Privacy policy

We only process data that is necessary for what we offer: • Contact details and inquiries via the booking form (name, email, company name, phone, free text and answers to questions about your project). • Reviews from clients who submit feedback via an invitation link (name, company, role, quote, rating and any additional details you choose to provide). • Technical data when visiting the website (e.g. IP address, browser type, time and pages you visit), in particular when you have consented to statistics, see the section on cookies. • Your cookie choice is stored locally in your browser so that we remember your consent.

We use the data for the following purposes: • Responding to inquiries and carrying out dialogue before and during an engagement (legal basis: entering into a contract and legitimate interest). • Managing and following up client reviews you have submitted with consent (legal basis: consent and legitimate interest). • Operating, securing and improving the website, including anonymous statistics when you have accepted optional cookies (legal basis: consent or legitimate interest, depending on the type of data). • Meeting legal requirements, e.g. bookkeeping and documentation where applicable (legal basis: legal obligation). We do not process personal data for purposes incompatible with what you were informed of when you gave us the data.

We do not sell personal data. Data may be shared with trusted providers who process data on our behalf: • Sanity.io: storage of content and form submissions (CMS/database). • Vercel: hosting and technical operation of the website, including Vercel Web Analytics when you have consented. • Resend: sending email notifications for new inquiries. • Google (Google Analytics 4): visitor statistics when you have consented to optional cookies. These providers only receive the data necessary to perform the service, and are bound by data processing agreements or equivalent agreements where required.

Some of our providers may process data in the USA or other countries outside the EEA. In such cases, the transfer takes place on the basis of the EU standard contractual clauses (SCC) or other approved transfer mechanisms, as described in the providers' privacy documentation. You can request more information about specific transfers by contacting us.

We store personal data for as long as necessary for the purpose: • Inquiries and booking submissions: until the matter is closed and any statutory retention periods have expired, normally up to 24 months after last contact unless longer storage is required. • Client reviews: for as long as the review is published on the website, or until you request deletion and we have no other basis for keeping it. • Cookie consent: until you withdraw consent or clear your browser storage. • Analytics data: according to Google's and Vercel's standard retention, typically limited to months. When storage is no longer necessary, the data is deleted or anonymized.

The website uses cookies and local storage (localStorage) to function and, with your consent, for statistics. Necessary storage: We store your cookie choice in the browser so you do not have to answer the banner on every visit. This is necessary to respect your consent. Optional cookies (only after "Accept all"): Google Analytics 4 and Vercel Web Analytics are used to understand how the website is used, so we can improve content and technical quality. With "Decline optional", these services are not loaded. You can change your choice at any time by clearing browser data for addifolia.com or using "Change cookie settings" in the footer of the website, and then choosing again in the banner. Read more in the privacy policy you are now reading.

You have the right to: • Request access to the data we hold about you. • Request correction of inaccurate data. • Request deletion when there is no longer a basis for the processing. • Request restriction of processing in certain cases. • Object to processing based on legitimate interest. • Request data portability for data you have provided to us, where technically possible. • Withdraw consent when the processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal. Contact us at the email address under "Data controller" to exercise your rights. We normally respond within 30 days.

If you are unhappy with how we process personal data, we hope you contact us first. You can also complain to the Norwegian Data Protection Authority (Datatilsynet): Datatilsynet Postboks 458 Sentrum, 0105 Oslo, Norway www.datatilsynet.no

We may update this privacy policy when services, technology or regulations change. The date of the last update is shown at the top of the page. We will communicate significant changes clearly where appropriate.