Privacy policy

How to reach us

Use the contact form on this website, or write to the business address above. Privacy enquiries are answered like everything else: without undue delay, and within one month at the latest.

You can also email us at post@kodebruket.no.

The contact form

When you submit the contact form, we process your name, email address, optionally your phone number and organisation, and the content of your message. We use this to reply to you – and, where the enquiry concerns a possible project, to prepare an agreement.

The legal basis is our legitimate interest in answering enquiries (GDPR Article 6(1)(f)), and steps taken prior to entering into a contract where relevant (Article 6(1)(b)).

Your message is sent to us by email via Brevo and stored as an enquiry in our workspace, on our server at Hetzner in Helsinki (Finland). The content is not written to any log. The email and the enquiry are deleted no later than 12 months after the last activity on the matter, unless the enquiry has become a client relationship with its own retention requirements. If we have agreed with you to get back in touch later, they are deleted three months after the agreed date.

Brevo keeps a sending log with the time, subject, sender, recipient and reply-to address – that is, your name and email address. Our Brevo account is set to delete this log after one month and not to keep the message text itself.

To stop abuse, the server counts submissions per IP address in memory for about an hour. You receive a confirmation by email via Brevo, and to limit abuse the server keeps a checksum of your email address in memory for about an hour. The legal basis is our legitimate interest in protecting the form against abuse (Article 6(1)(f)). The IP address is not written to disk or to a log.

Server logs

The web server keeps a technical log of the time, the requested address and the status code. Your IP address is not stored in the log. The log is used for operations and troubleshooting, is deleted automatically after 14 days, and rests on our legitimate interest in running the website securely.

Who we share data with

Hetzner Online GmbH hosts the server (Germany/Finland, within the EEA). Domene AS, a Norwegian company, hosts the mailbox that receives enquiries.

Brevo (Sendinblue SAS, Paris) delivers the email from the contact form to us. Brevo stores the data in the EU, but some of Brevo’s sub-processors and group companies outside the EEA, including in the USA and India, may process or access it – for example in connection with network traffic, operations and customer support. Such transfers rest on the European Commission’s standard contractual clauses and, for certain US providers, the EU–U.S. Data Privacy Framework. The sub-processors and safeguards are listed in Brevo’s data processing agreement, Appendix 3 to the terms at https://www.brevo.com/legal/termsofuse/.

The providers process data on our behalf, as data processors. The exception is that Brevo also uses some data about each sending for its own purposes, including preventing spam and abuse of its service. We do not sell data, and we do not use it for profiling or ad targeting.

Your rights

You can request access to the data we hold about you, have it corrected or deleted, demand that processing be restricted, object to it, and ask to have the data handed over (data portability). We reply without undue delay and within one month at the latest.

If you believe the processing breaches the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet).