Privacy Policy

This policy explains how Havdis AS (“Havdis”, “we”, “us”) handles personal data when you visit havdis.no or contact us through the website.

1. Who is responsible

The data controller is Havdis AS, org. no. 935 865 360, Thormøhlens gate 51, 5006 Bergen, Norway. Send any questions about privacy to mail@havdis.no. Havdis is not required to appoint a Data Protection Officer.

2. What we collect, why, and on what legal basis

When you browse the website

We do not use cookies, advertising trackers or social-media pixels on havdis.no. Fonts are served from our own domain, so your browser does not contact Google Fonts or other third parties when a page loads.

Our hosting provider, Vercel, automatically processes the technical data needed to deliver the website securely: your IP address, browser type, the page you asked for and the time of the request. This is based on our legitimate interest in running a secure, working website (GDPR Art. 6(1)(f)). These logs are kept for a short period under Vercel’s log retention and then deleted.

Measuring how the website is used

We measure how the website is used so that we can improve it, with Vercel Web Analytics. It counts page views. It does not set cookies and does not store personal data that identifies you. It records the page address (without any query string), the site you came from, and coarse technical details such as country, browser and device type. Our order pages are not measured. The legal basis is our legitimate interest in understanding how the website is used (Art. 6(1)(f)).

When you use the contact form

We collect:

• first name and last name
• email address
• subject and message, and anything you choose to write in it
• the date and time you sent it, and which of our web addresses you sent it from

We use this only to read and answer your enquiry and to follow up on the business conversation it starts. To stop spam, we limit how many messages can be sent per day. For this we store a one-way hash of your IP address combined with the date, together with a counter. We do not store your IP address in readable form alongside your message.

The legal basis is our legitimate interest in answering enquiries and protecting the form against abuse (Art. 6(1)(f)). Where your enquiry concerns a possible purchase or cooperation, the processing is also necessary to take steps at your request before entering into a contract (Art. 6(1)(b)).

Messages are deleted automatically 12 months after we receive them. If an enquiry leads to a customer or supplier relationship, the relevant correspondence is kept in our business records for that relationship. The spam-limit counters are deleted automatically after 7 days.

When you email or call us

If you email or phone us directly, we process your contact details and what you tell us for the same purpose and on the same basis as the contact form.

3. Who we share data with

We do not sell personal data, and we do not share it for marketing. We use these service providers to run the website and handle messages. They process data only on our instructions and under data processing agreements.

Where data is transferred outside the EU/EEA, the transfer is covered by the EU–US Data Privacy Framework (where the provider is certified) and/or the European Commission’s Standard Contractual Clauses. We may disclose personal data if the law requires it.

4. Your rights

You have the right to access, correct and delete the personal data we hold about you, to restrict our processing, to object to processing based on our legitimate interest, and to data portability where it applies. Email mail@havdis.no and we will answer within one month.

If you think we handle your data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet. We would appreciate the chance to sort it out with you first.

5. Security

Contact-form messages are stored in a database that is closed to public access and readable only by authorised Havdis staff. All traffic to and from the website is encrypted.

6. Children

The website is aimed at businesses. We do not knowingly collect data from children under 16.

7. Changes to this policy

We will update this page when the way we handle personal data changes. See also our Terms of Use.