Who is responsible
EGENFORM GAARDER, Norwegian organisation number 838 405 282, registered business address c/o Hans Robert Cunanan Gaarder, Olav M. Troviks vei 28B, 0864 Oslo, Norway, is the data controller for information used to operate Egenform’s customer portal and customer relationships. Contact: [email protected].
This notice covers Egenform’s own websites at egenform.no and egenform.com and the customer portal. Customer websites may have their own notices. Where we handle website visitors’ information on a customer’s behalf, that customer will normally be the controller for that processing; the roles must be defined in the relevant agreement.
Information and purposes
| Information | Why we use it |
|---|---|
| Email, name, business name and account membership | Create accounts, verify sign-in, identify the correct customer and respond to enquiries. |
| Business needs, goal and selected features, offer summary, website address, project status, content and correspondence | Build, operate and support the ordered website. |
| Order, saved payment-method reference, authorisation for later charges, publication, subscription details, contract start, accepted terms version, cancellation and payment references | Administer the agreement and payments, and document agreed actions. |
| Invoice details and relevant business/tax information | Create accurate records and meet accounting and tax obligations. |
| Technical information such as IP address, request time, sign-in and error information | Deliver the website, limit abuse and investigate specific security or operational issues. |
Information comes from you, the business that gives you access, providers handling payments or sign-in, and public business and tax registers when we verify billing details. Stripe receives payment card details directly. Egenform’s portal does not store complete card numbers or card security codes. Please avoid sensitive personal information in free-text fields.
Lawful bases
We use information necessary to enter into or perform a contract with you (GDPR Article 6(1)(b)). If you represent a company that is the contracting party, necessary contact and account administration normally relies on our legitimate interest in managing that business relationship (Article 6(1)(f)). Security and necessary troubleshooting also rely on legitimate interests, balanced against your rights.
Accounting and other statutory duties rely on legal obligations (Article 6(1)(c)). Where a specific feature requires consent, we ask for it for that feature and you may withdraw it. Accepting subscription terms is not blanket consent to advertising or other uses of your personal information.
Providers and international transfers
We use these providers where the corresponding functions are enabled:
- Cloudflare provides website delivery, networking and traffic protection. Data processing terms.
- Supabase provides authentication and the customer database. Data processing terms.
- Resend sends sign-in codes and other service messages. Resend states that its primary processing takes place in the United States. Data processing terms.
- Stripe handles payments, invoicing and payment-fraud prevention. Stripe can act as a processor or an independent controller depending on the activity. Stripe privacy information.
- Google Workspace handles ordinary email correspondence with Egenform. Data processing terms.
Choosing a European customer-database region does not mean every item of information or every support activity stays within the EEA. Providers may use international infrastructure and subprocessors. Transfers outside the EEA must have a valid basis, such as an applicable adequacy decision or the EU Standard Contractual Clauses with necessary supplementary measures. Contact us for information about the relevant recipients, countries and safeguards.
We may also disclose necessary information to an accountant or public authorities where there is an appropriate lawful reason. We do not sell portal users’ personal information.
Cookies and local storage
The customer portal uses necessary cookies for a secure sign-in session: __Host-egenform_session for up to seven days and __Host-egenform_challenge for up to ten minutes during sign-in. They are sent only over HTTPS, belong to the current domain and cannot be read by ordinary page JavaScript. Signing in on .no does not transfer a sign-in cookie to .com. Your browser may also receive necessary security storage from Cloudflare and from Stripe when you visit checkout or the billing portal.
The portal module does not add analytics tools or advertising pixels. If optional tracking is introduced later, we must explain it and provide a valid choice before it starts. You can remove cookies using your browser settings; doing so may require you to sign in again.
How long information is kept
We keep account and project information while needed for an active customer relationship and for necessary, reasonable follow-up. When its purpose ends, it is deleted or anonymised unless a specific lawful reason to retain it still applies. A deletion request triggers a review of what can be deleted now and what must remain, with an explanation.
Invoices and other primary accounting records normally have to be retained for five years after the end of the relevant financial year. Some contracts and supporting records have separate retention requirements. Information needed to establish, exercise or defend a specific legal claim may remain while that need exists. These requirements do not justify retaining all information indefinitely.
Technical logs, backups and provider-held data follow the actual settings and limitations of the relevant services. Retention must be limited to what is necessary. Deleting information from the active database is not a promise that every backup held by every provider is overwritten at the same instant. Ask us for current retention periods if you need further details.
Your rights and account deletion
You can request access, correction, deletion, restriction and, where the conditions apply, data portability. You can object to processing based on legitimate interests. The portal’s export function gives you a copy of your own portal data; contact us for a broader access request.
Submit a deletion request in the portal or email [email protected]. We respond without undue delay and normally within one month. If the law allows an extension because a request is particularly complex or extensive, we explain this within the first month. We may need to verify your identity.
Active services can mean some information remains necessary. We explain what is retained and why, and delete what is no longer needed. Account deletion, subscription cancellation and website deletion or unpublishing are separate actions; we clarify the consequences with you. You can complain to Datatilsynet, the Norwegian Data Protection Authority, or your local data protection authority.
Security and updates
We limit access according to work needs, check customer ownership of records and use encrypted transmission. No online system can be guaranteed free of risk. Tell us if you discover a potential security issue. The portal does not itself provide automated decisions producing legal or similarly significant effects; Stripe may apply its own payment-security checks.
We update this notice when processing or relevant requirements change. Significant changes should be made clear. The date and version appear on this page.