Privacy Policy

Norway Domain is the data controller for personal data collected through this website and in the course of providing the .no trustee and registration service.

Trading name

Norway Domain

Organisation number

The organisation number is shown in full above, as an image rather than text to deter scraping. It is also listed at Brønnøysundregistrene.

Address

Email

contact@norwaydomain.no

Website

norwaydomain.no

This policy is written under Regulation (EU) 2016/679, the General Data Protection Regulation, as incorporated into Norwegian law by the Personal Data Act.

Only what the service genuinely needs.

Identity and contact

• Your name, as given at order or registration.
• Your email address, for order confirmation, renewal notices and support.
• Your phone number, where you give it for a callback or support.
• A postal address, where one is needed for invoicing.

Service and transaction

• The domains registered for you, with registration and renewal dates.
• Order history, invoices and payment references. We never store card details, Stripe handles those.
• DNS and nameserver settings for your domain.
• Support correspondence between us.

Technical

• IP address and browser type, collected automatically by the web server.
• Pages visited and referring URL, for understanding how the site is used.
• Cookie identifiers, where applicable, as described in the cookies section.

• From you. When you order, submit a form, or email us.
• Automatically. Ordinary web server logs when you visit the site.
• From Norid. Administrative data exchanged while registering and maintaining your domain.
• From Stripe. A transaction reference after payment. We never receive your card number.

For running the service and nothing else. We do not advertise, we do not profile you, and we do not build a picture of you for any purpose unrelated to your domain.

• Registering your domain with Norid, managing DNS, handling renewals and maintaining your account.
• Communicating with you: order confirmations, renewal reminders, support replies, service notices.
• Taking payment and keeping financial records as Norwegian accounting law requires.
• Meeting our legal obligations under Norid's rules and Norwegian law.
• Responding to a lawful request from a court, regulator or law enforcement body.
• Understanding, in aggregate and anonymised form, how the website is used so it can be improved.

Performing a contract

Using your name, contact details and domain information to deliver the service you ordered.

Legal obligation

Keeping financial records under Norwegian accounting law, meeting Norid's registration requirements, answering lawful requests.

Legitimate interests

Basic technical and usage data to keep the site secure and working, where that does not override your rights.

Consent

Optional cookies, where used. You can withdraw consent at any time without affecting what happened before.

We do not sell, rent or trade your personal data. It is shared only where the service cannot work otherwise.

• Norid. The registry receives the administrative data required to register, renew or transfer a domain. This is unavoidable.
• Stripe. Our payment processor. Card details go directly to Stripe and never touch our systems. We receive a transaction reference.
• Our form and email provider. Messages you send through the website are delivered to us by a third party form service, and your email address is used to reply.
• Authorities. Where a binding legal obligation, court order or lawful request requires it.
• A successor. If the business is sold or merged, data may pass to the buyer under equivalent protection.

We are based in Norway, inside the European Economic Area. Where data goes to a provider outside the EEA, such as a payment or email service, we rely on safeguards permitted under Chapter V of the GDPR, which in practice means an adequacy decision or Standard Contractual Clauses. Ask us at contact@norwaydomain.no if you want the detail for a specific transfer.

Account and contact details

For as long as the service is active, plus five years afterwards.

Financial and invoicing records

Five years from the end of the financial year, as Norwegian accounting law requires.

Support correspondence

Three years from the last message, unless a dispute needs it longer.

Technical and usage data

Raw server logs no longer than 90 days. Aggregated statistics up to 12 months.

Contact and callback form data

Six months, unless it turns into an ongoing service relationship.

Under the GDPR and the Norwegian Personal Data Act you can ask us to do the following, and we will respond within 30 days, free of charge.

• Access. Get a copy of the personal data we hold about you and how it is used.
• Rectification. Have anything inaccurate or incomplete corrected.
• Erasure. Have data deleted where we no longer need it, subject to legal retention rules.
• Restriction. Have processing paused in certain situations, such as while a dispute is settled.
• Portability. Receive your data in a structured, machine readable format.
• Objection. Object to processing based on legitimate interests.
• Withdraw consent. At any time, where consent was the basis.

Write to contact@norwaydomain.no. We may ask you to confirm who you are first. If you are unhappy with our answer, you can complain to Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no.

A cookie is a small file a site leaves on your device so it can recognise it next time or remember a setting.

• Strictly necessary. Needed for the site to function, including keeping your session together during checkout. These cannot be switched off without breaking things.
• Analytical. Where used, these tell us in anonymised form which pages get visited. Nothing that identifies you personally.
• Third party. Services built into the site, such as the payment processor, may set their own cookies under their own policies.

We do not use cookies for advertising, retargeting or behavioural tracking. There is nothing on this site following you around the internet afterwards.

Data travels over HTTPS, access to personal data is limited to what the job needs, and account credentials are handled carefully. Payment data never reaches our systems at all, which removes the largest risk entirely.

If a breach happens that is likely to put your rights at risk, we will notify Datatilsynet within 72 hours of becoming aware of it, and tell you without undue delay where the law requires.

No system on the internet is perfectly secure, and we would rather say that plainly than pretend otherwise.

The service is not for anyone under 18 and we do not knowingly collect data from minors. If you think we have, email contact@norwaydomain.no and we will delete it promptly.

We may update this policy when the law, our processing or Norid’s requirements change. Material changes are emailed to existing clients at least 14 days before they take effect, and the revised policy is published here with a new date.

Email

contact@norwaydomain.no

Contact form

norwaydomain.no/contact

Supervisory authority

Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway. datatilsynet.no

You are entitled to complain to Datatilsynet at any time, but we would appreciate the chance to put something right first.