Privacy policy

Processing of Personal Data (Privacy Policy)

L A Larsen AS will process personal data in connection with our business. We are committed to handling your personal data in a safe and secure manner. Below you will find information about the personal data we collect and how it is processed, as well as your rights related to the processing of personal data.

The controller for the personal data we process is L A Larsen AS. We can be contacted at info@larsen.no.

Processing of personal data

We collect and use personal data for various purposes depending on who you are and how we come into contact with you. Below you will find the personal data we process about you, the purpose and legal basis for the processing, how long we process the data, etc.

“Personal data” means any information that can be linked to a natural person (the latter referred to as the “data subject”).

“Processing” means any operation performed on personal data, such as collection, registration, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.

Services – e-commerce

We collect and process personal data when you use our services, such as when you shop in our online stores. The purpose and legal basis for processing all personal data about you is to fulfill our agreement with you if you order and purchase goods from our websites, cf. GDPR Article 6(1)(b). In addition, we process personal data to manage the relationship with our customers, secure and improve our services, and protect our rights, etc. In these cases, the processing is based on our legitimate interests, and our interest outweighs the individual’s privacy. We are also required to retain certain information in connection with accounting, tax handling, and any warranty and returns handling, Article 6(1)(c). As set out below, we also process data based on your consent, cf. Article 6(1)(a).

Personal data collected and processed can be divided into two categories:

• Information you provide to us.

• Information we obtain when you use our services.

A. Information you choose to provide

If you choose to shop with us, we will collect and process the information you provide. This will include:

• Your name

• Your email address, which we use for communication related to your order/customer relationship

• Your telephone number, which we use for communication related to your order/customer relationship

• Your address, to which we will send any orders

• Account number (if you have registered this) for any refunds

• Date of birth (optional)

Providing this information is voluntary, but necessary to use or place orders on the website, and therefore a prerequisite if you wish to shop with us.

We also need this information to deliver the goods to you and to contact you about matters related to the order. We are further required to retain this information in connection with accounting, tax handling, and any warranty and returns handling. This history is deleted when the purpose of the processing has ceased, see below, and is also available to you on “My Page.” For security reasons, we also store the IP address used when the order was placed.

For information related to your account with us, such data will be stored and processed as long as your account is active or until you delete the account. If you have not made any purchases, the account will be deleted 12 months after the last activity on the account. If you have orders, the account will be deleted 5 years after the last activity. A deletion notice will be sent to the email address you provided, and if you do not respond, the account will be deleted 14 days after the notice is sent. This is to ensure we have order history, etc., available for any complaints.

We may also process personal data related to complaints, claims, or other matters linked to our services.

We use various payment providers in connection with payment in our online store. This means we may transfer your personal data in the form of credit card numbers and contact and order details to the payment provider when the checkout loads, so that the provider can manage your purchase. For the payment itself, the payment provider is the controller and processes personal data in accordance with the provider’s own privacy policy.

If you contact customer service or otherwise communicate with us, we collect the information you provide in connection with the contact. This may include:

• Your name

• Email address

• Telephone number

• Order number

The information you provide may be used in our internal testing routines for our IT systems. These are tests we perform to ensure our systems function properly and have the required level of security.

B. Information we obtain when you use our services

When you use our websites, we collect and store log data about changes made to your customer profile (e.g., changes to address, phone number, etc.), as well as which categories and products you click on or search for. Logs are retained and deleted in the same manner as your account details, see above. This allows us to track relevant changes and learn what our customers are interested in, enabling us to improve our product selection and offers. This information is also used to display related products to you or to send related offers (if you have explicitly requested this). The information is also used to produce traffic statistics for, among other things, capacity planning.

Like many other electronic services, we use cookies and similar technologies to collect information about activity, browser, and device.

Newsletter

We send email newsletters to those who have subscribed to receive them. To receive the newsletter, you must opt in, and we then process the personal data necessary to send it, i.e., your email address. The email address is not used for any purpose other than sending the newsletter.

We process personal data based on your consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time by using the link in the newsletter or by contacting us. If you withdraw your consent, you will no longer receive the newsletter.

Personal data is processed as long as you wish to receive the newsletter and have not canceled the subscription or otherwise indicated that you no longer wish to receive it.

Use of websites

To obtain information about the use of our websites, we use cookies. You can read more about cookies and which cookies we use below.

We use the information collected to improve the customer experience on our websites and services and to provide functionality in the services. We also use the information to provide visitors with recommendations and service customizations that are as relevant as possible for you. This is based both on the visitor’s behavior (e.g., services used, links clicked, or information read) and the behavior of other users with similar usage patterns.

Personal data is also used to improve our websites, and to prepare statistics and understand how the pages are used. Where practicable, we seek to do this with anonymous information, without being able to link the information to a specific visitor.

We process the above personal data on the basis of our legitimate interests (GDPR Article 6(1)(f)), or your consent, to tailor the website to our users, and this interest outweighs the individual’s privacy. However, we safeguard the privacy of website visitors by using the information only for statistics. In these statistics, it is not possible to identify individuals. The data will be stored as long as necessary for the purposes described above.

Storage and retention (deletion) of personal data

We retain personal data for as long as necessary for the purpose for which it was collected and delete the data in accordance with legal requirements. The retention periods for the different types of data are set out above where the individual processing activities are described.

Instead of deleting personal data, it may in some cases be relevant to anonymize the personal data. Anonymization means that all identifying or potentially identifying characteristics are removed from datasets that are retained.

This means, for example, that personal data we process based on your consent is deleted if you withdraw your consent. Personal data we process to fulfill an agreement with you is deleted when the agreement is fulfilled and all obligations arising from the contractual relationship have been met, such as statutory obligations related to accounting, customer relationship follow-up, complaints, etc. Personal data we process as a result of a legal obligation will be deleted as soon as we are no longer required to retain the data.

Transfer or disclosure of personal data to others

We do not disclose personal data to others in cases other than those mentioned in this statement and unless there is a legal basis for such disclosure. Examples of such a basis will typically be an agreement with or consent from the data subject, or a legal basis that requires us to provide the information. The latter applies to public authorities such as tax collection(where necessary), accountant/auditor, as well as others we need in our business such as our banking partner.

We use data processors to collect, store, or otherwise process personal data on our behalf. In such cases, we have entered into agreements to safeguard your rights and the security of your personal data at all stages of the processing. See more below.

If required by law or if there is suspicion that a criminal offense has been committed in connection with the use of our services, the personal data we have stored about you may be disclosed to public authorities.

If personal data may be subject to transfer to another organization in connection with a merger, financing, reorganization, or dissolution transaction of all or part of us, we will only do so if the parties have entered into an agreement whereby the collection, use, and sharing of the personal data is limited to purposes related to the transaction, including a provision on whether the transaction will proceed or not, and the personal data will only be used by the parties to implement and complete the transaction. If another company purchases us or our business or assets, this company will have access to the personal data collected by us and will assume the rights and obligations regarding your personal data as described in this privacy policy.

Transfer of personal data to recipients in countries outside the EEA

Our objective is that all processing of personal data takes place within the EEA, but we may use suppliers or process personal data outside the EEA. In such cases, transfers and processing outside the EEA will take place in countries approved by the European Commission or in accordance with a valid legal basis for the transfer of personal data under GDPR Chapter V. If the transfer does not take place to a country approved by the European Commission, the transfer will only occur subject to the safeguards set out in GDPR Article 46(2). You can obtain information about the legal basis used for a specific transfer by contacting us.

Links to third parties/other websites

There may be links to other websites or third parties that offer products or services, and other locations not under our control. These links are provided only as a way for users to obtain more information. Websites that are not part of ours, i.e., not under our domains, will process personal data as controllers in their own right and may have separate and independent privacy policies. We are not responsible for the content and activities of these websites.

Security of processing

We place a high priority on the security of personal data in our business and will implement all required technical and organizational measures to safeguard your personal data. All processing will, where possible, be encrypted, and not available to anyone other than those who need personal data for their tasks.

We handle information so that it is accurate, available, and handled in accordance with the sensitivity of the data. We also use a range of security technologies and information security procedures to protect your personal data from unauthorized access, use, or disclosure. Where necessary, risk assessments are carried out.

We have entered into data processing agreements with all our suppliers who process personal data, whereby they assume the same level of security as we apply to our processing of personal data.

We limit access to your personal data to personnel or third parties who will process the data on our behalf. These parties are subject to strict confidentiality requirements, and we may impose sanctions or terminate the agreement if these requirements are not met.

We have established procedures for dealing with information security breaches (personal data breaches). If there is a breach that poses a risk to the privacy of the personal data concerned, we will notify the Norwegian Data Protection Authority as soon as possible and no later than 72 hours after the breach is discovered. If the breach is likely to result in a high risk to the privacy of the data subjects, we will also notify those affected.

Your rights when we process personal data about you

Below are your rights as a data subject. To exercise your rights, please contact us—see contact information above.

We will respond to your inquiry as soon as possible, and no later than 30 days. If it takes longer than 30 days, you will be notified. We will ask you to confirm your identity or provide additional information before allowing you to exercise your rights with us. We do this to ensure we only grant access to your personal data to you—and not to someone posing as you.

Control over your information

You have the right to be informed about and to access the personal data we process about you. Through this statement, we inform you about our processing of personal data. You can also contact us if you want more information.

To give you control over your personal data, you will have access to the following tools:

• Access to personal data (right of access) and updates. You will have access to the key personal data processed about you by creating a user account on the website, and you can also update/correct the information. Information not available on “My Page” can be accessed by creating a customer case via “My Page” on our website. Our customer service will then make available the information stored on your profile, and you will receive a confirmation by email when the information is available to you. You can then retrieve it by logging in to “My Page.”

• Withdrawal of consent. If you later change your mind about our ongoing ability to collect information from sources you have already consented to, you can simply withdraw your consent by changing the settings on “My Page.” If you do this, certain services will naturally lose functionality. Alternatively, you can contact customer service.

• Deletion of account. If for any reason you wish to delete your user account, this can be done by logging into your customer profile via “My Page.”

Rectification and erasure

You can ask us to correct inaccurate information we hold about you via “My Page” (see above), or ask us to delete personal data. We will accommodate a request for deletion as far as possible, but we cannot do so if we still need the information.

Right to restriction or to object to processing

You have the right to obtain restriction of processing in certain cases, see GDPR Article 33, such as:

a) You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data.

b) The processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead.

c) We no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense of legal claims.

d) You have objected to processing pursuant to GDPR Article 21(1) pending verification of whether our legitimate grounds override your privacy.

Right to data portability

For data that you have provided to us that is necessary to perform an agreement with us and which is processed automatically (i.e., not manually by us), you may request that the personal data about you be provided or transferred to another provider in a structured, commonly used, and machine-readable format (data portability).

Automated processing, including profiling

There will be no automated processing, including profiling, based on your personal data that produces legal effects concerning you or similarly significantly affects you. See GDPR Article 22(1) and (4).

Use of data processors

We do not sell your personal data to third parties, and we do not trade or pass on such information to third parties. A third party will only gain access to the information if this is necessary to perform certain services for us so that we can provide our services to you. Relevant information necessary to complete the transaction is shared with the payment partner and carrier.

Data processors are other companies we use to process personal data. Strict agreements are concluded to safeguard information security in such cases.

Complaints

Please feel free to contact us if you have questions or concerns about how we process your personal data! If you believe our processing of personal data violates these rules or privacy legislation, including the Personal Data Act or the General Data Protection Regulation (GDPR), you can also lodge a complaint with the Norwegian Data Protection Authority. You can find information on how to contact the Authority on their website: www.datatilsynet.no.

We use the Norwegian Data Protection Authority as the lead supervisory authority for cross-border processing pursuant to GDPR Article 56.

Changes

We may need to change the information about the processing of personal data from time to time, e.g., as a result of changes to the websites or our services, or if there are changes to the rules on the processing of personal data. If this information is changed, we will notify you if we have your contact details. Otherwise, updated information will always be readily available on our websites.

Cookies

This website uses cookies. We use cookies to personalize content and ads, to provide social media features, and to analyze our traffic. We also share information about your use of our site with our social media, advertising, and analytics partners, who may combine it with other information you have provided to them or that they have collected from your use of their services.

Cookies are small text files that can be used by websites to make a user’s experience more efficient.

The law allows us to store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission.

This website uses different types of cookies. Some cookies are placed by third-party services that appear on our pages.

You can change or withdraw your consent via the Cookie Declaration on our website.

Read our Privacy Policy to learn more about who we are, how you can contact us, and how we process personal data.