Privacy Policy

This Privacy Policy explains how Vitshineex.ddd ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit our website, contact us, subscribe to updates, or purchase goods or services from us. We process personal data in accordance with:

• the EU General Data Protection Regulation (GDPR), as incorporated into Norwegian law through the EEA Agreement;
• the Norwegian Personal Data Act (Personopplysningsloven);
• the Norwegian Electronic Communications Act (Ekomloven) regarding cookies and similar technologies — see our Cookie Policy;
• the Norwegian Marketing Control Act (Markedsføringsloven) regarding electronic direct marketing.

We are the data controller for the processing described on this page. We have not appointed a data protection officer (DPO), as our processing does not meet the thresholds requiring one under GDPR Article 37 and Personopplysningsloven.

1. Data Controller

The data controller responsible for your personal data is:

Vitshineex.ddd
Organisasjonsnummer: 935 777 739
Krabberødveien 1B, 3961 Stathelle, Norway
Email: inquiry@vitshineex.world
Phone: +47 411 43 370

2. What Data We Collect

We may collect the following categories of personal data:

• Contact data: name, email address, and message content submitted through our contact form or newsletter signup.
• Technical data: IP address, browser type, device type, operating system, and referring URL collected automatically when you visit our site.
• Cookie data: preferences stored through our cookie consent mechanism. See our Cookie Policy for details.
• Usage data: pages visited, time spent on pages, and interaction patterns — collected only if you consent to analytics cookies.

3. Purposes and Legal Bases for Processing

Under GDPR Article 6 and Personopplysningsloven, we process your personal data only where we have a valid legal basis:

• Responding to inquiries (legal basis: consent, GDPR Art. 6(1)(a); and legitimate interest, Art. 6(1)(f)) — when you submit our contact form and tick the consent box, we use your name, email, and message solely to reply. Our legitimate interest is handling genuine customer enquiries efficiently.
• Newsletter and updates (legal basis: consent, GDPR Art. 6(1)(a); Markedsføringsloven § 15) — we send herbal tea tips and event announcements only if you have given prior, explicit consent to electronic marketing. Every message includes a simple way to opt out. You may withdraw consent at any time without affecting other services.
• Orders, events, and contracts (legal basis: contract performance, Art. 6(1)(b); and legal obligation, Art. 6(1)(c)) — if you book a workshop or buy products, we process data needed to deliver the service, issue receipts, and meet accounting and tax duties under Norwegian law (Regnskapsloven, Merverdiavgiftsloven).
• Website functionality (legal basis: legitimate interest, Art. 6(1)(f)) — strictly necessary cookies and local storage keep the site secure and remember your cookie choice. See our Cookie Policy.
• Analytics (legal basis: consent, Art. 6(1)(a)) — if you accept analytics cookies, we analyse aggregated traffic patterns to improve our content. No analytics run without your prior consent.
• Marketing cookies (legal basis: consent, Art. 6(1)(a)) — only activated if you opt in via the cookie banner.
• Legal compliance and disputes (legal basis: legal obligation, Art. 6(1)(c); legitimate interest, Art. 6(1)(f)) — we may retain certain records to comply with Norwegian consumer, tax, and bookkeeping rules, or to establish, exercise, or defend legal claims.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects (GDPR Art. 22).

4. Is Providing Data Mandatory?

You are never obliged to browse our website. Contact and newsletter forms are voluntary. However, if you want us to reply to a message, book an event, or complete a purchase, you must provide the information marked as required — otherwise we cannot perform the agreement. We will always tell you which fields are mandatory before you submit a form.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described above, in line with GDPR storage-limitation principles and Personopplysningsloven:

• Contact form submissions: 12 months from the date of your inquiry, unless a longer period is required for ongoing correspondence.
• Newsletter subscriptions: until you unsubscribe or request deletion.
• Order and payment records: up to 5 years after the end of the financial year, as required by Norwegian bookkeeping rules (Regnskapsloven § 13).
• Analytics data: up to 26 months from collection, in anonymised or aggregated form where possible.
• Cookie and consent records: 12 months from the date consent was given or updated, after which we ask you to renew your choice.

When retention periods expire, we delete or irreversibly anonymise your data unless the law requires us to keep it longer.

6. Data Processors and Sharing

We do not sell your personal data. Where we use external providers to process data on our behalf, we enter into data processing agreements (GDPR Art. 28) ensuring they only act on our instructions and apply appropriate security measures.

We may share data with:

• Hosting and IT providers within the European Economic Area (EEA) that operate our website infrastructure.
• Analytics providers, only if you have consented to analytics cookies.
• Payment and delivery partners, when needed to complete a purchase you have requested.
• Public authorities when required by Norwegian or EU law, including Datatilsynet, tax authorities, or courts.

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place — such as the EU Standard Contractual Clauses, an adequacy decision, or binding corporate rules — and we inform you of the transfer where required by law.

7. Your Rights Under GDPR and Personopplysningsloven

As a data subject, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where there is no compelling reason for continued processing.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decisions: you are not subject to decisions based solely on automated processing that significantly affect you.

To exercise any of these rights, contact us at inquiry@vitshineex.world. We will respond within one month, as required by GDPR Article 12. If your request is complex or numerous, we may extend this by a further two months and will inform you of the reason.

Exercising your rights is free of charge. We may refuse manifestly unfounded or excessive requests, or charge a reasonable fee where permitted by law.

8. Data Security and Breach Notification

We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, access controls, and regular security reviews. While no method of transmission over the internet is completely secure, we strive to protect your data using industry-standard practices.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet without undue delay and, where required by GDPR Article 34, inform you in clear and plain language.

9. Children's Privacy

Our website is not directed at children. Under Personopplysningsloven § 5, children under 13 years in Norway may not validly consent to the processing of their personal data for information society services. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will delete it promptly.

10. Direct Marketing and Advertising

Electronic marketing (email newsletters and similar messages) is sent only with your prior consent, in line with Markedsføringsloven § 15. You can opt out at any time by using the unsubscribe link in our emails or by contacting us. Objecting to marketing does not affect our ability to send essential service messages about an order or booking you have made.

If you accept marketing cookies in our cookie banner, we may load advertising measurement tools (such as Google Ads conversion tags) to understand whether our ads are effective. These tools are never activated without your consent. See our Cookie Policy for details.

11. Complaints to Datatilsynet

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) under Personopplysningsloven § 1 and GDPR Article 77:

Datatilsynet — www.datatilsynet.no
Postboks 458 Sentrum, 0105 Oslo, Norway
Tel: +47 22 39 69 00

We encourage you to contact us first so we can try to resolve your concern directly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.