Privacy policy

Controller

PAINTZ AS, org. no. 934 310 659 MVA, registered in the Norwegian Register of Business Enterprises (Foretaksregisteret). Innspurten 10B, 0663 Oslo, Norway. post@paintz.no, +47 463 07 132.

Privacy questions: post@paintz.no.

What we process, why and on what basis

Customer account and orders: name, e-mail, phone and role of contact persons and users, the company details from the Brønnøysund register, delivery addresses, orders, references and notes. The purpose is to give access to the shop, deliver the goods and look after the customer relationship. Basis: legitimate interest in performing the contract with the company (GDPR Art. 6(1)(f)).

Invoicing and accounting: orders and invoice details. Basis: legal obligation under the Bookkeeping Act (Art. 6(1)(c)).

Traceability and recalls: which lot numbers went to which customer. Basis: legal obligation under the Food Act and Regulation (EC) No 178/2002 Art. 18 (Art. 6(1)(c)).

Security: login codes and sessions are stored only as hashes. IP address and time are logged at login, sign-up, orders and changes, and used to limit abuse. Basis: legitimate interest (Art. 6(1)(f)).

Messages about the customer relationship by e-mail (new prices, new terms, recalls, holidays): to the invoice e-mail and the users, in Norwegian or English after the language you use in the shop. We keep the message and when it was sent to whom, as proof. Basis: legitimate interest (Art. 6(1)(f)), and legal obligation for recalls (Art. 6(1)(c)).

News by e-mail: only if you ticked the box. Basis: consent (Art. 6(1)(a) and the Marketing Control Act section 15). You can unsubscribe at any time under My account or with the link at the bottom of every e-mail.

The gallery on Paint the glass: when you share a painted glass, we store the picture, the strokes, the colours and, if you write them, name, workplace and city. We store a hash of the IP address (not the address itself) to stop abuse. Nothing is shown before we approve it. Basis: consent to show the picture with name, workplace and city (Art. 6(1)(a)), legitimate interest for the hash (Art. 6(1)(f)). Write to post@paintz.no and we delete it.

Supplier invoices (office only): invoices from suppliers may contain names of contact persons. We use AI to read amounts and lines (Cloudflare Workers AI, or Anthropic when switched on), and a person always checks the result. Basis: legal obligation (bookkeeping) and legitimate interest (Art. 6(1)(c) and (f)).

Recipients and processors

Cloudflare: hosting of the website and the office, database and security. Processor.

Resend: sends e-mail from the shop and the office (login codes, order confirmations, messages). The e-mail is sent from the EU (Ireland). Processor.

Tripletex: invoicing and accounting. Processor.

Our accountant and our bank: accounting and payments.

Posten/Bring: name, address and phone for delivery.

Domeneshop: our e-mail accounts (@paintz.no). Processor.

Anthropic: may read supplier invoices in the office when switched on (today Cloudflare reads them). Processor. No customer data from the shop is sent there.

The push service of our phones (Apple, or Google on Android): delivers short notices about orders and visits to our own phones. The notice is encrypted, so the service cannot read it.

The Brønnøysund register: we send the search (name or org. number) when you register your company.

Public authorities when the law requires it, for example the Tax Administration and the Food Safety Authority.

Collaboration products (BRUSH)

BRUSH is sold and invoiced by Cold Pressed AS (org. no. 920 401 899). When you order BRUSH, we create a secure link to the order. Only the link is sent by e-mail, without customer data.

Before Cold Pressed AS sees the details, they must accept a data sharing agreement (version 1.0). We log the name, time and version. They then see the company name, org. number, invoice address or EHF, contact person with e-mail and phone, delivery address and the items with prices incl. VAT.

Cold Pressed AS is an independent controller for its invoicing and customer service. The link stops working after 30 days. Basis: legitimate interest in carrying out the order (Art. 6(1)(f)).

Transfers outside the EEA

Cloudflare, Resend and Anthropic are US companies. Transfers to the US use the European Commission’s Standard Contractual Clauses (SCCs). Cloudflare is also certified under the EU-US Data Privacy Framework.

Notices to our phones pass through Apple or Google, but are encrypted so that only the phone can read them.

Retention

Accounting records: 5 years after the end of the financial year (Bookkeeping Act), in Tripletex.

Orders in the shop: 5 years after the end of the financial year. Then we remove the contact person, phone and note from the order. The figures stay.

Accounts not used for 3 years are deleted or anonymised.

Statistics and the cookie banner choice: 13 months. Security logs: IP addresses and logins 12 months, attempt counters 2 days. Who changed what and when: 5 years.

Login codes: 10 minutes. Sessions: up to 30 days. Collaboration links: 30 days.

Pictures in the gallery: until deleted, by us or when you ask.

Cookies

Necessary cookies (login, cart, promo code, language and theme) need no consent. We use no marketing cookies. Full list: paintz.no/cookies.

Statistics and heatmaps

Only if you say yes in the banner. We measure page views, clicks, how far you scroll and how long you look at each part of a page. We also store country and city, device type, browser and operating system, and your customer ID if you are logged in.

We may also get a short notice on our own phones when you visit: city, country, device, first page and the website you came from. If you are logged in, we see the company name and what is in the cart. At most one notice of each kind per visit.

We do not store your IP address, the full browser string or anything you type into forms.

Legal basis: consent (GDPR Art. 6(1)(a) and the Electronic Communications Act section 3-15). The data is kept in our own database at Cloudflare (processor) and deleted after 13 months. No scripts from others.

You can withdraw consent at any time under "Cookies" at the bottom of the page. Measuring stops at once, and the data linked to your ID is deleted.

Your rights

You may request access, rectification, erasure, restriction and data portability, and object to processing. Write to post@paintz.no. We answer within 30 days.

Delete your account yourself under "Delete account" on My account. We delete it within 30 days: names, e-mails, phone numbers, logins, addresses and consents. We keep orders and invoice records for 5 years under the Bookkeeping Act, and the log of notices we sent, as proof.

You may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).