Privacy Policy

Who is responsible

Altinnendata is the data controller for personal data collected through this website.

What data we collect

• Enquiries: the name, email, phone number, use case, budget and message you submit through the contact form.
• User accounts: name, email address and password (stored hashed). Accounts exist only for the people who run the site — there is no sign-up for visitors.
• Usage data: basic server logs (opaque user IDs, request paths) for debugging and security.

We do not collect payment data through this site.

How we use your data

• To answer your enquiry and arrange the work you ask about.
• To send sign-in related emails (invitation, password reset).
• To improve the service and diagnose technical issues.

We do not use your data for advertising and we do not sell or trade it.

Legal basis for processing

• Contract (Art. 6(1)(b)) — account data and sign-in emails are necessary to provide access to the admin pages.
• Legitimate interests (Art. 6(1)(f)) — enquiries are processed so we can respond to you, and server logs are retained for security monitoring and debugging. Our interest does not override your rights — you can object at any time.

Data sharing

We do not sell or trade your personal data. The platform is self-hosted on infrastructure under our direct control; there is no upstream cloud or hosting provider. We use one third-party data processor:

• Brevo (France, EEA) — transactional email delivery (invitation, password reset) and delivery of contact-form enquiries. Your email address and the email body are shared with Brevo solely for this purpose.

We may also disclose data when required by law.

Data retention

• Enquiries — kept for as long as needed to handle your request and any follow-up, then deleted.
• Account data — until the account is deleted, after which name, email and password are scrubbed.
• Server logs — 90 days. Metrics — 60 days.
• Database backups — encrypted at rest. After deletion, residual data may persist in backups for up to about 6 months until rotation completes; backups are not used for any processing.

Your rights

Under GDPR you have the right to:

• Access & portability — contact us for a copy of the data we hold about you.
• Erasure — contact us to have your enquiry and its data deleted.
• Correction — contact us if something is wrong.
• Object — object to processing carried out on the basis of our legitimate interests.

Requests go to altinnendata@gmail.com. You may also lodge a complaint with the Norwegian Data Protection Authority.

Cookies

We use cookies for authentication and session management. See our Cookie Policy for details.