Privacy statement

1. Introduction

VargTech AS processes personal data in line with the Norwegian Personal Data Act (personopplysningsloven) and the GDPR. This privacy statement briefly describes what we collect, why, and which providers are involved in running the website and the contact form.

2. Data controller

VargTech AS is the data controller for the processing described here.

Company registration number 937 500 386, Steinhaugvegen 28, 5545 Vormedal. Contact: post@vargtech.com.

3. What personal data do we process?

Depending on how you contact us:

• Contact form on the website: name, email address, phone number if you fill it in, your free-text message, and technical data that can arise in normal operation (for example IP address and timestamps in provider logs). The submission is verified with Cloudflare Turnstile, which means a verification token is sent to our server for checking.
• Ordinary visits to the website: traffic goes through Cloudflare (DNS, CDN, WAF). Cloudflare may process technical data as part of security and delivery. We also use Cloudflare Web Analytics for simple, aggregated visitor statistics. The statistics are used to understand traffic at an overall level and improve the website, and are not tied to the choices in the cookie banner.
• Your choice in the cookie banner: stored locally in your browser so that we remember that you have responded to the information.

4. Purposes and legal basis

We process data in order to:

• answer enquiries and administer the contact form (legitimate interest / steps prior to a contract);
• deliver and secure the website (legitimate interest and agreement with you as a visitor);
• fulfil any statutory obligations (accounting and similar, where relevant).

Where we ask for consent (for example to clear information about storing a choice in your browser), consent is the basis where that applies.

5. Sub-processors and transfers

We do not sell personal data. Data is disclosed to providers where this is necessary for the purposes above:

• Cloudflare, Inc. (USA) — DNS, CDN, DDoS protection, WAF and Web Analytics. See Cloudflare's privacy policy: cloudflare.com/privacypolicy. Transfer to the USA may take place under the European Commission's standard contractual clauses (SCC) pursuant to GDPR Article 46(2)(c) where relevant.
• Resend, Inc. (USA) — email delivery when you use the contact form (name, email, message and so on that you submit). See resend.com/legal/privacy-policy.
• Infrastructure provider (server capacity) — supplies the hardware the website and the API run on. VargTech itself operates everything running on the server (network services, configuration and security); the provider supplies capacity only, but has technical access to the machine and takes backups, and is therefore regarded as a data processor. Technical logs at the provider's own level (for example IP address and timestamp) are normally deleted or rotated within up to 7 days, in line with common practice for access logs. The exact retention period may depend on the provider's settings.

6. Retention periods

• Enquiries via the contact form: the content is processed in order to reply to you; further storage follows objective need (typically up to about two years unless otherwise agreed or required).
• Access logs at the infrastructure provider: as a rule up to 7 days, cf. section 5.
• VargTech's own application log (operation of the contact API): the log may contain an IP address for blocked or failed submissions and for rate limiting. The message content itself is not logged. The log is rotated daily and deleted automatically after 14 days. The infrastructure provider additionally takes backups of the server that are kept for up to 7 days, so data deleted from the log may exist in a backup for up to 7 days longer.
• Accounting data: where such data arises, statutory deadlines apply (for example retention under the Norwegian Bookkeeping Act, bokføringsloven).
• Storage of the cookie choice: sits locally in your browser until you delete site data.

7. Your rights

Under the GDPR you have, among others, the right to:

• access, rectification, erasure and restriction of processing;
• object to certain forms of processing;
• data portability where the rules provide for it;
• withdraw consent where the processing is based on consent.

To exercise your rights, contact us at post@vargtech.com.

8. Right to complain

If you believe the processing breaches data protection law, you may complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

9. Cookies, browser storage and measurement

We store your answer from the cookie banner locally in your browser.

We use Cloudflare Web Analytics for simple, aggregated visitor statistics. We do not use Google Analytics and no marketing cookies from VargTech on this website.

Measurement starts on page load, that is before you make a choice in the banner. That is defensible because Cloudflare Web Analytics is cookieless and aggregated: it sets no cookies and does not identify you as an individual. Read more in the cookie declaration. You can reopen the cookie settings at any time with the «Cookie settings» button at the bottom right of the page.

10. Security

Among other measures, we use:

• HTTPS for communication with the website;
• Cloudflare as a protective layer (WAF/DDoS protection) in front of the site;
• server-side verification of the contact form (Turnstile) and rate limiting of submissions.

11. Changes

We may update this privacy statement as needed. The current version is published on this page.