Privacy Statement (EU)

This statement explains which personal data Nettsmed AS processes when you use nettsmed.no, why we do it, who has access, and what rights you have. It applies to visitors and to anyone who contacts us. Customer relationships and agreements have their own terms.

1. Controller

Nettsmed AS (org. no. 934 297 571) is the controller for the personal data processed on nettsmed.no.

• Address: Høgvollvegen 51A, 2312 Ottestad, Norway
• Email: post@nettsmed.no
• Phone: +47 466 92 611

We have no data protection officer. Send privacy questions to the email address above.

2. What we process, why and for how long

2.1 Enquiries (contact form, email and phone)

• Data: name, email address, phone number, your message and the page you came from. If you came from an ad, we also store the ad source (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and the first page you visited.
• Purpose: to answer and follow up your enquiry.
• Legal basis: consent, which you give when you submit the form (GDPR art. 6(1)(a)). If you contact us to enter into an agreement, the basis is also that we must process the data to respond to your request (point (b)).
• Retention: messages from the form are stored for 12 months and then deleted automatically. Email we have sent or received is kept as long as the matter or customer relationship requires, and accounting records as long as the Norwegian Accounting Act requires.

2.2 «Speak» in the contact form (voice recording)

• Data: an audio recording of up to 60 seconds that you start and stop yourself in the browser, and the text it becomes.
• What happens: the recording is sent from your browser through nettsmed.no to OpenAI, which transcribes it (Whisper). The text is filled into the form and you can correct it before sending. We store neither the recording nor the transcript, and we do not log the content.
• Legal basis: consent, which you give when you press «Speak» (art. 6(1)(a)). The feature is optional; you can type instead.

2.3 AI search and price estimate

• Data: what you type in the search or price estimate and the answer you get. Your IP address is used briefly to limit abuse. Do not enter data you do not want us to process.
• What happens: the question is sent to our chatbot service, which uses a language model from Anthropic to produce the answer. We make no decisions about you based on this, and no profiling takes place.
• Retention: the conversation log is deleted after 90 days. «Send the conversation» stores nothing; if you choose to send the conversation to us, it is treated as an enquiry (point 2.1).
• Legal basis: our legitimate interest in answering questions and running the service (art. 6(1)(f)). You can object to the processing (point 6).

2.4 Statistics and improving the website

Only if you press «Accept» in the banner.

• Data: page views, clicks, approximate location, device, browser, referring page and an anonymous user ID in cookies and local storage. PostHog also records sessions (session recording). All form fields and text you type are hidden in the recordings.
• Services: PostHog (stored in the EU, Frankfurt) and Google Analytics 4 through Google Tag Manager.
• Purpose: to understand how the site is used and improve it.
• Legal basis: consent (art. 6(1)(a) and the Norwegian Electronic Communications Act § 3-15). You can withdraw it at any time with «Manage consent» at the bottom of the page. Withdrawal does not affect processing before it.
• Retention: the cookies expire after 1–2 years (see the cookie declaration). We delete statistics data when it is no longer needed for the purpose.

2.5 Marketing and ad measurement

Only if you press «Accept» in the banner.

• Data: that you visited the site or sent an enquiry after clicking an ad, and an ad ID in cookies.
• Services: Google Ads (conversion measurement) and OpenAI's ad pixel for ads in ChatGPT, both loaded through Google Tag Manager.
• Purpose: to measure whether the ads lead to enquiries, so we can spend the ad budget sensibly.
• Legal basis: consent (art. 6(1)(a) and the Electronic Communications Act § 3-15). If you choose «Decline», they are not loaded, and we delete the Google cookies in your browser.

2.6 Operations and security

• Data: IP address and technical data in server logs, and the number of requests per IP address to prevent abuse (rate limiting).
• Purpose: to deliver the website, protect it against abuse and find errors.
• Legal basis: legitimate interest in a safe and stable service (art. 6(1)(f)).
• Retention: short, normally days to weeks, and only as long as needed for the purpose.

3. Who has access

We do not sell personal data. We use these processors and recipients, with a data processing agreement where required:

Recipient	What they do for us	Where data is processed
Vercel Inc.	Hosting of the website and the chatbot service	USA, with servers in the EU
Turso	Storage of enquiries (12 months) and conversation log (90 days)	Data stored in the EU
Mailgun (Sinch)	Sending email from forms and chat	EU
Upstash Inc.	Limiting abuse (rate limiting)	USA
Anthropic PBC	Language model for AI search and price estimate	USA
OpenAI	Transcription of voice recordings, and ad pixel (only after consent)	USA
PostHog Inc.	Product analytics and session recording (only after consent)	Stored in the EU (Frankfurt)
Google	Tag Manager (fetched on every page), Analytics and Ads (only after consent)	EU and USA
Sentry	Error reporting	USA

We may disclose data if the law or a public authority requires it.

4. Transfers outside the EEA

Some of the recipients above process data in the USA. The transfer is based on the EU Standard Contractual Clauses (SCC) or on the recipient being certified under the EU–US Data Privacy Framework, which provides an adequate level of protection. If you want a copy of the safeguards, contact us.

5. Cookies

The website uses cookies and similar technologies. Nothing for statistics or marketing is set until you have chosen. Read more in the cookie declaration.

6. Your rights

You have the right to:

• access the data we hold about you and get a copy (art. 15 and 20)
• have inaccurate data corrected (art. 16)
• have your data erased (art. 17)
• have processing restricted (art. 18)
• object to processing based on legitimate interest (art. 21)
• withdraw consent at any time

Send us an email and state clearly who you are, so we do not touch data about the wrong person. We reply within 30 days. If you disagree with how we process your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

7. Security

The website is delivered over an encrypted connection (HTTPS). Access to the data is limited to those who need it, and our processors are bound by agreement. The content of enquiries and voice recordings is not logged.

8. Changes

We update this statement when the processing changes. The date at the top shows when it was last changed.