Privacy notice
Sande Multiservice AS
Data controller
Sande Multiservice AS is the controller of the personal data collected through this website. Contact: Lasse@sandemultiservice.no · +47 907 64 966 · Barstadveien 1, 3089 Holmestrand · org. no. 926 287 303.
What information we collect
When you contact us or make a booking through the website, we process:
- The name, email address and telephone number you provide in the contact form
- Your message/enquiry
- Other information you write in the form yourself
- Technical information to prevent spam (including IP address, processed via Cloudflare Turnstile)
- With your consent to marketing: which campaign or advertisement you came from (UTM tags and click IDs from Google or Meta) and the page you came from
Purpose and legal basis
The information is used to respond to your enquiry. The legal basis is to perform/prepare a contract with you (General Data Protection Regulation, Art. 6(1)(b)) and our legitimate interest in protecting the form against misuse (Art. 6(1)(f)). If you have consented to marketing, we also record which campaign or advertisement the enquiry came from, in order to measure our marketing (Art. 6(1)(a)). You can withdraw your consent under “Cookies” at the bottom of the page.
Data processor and sub-processors
The website is run with the website tool Lansera (Nettfokus AS), which is our data processor and processes the information on our behalf. Nettfokus in turn uses the following sub-processors:
| Sub-processor | Purpose | Region |
|---|---|---|
| Vercel | hosting and delivery of the website | EU (Frankfurt), and a global content delivery network |
| Supabase | database and storage | EU (Frankfurt), support from the USA |
| Resend | email notifications about enquiries and bookings | sent from the EU (Ireland), account and logs in the USA |
| Cloudflare | spam and bot protection (Turnstile) | global |
| Upstash | rate limits against abuse (the IP address only as a salted hash) | EU (Frankfurt) |
| Sentry | error monitoring (email addresses, phone numbers and keys are removed from the reports) | EU (Frankfurt) |
Vercel, Resend, Cloudflare, Upstash and Sentry are US companies, and Supabase's contracting party is in Singapore. Where information is processed outside the EEA, this is based on the EU standard contractual clauses in the agreements with them. Cloudflare, Upstash and Sentry also use the EU–US Data Privacy Framework.
Retention period
Enquiries are kept for as long as we need them to respond and follow up. They are deleted when we delete them, or when the website is deleted. We also receive them by email, which we delete ourselves, and our email provider (Resend) keeps a copy for a limited time. You can at any time request access to or deletion of your information.
Cookies
The website counts visits without cookies. For each visit, we store which page you viewed, which website you came from, and a code made from your IP address and browser together with the date. The code changes every day, so visits on different days cannot be linked, and the IP address is not stored. The legal basis is our legitimate interest in knowing how the website is used (Art. 6(1)(f)), and the count is deleted when the website is deleted. The website does not set cookies for analytics or marketing without your consent. Other analytics, such as Google Analytics, is loaded only after you have consented (Google Consent Mode, declined by default). If you have consented to marketing, the browser remembers which campaign or advertisement you came from while you are on the site (sessionStorage), and this is sent with your enquiry. Necessary functions – such as bot protection on forms – may be used without consent.
Content from other services
If you play a video, it is loaded from YouTube or Vimeo, and the service receives your IP address.
Your rights
Under the rules of the General Data Protection Regulation (Art. 15–21), you have the right of access, rectification, erasure, restriction and data portability, and the right to object to the processing. Contact Sande Multiservice AS at Lasse@sandemultiservice.no to exercise your rights. You can also lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority).