1. Introduction

This privacy policy explains how Denne Stranda AS ("we", "us" or "our") collects, uses, stores and protects your personal data when you visit our website https://www.dennestranda.no ("the Service").

We take your privacy seriously and are committed to protecting your personal data in line with applicable law, including the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

2. Data controller

The data controller for the processing of personal data is:

Denne Stranda AS Company registration number: 932 950 227 Address: Bankgata 1, 6200 Stranda E-mail: post@dennestranda.no Phone: +47 000 00 000

3. What personal data do we collect?

3.1 Information you give us

We may collect the following information when you use our services:

• Contact details: Name, e-mail address, phone number (when you contact us via the contact form)
• Correspondence: The content of messages you send us
• Other information: Data you give voluntarily through forms or when communicating with us

3.2 Information we collect automatically

When you visit our website, we automatically collect certain information:

• Technical information: IP address, browser type and version, operating system, time zone
• Usage information: Pages visited, clicks, time and length of visit, referring website
• Device information: Device type, screen resolution, language settings

3.3 Information from third-party services

Google Analytics

We use Google Analytics to analyse traffic and user behaviour on the website. Google Analytics collects:

• Demographic information (age, gender, interests)
• Geographic location (city, region, country)
• Technology (browser, device, operating system)
• User behaviour (page views, clicks, conversions)

Google Analytics uses cookies to track user activity. Data is anonymised and shared with Google in accordance with their privacy policy.

Cookies

We use cookies to:

• Improve the user experience
• Analyse website traffic
• Tailor content and adverts
• Remember preferences and settings

See detailed information about cookies in section 6 below.

4. Purpose and legal basis for processing

We process your personal data for the following purposes:

Purpose

Legal basis

Storage period

Answering enquiries and communication

Consent / Legitimate interest

2 years after last contact

Improving the website and the user experience

Legitimate interest

Anonymised data: unlimited

Analysing traffic and usage patterns (Google Analytics)

Consent via cookie banner

26 months (Google Analytics default)

Security and prevention of misuse

Legitimate interest / Legal obligation

12 months

Meeting legal obligations

Legal obligation

As required by law

Legitimate interest: Our legitimate interest is to run, maintain and improve our website, and to keep it secure.

Consent: For non-essential cookies and Google Analytics, we obtain your consent via our cookie banner before any data is collected.

5. Sharing personal data

We never sell your personal data to third parties. We may share information with:

5.1 Service providers

• Web hosting providers: For hosting the website
• Analytics tools: Google Analytics (with IP address anonymisation)
• E-mail services: For sending and receiving e-mail
• CDN providers: For content delivery and performance

All service providers are obliged to process personal data in accordance with the GDPR and relevant data processing agreements.

5.2 Legal requirements

We may disclose personal data when we believe in good faith that disclosure is necessary to:

• Comply with applicable laws or regulations
• Protect our rights or property
• Prevent or investigate possible breaches of the law
• Protect the safety of users or the public

5.3 Transfers to third countries

Some of our service providers (such as Google) may process data outside the EU/EEA. In such cases we make sure that:

• The transfer takes place in accordance with Chapter V of the GDPR
• Adequate safeguards are in place (e.g. Standard Contractual Clauses)
• Your rights are protected in accordance with the GDPR

6. Cookies

6.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They are used to remember preferences, analyse use and improve functionality.

6.2 Types of cookies we use

Essential cookies

These are essential for the website to work and cannot be switched off:

• Security cookies
• Session cookies
• Cookie consent (remembers your choices)

Functional cookies

Improve functionality and personalisation:

• Language preferences
• Region settings

Analytics cookies (Google Analytics)

Help us understand how visitors use the website:

• _ga: Distinguishes between users (2 years)
• _gid: Distinguishes between users (24 hours)
• _gat: Used to limit the request rate (1 minute)

Marketing cookies

For future use in targeted marketing and advertising (requires consent).

6.3 Managing cookies

You can change your cookie preferences at any time by:

• Using our cookie banner (shown on your first visit)
• Adjusting the settings in your browser
• Clicking "Cookie settings" in the footer of the website

Please note that switching off certain cookies may affect how the website works.

7. Your rights

Under the GDPR you have the following rights:

7.1 Right of access (Article 15)

You have the right to be told which personal data we process about you.

7.2 Right to rectification (Article 16)

You can ask us to correct inaccurate or incomplete personal data.

7.3 Right to erasure (Article 17)

You can ask us to delete your personal data when:

• It is no longer needed for the purpose
• You withdraw your consent
• You object to the processing
• The data has been processed unlawfully

7.4 Right to restriction (Article 18)

You can ask us to restrict the processing in certain situations.

7.5 Right to data portability (Article 20)

You have the right to receive your personal data in a structured, machine-readable format.

7.6 Right to object (Article 21)

You can object to processing based on legitimate interest or for direct marketing.

7.7 Right to withdraw consent

You can withdraw your consent to the processing of personal data at any time.

7.8 Right to complain

You have the right to complain to Datatilsynet, the Norwegian Data Protection Authority, if you believe we process your personal data in breach of the rules:

Datatilsynet Postboks 458 Sentrum, 0105 Oslo Phone: 22 39 69 00 E-mail: postkasse@datatilsynet.no Website: www.datatilsynet.no

Exercising your rights

To exercise your rights, contact us at post@dennestranda.no. We will respond to your request within 30 days.

8. Security

We use appropriate technical and organisational security measures to protect your personal data against:

• Unauthorised access
• Loss or destruction
• Accidental alteration
• Unlawful processing

Security measures include:

• SSL/TLS encryption (HTTPS)
• Secure data storage
• Access control and authentication
• Regular security reviews
• Staff training in data protection

No transfer of data over the internet is 100% secure. Although we do our best to protect your personal data, we cannot guarantee absolute security.

9. Children's privacy

Our website is not aimed at children under 16. We do not knowingly collect personal data from children under 16 without parental consent. If we become aware that we have collected such data, we will delete it immediately.

10. Storage of personal data

We keep personal data only for as long as it is needed for the purposes described in this policy, or as required by law.

General storage periods:

• Enquiries via the contact form: 2 years after last contact
• Server logs and security information: 12 months
• Google Analytics data: 26 months (can be adjusted)
• Essential cookies: Session or up to 1 year
• Analytics cookies: 2 years (Google Analytics default)

Once the storage period ends, the personal data is deleted or anonymised.

11. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in:

• Our practices
• The services we offer
• Legal or regulatory requirements

We will tell you about significant changes by:

• Publishing the new privacy policy on this page
• Updating the "Last updated" date
• Sending a notice by e-mail (where relevant)

We encourage you to review this policy regularly.

12. Contact us

If you have questions about this privacy policy or how we process personal data, contact us at:

E-mail: post@dennestranda.no Phone: +47 000 00 000 Postal address: Bankgata 1, 6200 Stranda

We will answer enquiries as quickly as possible, and within 30 days at the latest.

13. Legal references

This privacy policy has been drawn up in accordance with:

• EU Regulation 2016/679 (General Data Protection Regulation – GDPR)
• The Norwegian Personal Data Act (personopplysningsloven)
• The Norwegian Electronic Communications Act (ekomloven) section 2-7b (cookies)
• The Norwegian Marketing Control Act

14. Specific provisions for Google Analytics

14.1 Anonymisation of IP addresses

We have enabled IP anonymisation (anonymizeIP) so that your full IP address is not stored.

14.2 Data processing agreement

We have entered into a data processing agreement with Google that ensures GDPR compliance.

14.3 Sharing with Google

Google may use the data collected to improve its own services. Read more about Google's privacy practices at: https://policies.google.com/privacy

14.4 Opt-out

You can opt out of Google Analytics tracking by:

• Installing the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout
• Switching off analytics cookies in our cookie banner
• Using your browser's "Do Not Track" function

15. Cookie banner and consent

When you visit the website for the first time, you will see a cookie banner that:

• Tells you about our use of cookies
• Lets you accept or reject non-essential cookies
• Gives you the option to adjust your cookie preferences
• Links to this privacy policy

You can change your choices at any time through the cookie settings on the website.

Consent categories:

• Essential: Always active (cannot be switched off)
• Functional: Improve the user experience (optional)
• Analytics: Google Analytics and statistics (requires consent)
• Marketing: Future use for targeted content (requires consent)