Privacy Policy

Vevja AS, org. nr. 938 295 735, Sagrønningen 1, 3271 Larvik, Norway ("we," "us," or "our") is the data controller for personal data collected through our platform and authentication service, in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven). For personal data processed on behalf of our tenants (website owners using Vevja), Vevja acts as a Data Processor, and the tenant acts as the Data Controller. This processing is governed by our Data Processing Agreement, available at https://login.vevja.no/dpa. Contact: support@vevja.no

We collect the following categories of personal data: Account Information: - First name and last name - Email address - Phone number (verified by SMS during registration) - Securely hashed password (never stored in plain text) - Account role and permissions Authentication & Security Data: - Device verification data, including a device fingerprint used to recognize trusted devices (for two-factor authentication) - IP address (hashed for analytics, not stored in plain text) - Authentication records and timestamps - Login history and 2FA verification records Usage Data: - Pages visited within the admin panel - Feature usage patterns - Browser type and operating system (for analytics) Store Data (if applicable): - Order history and transaction records - Shipping recipient details (name, address, phone number) - Payment method identifiers (processed by our payment providers, not stored by us) Domain Registration Data (if you register a domain through the Service): - Registrant contact details (name, address, email, phone) required by domain registries Mobile App Data (if you install the Vevja employee app): - Device push notification token (used to deliver notifications to your device) Employee Data (Timeclock module, if applicable — processed on behalf of your employer, who is the data controller; see Section 13): - Clock in/out timestamps - Break records - Shift schedules and swap history - Vacation and absence records - Compensation basis and working-time agreement settings - Date of birth (where required for working-time rules) - One-to-one staff chat messages sent through the mobile app

We process your personal data based on the following legal grounds under GDPR Article 6: Contract Performance (Art. 6(1)(b)): - Processing account data to provide the Service - Processing payment and order data for store transactions - Processing registrant data to register domains on your behalf - Managing your subscription and billing Legitimate Interest (Art. 6(1)(f)): - Privacy-focused analytics to improve the Service - Security monitoring and fraud prevention - Device verification for two-factor authentication Consent (Art. 6(1)(a)): - Marketing communications (opt-in only) - Non-essential cookies (if any) Legal Obligation (Art. 6(1)(c)): - Tax and accounting records for store transactions - Compliance with Norwegian bookkeeping requirements (Bokføringsloven)

We use your personal data to: - Provide, maintain, and improve the Service. - Authenticate your identity and secure your account. - Process transactions through the web store. - Send transactional emails and SMS messages (account verification, password reset, 2FA links, order confirmations). - Send push notifications to your mobile device if you install the employee app and enable notifications (for example shift changes and staff chat messages; chat notifications include the sender's name and a short preview of the message). - Generate privacy-focused analytics (using hashed IPs, no tracking cookies). - Provide AI-powered content translation and image search (see Section 5). - Monitor and ensure the security of the Service. - Comply with legal obligations. We do not sell your personal data. We do not use your data for profiling or automated decision-making that produces legal effects.

We use artificial intelligence for the following features: Content Translation: We use Mistral AI (a French company with EU-based processing) to translate website content into supported languages. The content submitted for translation is sent as-is; if a page contains personal data (for example a name or contact details published on the page), that data will be included in the content sent for translation. Image Search: We use AI services to analyze uploaded images and generate searchable descriptions. Image analysis data is stored locally within your account. Content submitted to AI providers is used solely to provide these features and is covered by a data processing agreement. We do not send account data, customer records, or other stored personal data to AI providers — only the content you choose to translate or the images you upload for analysis.

We share personal data only with the following categories of recipients, and only to the extent necessary: Payment Processors: - Vipps MobilePay (Norway) — payment processing and, where enabled, Vipps Login for customer sign-in - Stripe (EU/EEA processing via Stripe Payments Europe) - Klarna (Sweden) These providers handle payment data under their own privacy policies. Communications: - Bird — delivers our transactional email and SMS messages (receives email addresses, phone numbers, and message content) - Expo (USA) — delivers mobile push notifications for the employee app (receives device push tokens and notification content, including sender name and a short message preview for chat notifications). Depending on your device, notifications are also routed through Apple Push Notification service or Google Firebase Cloud Messaging. Infrastructure Providers: - Bunny.net — content delivery network and DNS - Server hosting and cloud storage providers (for running the Service and storing encrypted database backups) Geolocation: - ipinfo.io — approximate IP-based geolocation for security and regional features Domain Registration: - Accredited domain registrars and registries (receive registrant contact details when you register a domain) AI Services: - Mistral AI (content translation and image analysis, as described in Section 5) Image Search: - Unsplash (receives search terms only when you search their image library from the admin panel) Integrations You Enable (data shared only when the website owner connects them): - Accounting and payroll systems: Fiken, PowerOffice, Tripletex, Conta, Finago, Visma (receive customer names, contact details, and order data for invoicing and bookkeeping; where the payroll integration is enabled, they also receive employee payroll data such as hours worked and salary basis lines) - Shipping carriers: Bring/Posten, PostNord, Helthjem (receive recipient name, address, and phone number for shipping labels, rates, and tracking) We do not share your personal data with advertisers, data brokers, or any third parties for marketing purposes. All third-party processors are bound by data processing agreements in compliance with GDPR Article 28. The current list of subprocessors is also included in our Data Processing Agreement at https://login.vevja.no/dpa.

Your data is primarily processed and stored on servers located in Europe, with encrypted backups stored in the EU (Germany). Some services involve transfers to the United States — in particular mobile push notification delivery (Expo, Apple, Google). Where data is transferred outside the EEA (for example when a third-party provider processes data abroad), we ensure appropriate safeguards are in place, including: - EU Standard Contractual Clauses (SCCs) - Adequacy decisions by the European Commission, including the EU-U.S. Data Privacy Framework for certified U.S. providers - Additional technical measures such as encryption Database backups are encrypted and stored with access restricted to authorized personnel only.

We retain your personal data only as long as necessary for the purposes described in this policy: - Account data: Retained while your account is active, plus 30 days after deletion. - Authentication logs: Retained for 90 days for security purposes. - Administrative audit logs: Retained for 90 days. - Analytics data: Aggregated and anonymized; raw data retained for 12 months. - Store transaction data: Retained for 5 years in accordance with Norwegian bookkeeping law (Bokføringsloven). - Timeclock data: Retained for the duration required by Norwegian labor law. After the retention period, data is securely deleted or anonymized.

Vevja takes a privacy-focused approach to tracking: - We do not use third-party tracking cookies. - We do not use advertising cookies. - Our analytics system uses hashed IP addresses and does not rely on cookies. - We use essential session cookies only for authentication purposes. Essential cookies cannot be disabled as they are required for the Service to function. These include: - Session cookies for maintaining your login state. - Security cookies for request verification.

As a data subject, you have the following rights under GDPR and Norwegian data protection law: Right of Access (Art. 15): You can request a copy of all personal data we hold about you. Right to Rectification (Art. 16): You can request correction of inaccurate personal data. Right to Erasure (Art. 17): You can request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements. You can also request account deletion directly from your account settings. Right to Restriction (Art. 18): You can request that we limit how we process your data. Right to Data Portability (Art. 20): You can request your data in a structured, machine-readable format. Right to Object (Art. 21): You can object to processing based on legitimate interest. Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you can withdraw it at any time. To exercise any of these rights, contact us at support@vevja.no. We will respond without undue delay and at the latest within one month, as required by GDPR.

We implement appropriate technical and organizational measures to protect your personal data, including: - Passwords are securely hashed (never stored in plain text). - Two-factor authentication with device verification. - Secure token-based authentication with short-lived sessions. - Encrypted backups with automated retention policies. - Role-based access control with granular permissions. - Data isolation ensuring separation between customers. - Regular security monitoring and incident response. Despite these measures, no system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours, as required by GDPR Article 33, and we will notify you without undue delay where the breach is likely to result in a high risk to your rights, as required by GDPR Article 34.

Users must be at least 15 years old to create an account independently; users between 13 and 15 years of age require parental or guardian consent. This age requirement is our own policy and is stricter than the minimum age of 13 at which children may consent to the processing of their personal data in connection with information society services under the Norwegian Personal Data Act (Personopplysningsloven §5). We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without parental consent, we will delete that data promptly.

Each customer on the Vevja platform has an isolated environment: - Customer data is stored separately and securely. - Customers cannot access other customers' data. - When a customer collects data from their website visitors, the customer is the Data Controller, and Vevja is the Data Processor, as set out in our Data Processing Agreement (https://login.vevja.no/dpa). - Customers are responsible for their own privacy policies and GDPR compliance for data they collect from their visitors.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Norwegian Data Protection Authority: Datatilsynet Postboks 458 Sentrum 0105 Oslo, Norway Website: www.datatilsynet.no Email: postkasse@datatilsynet.no You also have the right to lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence or place of work.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The current version of this Privacy Policy is always available at this page.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: Vevja AS, org. nr. 938 295 735 Sagrønningen 1, 3271 Larvik, Norway Email: support@vevja.no Website: https://vevja.no For data protection inquiries, you may also contact our data protection team directly at privacy@vevja.no.