This is a translation provided for convenience. The Norwegian version at ithappens.no/personvern is the legally binding text. If the two differ, the Norwegian text applies.
1. Who is the data controller
ithappens is operated by SillySanta AS, org. no. 916 896 050 MVA, Lilletorget 1, 0184 Oslo, Norway. SillySanta AS is the data controller for the personal data described here.
Contact for privacy matters: henrik@ithappens.no. We have not appointed a data protection officer, as the business does not fall within the requirement in GDPR Article 37.
2. What data we collect
The contact form
When you submit the form on ithappens.no, we process:
- Name, required
- Email address, required
- Company, optional
- Message, optional
- IP address, held briefly in memory to rate limit abuse of the form. It is not written to any database and is not included in the email we receive.
Visitor statistics
We use Vercel Web Analytics to see how many people visit the site and which pages they read. The service is cookie free, does not track you across websites, and does not build profiles. We receive aggregated numbers only, not data that identifies individual visitors.
The website sets no marketing cookies, and we use no ad networks, no tracking pixels and no chat widget.
3. Why we process the data, and on what lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering your enquiry and following up a possible agreement | Legitimate interest, GDPR Article 6(1)(f): responding to an enquiry you sent us yourself. Where an agreement is actually entered into: Article 6(1)(b). |
| Preventing abuse and spam through the form | Legitimate interest, Article 6(1)(f): secure operation of the website |
| Understanding use of the website at an aggregated level | Legitimate interest, Article 6(1)(f): improving the content |
We do not use your data for automated decision making or profiling, and we never sell it.
4. How long we keep it
- Enquiries that do not lead to a customer relationship: deleted no later than 24 months after the last contact.
- Enquiries that become a customer relationship: kept for as long as the agreement runs, and thereafter for as long as the Norwegian Bookkeeping Act requires (five years after the end of the financial year for documentation covered by it).
- IP address from the form: gone within 10 minutes.
5. Who the data is shared with
We do not share personal data with anyone other than the processors below, all of which process data on our behalf and under a data processing agreement.
| Processor | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosting of the website and visitor statistics | USA / global CDN |
| Microsoft Ireland Operations Ltd. | Email (Microsoft 365): receives and stores the enquiry | EU/EEA |
Otherwise we disclose data only where we are legally obliged to do so.
6. Transfers outside the EEA
Vercel Inc. is a United States company. The transfer takes place on the basis of the European Commission's Standard Contractual Clauses (SCCs), supplemented by Vercel's data processing agreement. The data affected is limited to ordinary visitor data and the content of the form you submit yourself.
7. Your rights
You have the right to:
- access the data we hold about you
- have inaccurate data corrected
- have data erased where we no longer have a basis for keeping it
- request that processing be restricted
- object to processing based on legitimate interest
- receive the data in a machine readable format (data portability)
Send an email to henrik@ithappens.no and we will answer within 30 days. It costs nothing.
If you believe we process your data in breach of the rules, you may complain to the Norwegian Data Protection Authority, Datatilsynet: datatilsynet.no. We would appreciate hearing about it first, so that we can put it right.
8. The return portal: an important boundary
This policy covers the ithappens.no website.
If you are a consumer with a question about your own return or warranty case, contact the shop you bought from. Do not contact ithappens. We cannot answer questions about your data, and we are not permitted to look it up for you or act on your request without the shop's instruction.
When a consumer registers a return or a warranty claim in the return portal, the online shop is the data controller for that data. ithappens is the processor, and processes the data solely on the shop's instructions, governed by a data processing agreement. The shop is the party that can give you access to your data, correct it or erase it.
For completeness: return data in the portal is stored within the EEA, in Stockholm, Sweden. Two supporting services run from the USA on the basis of Standard Contractual Clauses, namely customer email delivery (SendGrid) and administrator login for shop staff (Stytch). The details are on the security page.
If you are an online shop and need a data processing agreement, a sub-processor list or answers to a security questionnaire, you will find it on the security page.
9. Changes
If we change this policy, we update the date at the top. For material changes we notify active customers directly.