Privacy policy

Controller

Vitoma AS, [Organisation number missing], Sørflåtveien 59, 4018 Stavanger. Privacy questions go to post@vitoma.no.

What we use the data for, and why

• Deliver goods and follow up the order (name, email, phone, delivery address, order history). Legal basis: contract (GDPR art. 6(1)(b)).
• Run your customer account, including login and email verification. Legal basis: contract.
• Answer inquiries and delivery inquiries. Legal basis: contract or legitimate interest (art. 6(1)(f)).
• Bookkeeping of sales. Legal basis: legal obligation (Norwegian Bookkeeping Act, art. 6(1)(c)).
• Checking business customers against the Business Register and approving invoice purchases. Legal basis: legitimate interest (credit risk and fraud prevention).
• Offers by email, only if you said yes. Legal basis: consent (art. 6(1)(a)). You can withdraw it under My account.
• Security and preventing abuse, for example login attempts. Legal basis: legitimate interest.

Categories of data

Contact details, addresses, order and payment status, customer type and organisation number for businesses, time of consent, login data (passwords are stored only as an encrypted hash) and technical information such as IP address in server logs. We do not store card numbers. The payment provider handles the payment.

Who we share data with

They process the data on our behalf or by law and are bound by data processing agreements where required. We do not sell your data and do not use it for advertising.

• Tripletex (accounting and order management) when the accounting link is active.
• The payment provider for Vipps and card when online payment is opened.
• Microsoft (email service) which sends order confirmations and other messages.
• Serve the World (web hosting and server operation).
• The Brønnøysund Register Centre, where we look up organisation numbers. We send only the number.
• The carrier or driver, who receives name, address and phone to deliver.
• Public authorities when the law requires it.

Transfers outside the EEA

We do not transfer data to countries outside the EEA, except where a supplier uses sub-processors there. Then it happens only with a valid transfer basis, such as the EU standard contractual clauses or an adequacy decision.

How long we keep it

• Customer account: as long as you have it. When you delete the account, the personal data is removed.
• Orders and bookkeeping records: 5 years after the end of the financial year, under the Bookkeeping Act. Orders are unlinked from you when you delete the account.
• Inquiries: until the matter is resolved, normally no longer than 2 years.
• Server logs: a short time, normally a few weeks.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and to object. Under My account, Data and privacy, you can download all your data and delete the account yourself. For other requests contact post@vitoma.no. We reply within one month.

You can complain to the Norwegian Data Protection Authority (datatilsynet.no) if you believe we process the data in breach of the rules.

Cookies and tracking

We only use necessary cookies for the cart, login and language. We use no tracking, analytics or advertising. See cookies.