Privacy Policy

1. Controller Identity

The data controller responsible for processing your personal data is:

2. Data We Collect

We collect personal data only when you interact with our website. The categories of data we may collect include:

• Identity data: first and last name.
• Contact data: email address, telephone number, delivery address.
• Transaction data: details about purchases or orders placed.
• Technical data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology identifiers on the devices you use to access this website.
• Usage data: information about how you use our website.
• Communications data: content of messages you send us through contact forms.

We do not knowingly collect data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR) (EU) 2016/679, as implemented through Norwegian law (Personopplysningsloven):

• Contract performance (Article 6(1)(b)): processing necessary to fulfill an order you have placed or to take steps at your request prior to placing an order.
• Legal obligation (Article 6(1)(c)): processing necessary to comply with applicable Norwegian and EU legal obligations.
• Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate business interests, such as fraud prevention and improving our website, provided these interests are not overridden by your rights.
• Consent (Article 6(1)(a)): for non-essential cookies and marketing communications, where you have provided explicit consent.

4. Purposes of Processing

We use your personal data for the following purposes:

• Processing and fulfilling your orders and managing payments, fees, and charges.
• Managing our relationship with you, including notifying you about changes to our terms or policies.
• Responding to inquiries and providing customer support.
• Administering and improving our website and services.
• Complying with legal and regulatory requirements.
• Preventing and detecting fraud and other unlawful activities.
• Sending promotional communications where you have opted in or we have a legitimate interest, always with the right to opt out at any time.

5. Data Retention

We retain your personal data for no longer than is necessary for the purposes for which it was collected:

• Order and transaction data: 5 years, in accordance with Norwegian accounting legislation (Bokføringsloven).
• Contact form submissions: up to 12 months, unless required for an ongoing matter.
• Technical / analytics data: up to 26 months, in anonymized or aggregated form where possible.
• Marketing consent records: until consent is withdrawn, plus 3 years thereafter for compliance documentation.

6. Sharing of Your Data

We do not sell your personal data. We may share your data with trusted third parties only where necessary:

• Delivery and logistics providers: to fulfill your order.
• Payment processors: to process payment transactions securely.
• IT service providers: for website hosting, email delivery, and analytics.
• Legal and regulatory authorities: where required by law.

All third-party processors are subject to data processing agreements that require them to protect your data and process it only for specified, lawful purposes.

7. International Transfers

Where data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or that the recipient country benefits from an EU adequacy decision.

8. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15): the right to obtain confirmation of whether we process data about you and, if so, to receive a copy.
• Right to rectification (Article 16): the right to request correction of inaccurate or incomplete data.
• Right to erasure (Article 17): the right to request deletion of your data, subject to legal obligations that require retention.
• Right to restriction (Article 18): the right to request that we limit processing in certain circumstances.
• Right to data portability (Article 20): the right to receive your data in a structured, machine-readable format.
• Right to object (Article 21): the right to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet): www.datatilsynet.no.

9. Cookies

Our website uses cookies. For full details about which cookies we use, why, and how to manage them, please see our Cookie Policy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. All data transmitted to and from our website is encrypted using TLS (HTTPS). Access to personal data is restricted to staff who need it to perform their duties.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acceptance of the updated policy.

12. Contact

For any questions or requests regarding this policy or your personal data, please contact us: