we store

• Who you are: name, email, employer, role, language, which projects you are part of, and your Lab205 address if you have one.
• Login and security: login sessions (14 days), IP address and browser at login, an encrypted two-factor key, and an audit log of what was done and by whom.
• Work: hours per day and task, work package, a short description of what you did, submission, approval, quarterly sign-off and later corrections (with the reason).
• Canteen and expenses: days you ate in the canteen (only if you pay for the canteen), and expenses with receipts.
• Monthly reports you send to the accountant or your employer.

We do not store health information, and we ask you not to write any anywhere in Lab205.

Why

• R&D accounts (SkatteFUNN): hours must be logged continuously per person and day, stating which sub-goal the work relates to, and signed every quarter. This is required for the tax deduction and is documentation the companies must keep (legal obligation).
• Pay and invoicing: hours, canteen days and expenses are used for salary, refunds and invoices between supplier and client (contract).
• Canteen: your own payment is documented so the meal is not a taxable benefit (legal obligation).
• Security and traceability: login data and the audit log protect your account and show that the accounts have not been changed without a trace (legitimate interest).

Who sees what

• You see everything about yourself.
• The project lead in the company sees your hours in their project in order to approve them.
• Owners (board and CEO of the company that owns the project) see the project's hours, costs and progress — read only.
• Your employer / accountant sees your hours, canteen days, expenses and monthly reports — not anyone else's.
• The adviser and auditor receive the R&D workbook when the company sends it.

My panel shows your own rhythm against an anonymous team average. We do not rank people or use hours as a competition or to monitor individuals.

Follow-up (e.g. wage subsidy from NAV)

A few employees have an agreed follow-up, for example under a wage subsidy. In that case the following also applies:

• The follow-up is a closed part of Lab205. Only the person who created it (Christian Warhuus) can write assessments and give others access.
• The employee is shown with a pseudonym to everyone except the supervisor and themselves.
• Each week we record: meetings held, training given, whether the weekly report was delivered and satisfactory, how the work is going, work-related incidents, the supervisor's assessment and the employee's own comment.
• Every 14 days a status report is sent to the NAV adviser who agreed the follow-up. The report contains no project content and no health information.
• The employee sees everything that is written and sent, and can comment every week.
• The basis is the agreement on the measure between NAV, the employer and the employee.

Where and for how long

The data is stored on a dedicated server at Hostinger, with daily backups. R&D accounts, timesheets, vouchers and invoice bases are kept as long as accounting rules require (as a rule five years after the end of the financial year). Login links are deleted after use, sessions after 14 days. Follow-up data is deleted or anonymised when the measure has ended and it is no longer needed, at the latest one year later.

Your rights

You can ask for access, correction, deletion (as far as accounting rules allow), restriction, and you can object. Email post@lab205.com. If you believe we process data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.