Privacy Policy
This policy explains how Permafrost Design AS processes personal data when you visit permafrost.no, shop in our webshop, contact us or subscribe to our newsletter. Last updated: 19 October 2026.
1. Who is responsible
The controller is Permafrost Design AS, org. no. 981 311 418 MVA, St. Halvards Gate 33A, 0192 Oslo, Norway. For questions about your personal data, write to mail@permafrost.no or call +47 23 24 04 50. “We” below means Permafrost Design AS. We follow the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).
2. What we process, why, and on what basis
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Orders and delivery: handling your order, payment, shipping, returns and complaints | Name, address, e-mail, telephone number, order details, payment status, IP address at ordering, communication with you | Contract (GDPR art. 6(1)(b)) | Until the order is completed and any complaint or return period has ended |
| Accounting and legal obligations | Order and payment records, invoices | Legal obligation (art. 6(1)(c)), the Norwegian Bookkeeping Act | 5 years after the end of the financial year, as the law requires |
| Customer account (optional) | Name, e-mail, address, order history, password (stored encrypted) | Contract (art. 6(1)(b)) | Until you ask us to delete the account |
| Contact form and e-mail inquiries | Name, e-mail, your message | Our legitimate interest in answering you (art. 6(1)(f)), or steps before a contract (art. 6(1)(b)) | As long as needed to handle the inquiry and follow-up, normally no more than 24 months |
| Newsletter | E-mail address, name if given, subscription status, whether you open and click our e-mails | Your consent (art. 6(1)(a)); you can unsubscribe at any time | Until you unsubscribe |
| Security and spam protection: protecting the forms and the shop against abuse | IP address, browser data, the result of a Cloudflare Turnstile check | Legitimate interest in security (art. 6(1)(f)) | Short-term technical logs |
| Statistics: understanding how the site is used | Pseudonymous usage data through Google Analytics (pages viewed, source, device, approximate location) | Your consent (art. 6(1)(a)), only if you accept analytics cookies | Up to 14 months (retention setting in Google Analytics) |
Providing the information needed for an order is necessary for us to be able to deliver it. Everything else is voluntary. We do not make decisions based solely on automated processing, and we do not profile you. We do not sell your personal data.
3. Who receives your data
We share data only when it is necessary, and with processors who are bound by data processing agreements:
- Payment providers: Stripe (card and wallet payments) and Vipps MobilePay AS (Vipps). They receive the information needed to carry out the payment. They are also independent controllers for their own compliance and fraud-prevention duties. Card numbers are never stored by us.
- Carriers: Posten Norge and other carriers receive your name, address, telephone number and e-mail address to deliver the parcel.
- Google (Google Analytics), only if you accept analytics cookies.
- Cloudflare (Turnstile spam protection on forms).
- Technical providers: our web host, Amazon Web Services (Amazon SES) for sending e-mail, and our accounting and invoicing providers.
- Authorities, where we are required by law, such as tax authorities.
4. Transfers outside the EEA
Some of the providers above (for example Google, Stripe and Amazon) may process data in the USA or other countries outside the EEA. Where that happens, the transfer is based on an adequacy decision (such as the EU–US Data Privacy Framework) or on the EU Commission’s standard contractual clauses and supplementary safeguards.
5. Your rights
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to processing, and to receive your data in a portable format. Where processing is based on consent, you can withdraw it at any time, without affecting earlier processing. To use your rights, contact us at mail@permafrost.no; we reply within one month. If you believe we process your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or to the authority in the country where you live.
6. Cookies and similar technologies
Cookies are small text files stored on your device. We use two kinds.
Necessary cookies make the shop work and are set without consent: they keep your cart and your login, protect forms and checkout, and carry out payments. They are normally set only when you use the cart, checkout or log in.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | permafrost.no (WooCommerce) | Cart and checkout | Session, up to 2 days |
| wordpress_logged_in_*, wordpress_sec_*, wp-settings-* | permafrost.no | Login to customer account | Session, up to 14 days |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention and secure payment | 1 year / 30 minutes |
| Turnstile check data | Cloudflare | Spam protection on forms | Session |
| pf_samtykke, pf-tema (browser storage) | permafrost.no | Remembers your cookie choice and light/dark mode | Until you clear your browser data |
Analytics cookies are set only if you click “Accept” in the cookie notice. We use Google Analytics to see, in aggregate, how the site is used and how visitors find us.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga, _ga_1C5NP270SG | Google Analytics | Distinguishes visitors and sessions for statistics | 2 years |
If you decline, nothing from Google is loaded or stored. You can change your choice at any time with Cookie settings (also in the footer of every page); declining also removes the Google cookies. You can also delete cookies in your browser settings.
7. Newsletter
We send our newsletter only to people who have subscribed and ticked the box to give their consent. Every newsletter has an unsubscribe link. If you are an existing customer, we may also e-mail you about similar products, and you can object at any time. E-mails are sent through Amazon SES.
8. Children
Our shop is meant for adults. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.
9. Notice for residents of California and other US states
We collect the categories of personal information described in section 2 for the business purposes described there. We do not sell personal information and do not share it for cross-context behavioural advertising. Depending on your state, you may have the right to know, access, correct and delete your personal information and not to be discriminated against for using these rights. Contact us at mail@permafrost.no to use them.
10. Changes to this policy
We update this policy when our processing changes. The current version is always on this page, with the date it was last updated at the top.