How Vevsmia looks after your data.

Who is responsible?

Vevsmia, by Bjørn Sylte, is the data controller for the personal data collected through this website.

If you have questions about privacy, or want to exercise your rights, you can contact us at hei@vevsmia.no.

What data do we collect?

When you submit the contact form, we may receive data such as:

• your name
• the name of your business, if you give it
• your email address
• your phone number, if you give it
• which service or package you are interested in
• the content of your message

We may also process data you give us later by email or through other direct contact.

Please do not write sensitive personal data in the contact form.

Why do we process the data?

The data is used to answer your enquiry, assess what you need and, where relevant, prepare a quote or enter into an agreement.

The legal basis is normally GDPR Article 6(1)(b) – processing that is necessary before entering into, or in order to perform, a contract.

For other general enquiries, the basis may be our legitimate interest in communicating with people who contact Vevsmia, cf. Article 6(1)(f).

The contact form and email

The contact form is served from Vevsmia's own domain. There is no external form provider. When you submit the form, the data goes to an endpoint at Cloudflare, where it is checked and then passed on through Vevsmia's own email service to Mailjet, which delivers the message to our inbox.

Mailjet is part of Sinch, with data centres in Frankfurt and Belgium, and processes the data as a data processor under a standard data processing agreement. Cloudflare and Mailjet are the sub-processors involved in moving the message from the form to our inbox.

Vevsmia does not keep its own database copy of the form submission. The data is processed by Cloudflare and the email provider, and is then delivered to our inbox.

Bot protection and cookies

Vevsmia sets no non-essential cookies, and none at all until you have made a choice about analytics. The site uses first-party storage only: your analytics choice, and — if you consent — the Google Analytics cookies described below.

Your choice itself is stored locally in your browser under the name vevsmia-samtykke. The only things stored there are a version number, whether you said yes or no to analytics, and the date you made the choice. The value is never sent to us or to any third party, and it contains no identifier. This storage happens without consent because it is strictly necessary for exactly what you asked for — not being asked again — cf. the Norwegian Electronic Communications Act section 3-15, second paragraph.

To prevent automated submissions, the contact form uses Cloudflare Turnstile. Turnstile is only loaded once you start using the form. If you simply read the page without touching the contact form, nothing is stored in your browser, and your browser does not contact Cloudflare's bot protection service at all.

When you start filling in the form, Turnstile stores one technical value in your browser under the name cf.turnstile.u. The value belongs to Cloudflare's domain and is limited to use on this site — it cannot be read by other sites. It contains none of the information you have typed into the form.

As part of the bot check, Cloudflare receives your IP address, your browser's User-Agent and technical characteristics of the connection. Cloudflare uses this data to tell people from bots, and also to improve its own bot detection.

The basis for processing this data is our legitimate interest in protecting the contact form from misuse, cf. GDPR Article 6(1)(f). The storage takes place without consent because we consider it strictly necessary in order to provide the contact function you have asked for, cf. the Norwegian Electronic Communications Act section 3-15, second paragraph.

Statistics with Google Analytics

Vevsmia uses Google Analytics 4 to count visits and see how the site is used. Analytics is only switched on if you explicitly choose "Allow analytics". If you have not made a choice, or if you chose "Decline analytics", no script from Google is loaded, your browser does not contact Google, and no analytics cookies are set.

What the statistics are used for

The purpose is aggregated statistics: how many people visit the site, which pages and language versions they use, how far down the page they read, which outbound links they follow, and how many end up submitting the contact form. We use the statistics to improve the content and the structure of the site. We do not use them to track individuals, and we do not link them to the enquiries that come in.

The legal basis is your consent, cf. GDPR Article 6(1)(a) and the Norwegian Electronic Communications Act section 3-15.

What kind of data may be processed

• a randomly generated identifier stored in your browser, which distinguishes one browser from another
• your IP address, which Google uses to derive an approximate location — typically country or region
• technical data about your device: browser, operating system, screen size and language setting
• which pages you open, when, how long you stay and how far down you scroll
• which page you came from, and which outbound links you click
• the fact that a contact form submission was completed

The last item is a plain count. Name, email address, phone number, company name, package selection, message content and Turnstile data are never sent to Google. The event is only recorded after the submission has actually been confirmed as successful — not when you press the send button, and not if something goes wrong.

The cookies

If you consent, Google Analytics sets two first-party cookies on vevsmia.no: _ga and _ga_SMXJX65S4Z. They hold the random identifier and session data, and they last for up to two years from the last time they were updated. They belong to vevsmia.no and cannot be read by other sites.

No advertising measurement

Vevsmia does not do advertising measurement and does not use ad personalisation. Google Consent Mode is configured so that ad_storage, ad_user_data and ad_personalization remain "denied" at all times — including after you have said yes to analytics. We do not use Google Ads, Google Signals or other advertising products, and the data is not shared with advertising networks.

Google as a recipient

Google Ireland Limited is the data processor for the analytics data and processes it under Google's data processing terms for Google Analytics. Google may also process the data outside the EEA, including in the United States, through companies in the Google group. Google states that such transfers take place on the basis of the European Commission's Standard Contractual Clauses, and that Google LLC is certified under the EU–US Data Privacy Framework. You can read Google's own description in Google's privacy resource centre for businesses.

Event and user data in Google Analytics is retained for 14 months from the point at which it was recorded, and is then deleted automatically by Google. The retention period is not reset by new activity from the same browser, so nothing is kept for longer than 14 months because you came back. Aggregated report figures — the number of visits in a month, for example — are not covered by this limit, because they cannot be traced back to a single browser. The cookies in your browser last as described above, and are deleted the moment you withdraw your consent.

Settings that are not enabled

Google Analytics offers a number of features that widen what is collected or what it can be used for. These are switched off in Vevsmia's property:

• Google Signals — no linking to signed-in Google accounts and no cross-device tracking
• User-ID — Vevsmia sends no identifier of its own to Google
• User-provided data collection — no email addresses or phone numbers are sent to Google
• Granular location and device data collection — switched off for all regions
• Ads personalisation — switched off for all regions

This does not mean that Google processes no technical data at all. Coarse geographic location derived from the IP address — typically country or region — and ordinary browser and device information are still processed, as described above. What is switched off is the more detailed and more identifying versions of that collection.

How to withdraw your consent

You can reopen the settings at any time through the "Cookie settings" link at the bottom of every page, and choose "Decline analytics". Your consent is then set back to denied, the _ga cookies are deleted from your browser, and no further data is sent to Google. Withdrawing consent is meant to be just as easy as giving it.

Technical data

The provider that hosts the website may process technical data such as IP address, time, browser type and the page requested. This is done for security, stable operation and necessary troubleshooting.

How long do we keep the data?

We keep personal data only for as long as it is necessary for the purpose it was collected for.

Enquiries that do not lead to a customer relationship are normally deleted no later than 12 months after the last contact. If an agreement is entered into, relevant data may be kept for as long as the customer relationship lasts, and beyond that where statutory documentation requirements demand it.

Who has access to the data?

The data is not sold, and it is not used for unrelated marketing. Beyond Vevsmia itself, only the providers listed below are involved, and only as far as is necessary to deliver the service.

Cloudflare hosts the website and receives the form submission. As regards the content you write in the form, Cloudflare processes the data on our behalf and on our instructions.

For the bot check the picture is different. Cloudflare Turnstile processes certain technical signals — including IP address, User-Agent and characteristics of the connection — also for its own purposes, to detect bots and to improve its bot detection. For that part of the processing, Cloudflare is not acting solely as a provider on our behalf.

Mailjet, which is part of Sinch, is the email delivery provider and passes the message from the form on to us.

Google Ireland Limited receives analytics data as a data processor, but only if you have consented to analytics. If you have not consented, Google receives no data from this site.

Our email provider receives the message and stores it in our inbox, in the same way as ordinary email.

Your rights

You can, among other things, ask for:

• access to the data we hold about you
• correction of inaccurate or incomplete data
• erasure or restriction of the processing
• to object to processing based on legitimate interest
• to receive your data where the right to data portability applies

Contact hei@vevsmia.no if you want to exercise one of your rights.

Complaints to the Data Protection Authority

If you believe that Vevsmia processes your personal data contrary to the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Changes to this notice

This privacy notice may be updated if the website, our services or our routines change. The date at the top of the page shows when it was last updated.