Privacy
What we collect, why, and your rights.
What we collect
Order details (name, email, shipping address), and your purchase history. We do not store full payment card details — those go directly to our payment provider.
Why & who processes it
To fulfil your order and provide support. We share what's necessary with our processors: our payment provider (Stripe, to take payment) and our fulfilment partner (Printful, to make and ship your order). They act on our instructions under data-processing agreements.
Transfers outside the EEA
Some processing happens outside the EEA: payment via Stripe (USA) and, for some orders, fulfilment via Printful (USA/EU). Where personal data goes to the USA it is safeguarded by the EU Commission's adequacy decision under the EU–US Data Privacy Framework and/or the Commission's Standard Contractual Clauses. Ask us for a copy of the safeguards at halla@midhats.no.
How long we keep it
As long as needed to run the shop and meet accounting/tax obligations under Norwegian law (typically 5 years for sales records), then we delete it.
Analytics (our own, no cookies)
We measure how the site is used on our own servers — no Google Analytics, no ad pixels, no cross-site tracking, and nothing stored on your device (so no cookie banner). For each page view we log the page path, the referring site's domain, your device type, your country (a 2-letter code our CDN derives from your IP), and any campaign tags. To count visitors without storing anything on your device, our server makes a short-lived fingerprint by hashing your IP and browser with a key we rotate every 24 hours; we never store your IP and the fingerprint can't be traced back to you. Legal basis: our legitimate interest in privacy-friendly analytics (GDPR Art. 6(1)(f)) — you can object any time at halla@midhats.no.
Your rights (GDPR)
You can ask for a copy of your data (access), ask us to correct or delete it, restrict or object to processing, or receive the data you gave us in a portable format. Email halla@midhats.no. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
Controller
Kveitejakten AS (org.nr. 838 104 932 MVA), Oslo, Norway, is the data controller.