Privacy policy

What we collect 02

• Contact form — name, email address, and whatever you write in the message, so we can reply to you.
• Purchases — billing name, email, and address, plus a record of what you bought and when, stored in our WooCommerce order history.
• Payment details — handled directly by PayPal and/or WooCommerce Payments (see below). We never see or store your full card or PayPal account details ourselves.
• Withdrawal-right waiver — for downloadable products, we record that you ticked the box waiving your 14-day right of withdrawal, together with the exact wording shown, a timestamp, your IP address, and browser (user agent) string. This is kept solely as evidence in case the waiver is ever disputed.
• Cookies — strictly functional cookies used to keep track of your shopping cart and checkout session. No advertising or analytics cookies are used on this site.

Why, and on what basis 03

• Purchase and billing data: to fulfil the sales contract with you (GDPR Art. 6(1)(b)) and to meet Norwegian bookkeeping requirements, which require us to retain sales records for 5 years.
• Contact form data: to respond to your enquiry, on the basis of our legitimate interest in providing support (Art. 6(1)(f)).
• Withdrawal-right waiver evidence (text shown, timestamp, IP, user agent): our legitimate interest in being able to demonstrate compliance with consumer-law consent requirements if a waiver is ever challenged (Art. 6(1)(f)), retained for as long as the related order record is kept.
• Cart/session cookies: strictly necessary for the checkout to function — no consent banner is shown for these, as permitted under the ePrivacy exemption for functional cookies.

Who we share it with 04

• PayPal and/or WooCommerce Payments — process your payment directly; each acts as an independent data controller for the payment details you give them.
• One.com — our hosting provider, which stores the underlying website and database as a data processor on our behalf.

We do not sell or rent your data to anyone, for any reason.

Your rights 05

Under GDPR you can ask us to access, correct, or delete your personal data, or ask us to restrict or object to how we use it. Email administrator@masaga.no to make a request. If you’re not satisfied with our response, you can complain to the Norwegian Data Protection Authority (Datatilsynet).