Privacy policy

1. Who is responsible

Nordic Productions Hansen (org. no. 920 421 350 MVA), a sole proprietorship owned by Jørn Otto Hansen, is the controller for the personal data processed on nordicproductions.no and in the shop.

Address: Kulturveien 3598, 8100 Misvær, Norway
Email: post@nptv.no
Phone: +47 958 59 628

We don't have a data protection officer. Send privacy questions to the email address above.

2. When you visit the website

Data: IP address, browser and device, the page you request, the time, and the page you came from.
Source: Your browser sends it automatically.
Purpose: To show you the website and protect it from attacks and abuse.
Legal basis: Legitimate interest (GDPR article 6(1)(f)). The interest is running a secure and stable website.
Recipients: Cloudflare, which hosts the website for us (processor).
Retention: We don't keep a visitor log ourselves. Cloudflare uses the data briefly for operations and security. Error messages from the shop are kept at Cloudflare for up to 7 days. They contain no names, addresses or contact details.

3. When you buy something in the shop

Data: Name, email address, mobile number and delivery address. Which items, colours and sizes you buy, the price, delivery option and shipping cost. The order reference and payment status from Vipps, and the tracking link from the carrier. We don't receive your card details.
Source: Vipps, after you have agreed in the Vipps app that Vipps shares your name, email address, mobile number and address with us. The items come from your cart or the product page.
Purpose: To carry out the purchase: make and deliver the item, charge you when it ships, handle withdrawals, complaints and questions about the order, and keep accounts.
Legal basis: Contract (article 6(1)(b)) to carry out the purchase. Legal obligation (article 6(1)(c)) under the Norwegian Bookkeeping Act for accounting records.
Do you have to provide it?: To buy, yes: without a name, address and contact details we can't deliver the item.
Recipients: Vipps MobilePay AS processes the payment and is itself the controller for its part of it. Gelato and the print partner that makes your item receive your name, address, email address and mobile number to produce and ship it (processors). With the order we also send Vipps's customer ID for you, a code without your name. The carrier (for example Posten, Helthjem or DHL) receives the same to deliver the parcel and notify you by text message or email.
Retention: Your name, address, email address and mobile number are not stored in our own database. They go from Vipps to Gelato when the order is created, and stay in the order history of our Gelato account for as long as we need them to handle complaints: normally 2 years after delivery, or 5 years for items meant to last substantially longer. The order details in our database (reference, items, amounts, delivery option, status, tracking link and timestamps) and accounting records are kept for 5 years after the end of the financial year, as the Bookkeeping Act requires.

Your cart is only stored in your browser (see section 7) and is sent to us only when you go to payment.

4. When you contact us

Data: Name, email address, subject and message, and anything else you choose to write. If you send an order inquiry from the cart, the items, colours and sizes are included.
Source: You, through the contact form or email.
Purpose: To answer you and follow up on your inquiry.
Legal basis: Legitimate interest (article 6(1)(f)) in answering inquiries. If the inquiry is about a purchase or an agreement you want to enter into, the basis is contract (article 6(1)(b)).
Do you have to provide it?: No, contacting us is voluntary, but without an email address we can't reply.
Recipients: Web3Forms (Web3Creative) receives the contact form and forwards it to our email. Domeneshop AS runs our email in Norway. Both are processors.
Retention: We delete inquiries when the matter is closed, and no later than 12 months after the last contact. If an inquiry becomes part of an agreement or the accounts, it is kept for 5 years after the end of the financial year. Web3Forms may keep a copy of the form for a limited period under its own terms.

The contact page shows whether Jørn Otto Hansen is online on Discord. Your browser fetches the status from the Lanyard service (api.lanyard.rest), which then sees your IP address. We receive no data about you from this.

5. Embedded videos

Some articles have embedded videos from YouTube, Vimeo or TikTok. When you scroll to a video, your browser loads the player from the service, which then receives your IP address and information about your browser. YouTube videos are shown via youtube-nocookie.com, which sets no cookies until you play the video, and Vimeo videos are set up without tracking. TikTok may set its own cookies. The services process the data under their own privacy policies.

6. Affiliate links

Some links and product cards in articles are affiliate links, marked [AD]. They take you to an online shop, such as AliExpress, with a code that earns us a small commission if you buy something. We don't receive your name or contact details; the shop only reports the order and the commission. When you arrive at the shop, it may set its own cookies under its own privacy policy.

7. Cookies and local storage

We only use cookies and local storage that the website needs to work, so they don't require consent (section 3-15 of the Norwegian Electronic Communications Act). We don't use analytics or advertising cookies. If we start using analytics later, we will ask for consent first and update this policy. You can see and change your choice under "Cookies" at the bottom of the page.

Name	Set by	Purpose	Duration
`cc_cookie`	This website	Remembers your choice in the cookie banner	6 months
`np-cart` (local storage)	This website	Remembers your cart. Stays in your browser	Until you empty the cart or clear your browser data
`np-lang` (local storage)	This website	Remembers the language you picked with the flags, so you aren't sent to the Norwegian version once you've chosen English	Until you clear your browser data
`__cf_bm`	Cloudflare	Tells people from bots to protect the website. Only set when needed	30 minutes

8. Transfers outside the EU/EEA

Cloudflare, Inc. and Web3Forms may process data in the United States and other countries outside the EU/EEA. Cloudflare is certified under the EU–US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection, and otherwise uses the Commission's standard contractual clauses (article 46). Web3Forms bases its transfers on standard contractual clauses. You can get a copy of the safeguards by contacting us.

Vipps MobilePay AS, Gelato and Domeneshop AS are Norwegian companies. The print partner and carrier that handle your parcel are in Norway or another European country.

9. Your rights

You have the right to:

access the data we hold about you, and get a copy
have incorrect or incomplete data corrected
have data deleted when we no longer need it or have no basis for keeping it
ask us to restrict processing, for example while we check whether data is correct
receive the data about your purchase in a machine-readable format (data portability)
withdraw consent you have given, for example to cookies

Your right to object

Where we process data about you based on legitimate interest (sections 2 and 4), you can object at any time on grounds relating to your particular situation. We then stop the processing, unless we have compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend a legal claim.

Email post@nptv.no to use your rights. It's free. We reply without undue delay and within one month at the latest, and may ask you to confirm who you are. If there is something we can't delete, such as accounting records, we'll tell you.

We make no decisions about you based solely on automated processing, and we don't build profiles.

10. Complaints to Datatilsynet

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no. Feel free to contact us first, so we can try to put it right.

11. Security

The website uses an encrypted connection (HTTPS). The shop's database stores no names, addresses or contact details. The keys to Vipps and Gelato are stored encrypted at Cloudflare, and only the owner has access to the accounts with our providers. We have data processing agreements with the providers that process data for us.

12. Changes and language

We update this policy when the processing changes, and the date at the top shows when it last changed. We announce material changes clearly on the website before they take effect.

This privacy policy is written in Norwegian and translated into English. If the Norwegian and English versions differ, the Norwegian version prevails.

In short