This is a courtesy translation. The Norwegian version applies.
1. Controller
Naing ENK, org. no. 932315610, is the controller for personal data collected through viafolk.no. Contact: kontakt@viafolk.no.
2. What we collect
- Organiser: email address, chosen occasion, delivery date and cover image.
- Recipient: name and email address, provided by the organiser.
- Contributor: display name, greeting, photos you upload, email address if you choose to give it (for receipts and refunds), and the payment reference from Vipps or Stripe. We never store card numbers.
- Waitlist: email address and consent text.
- Technical: IP address and timestamp on submission, used to prevent abuse.
We strip metadata (EXIF, including GPS location) from every uploaded photo.
3. Purposes and legal basis
- Delivering the service: creating, sharing and delivering the card, processing payments and refunds. Basis: contract (GDPR article 6(1)(b)).
- Processing the recipient’s name and email, given by the organiser, in order to deliver the card. Basis: legitimate interest (article 6(1)(f)). The recipient can ask us to delete the data.
- Notifying the waitlist about launch. Basis: consent (article 6(1)(a)).
- Meeting bookkeeping obligations for payments. Basis: legal obligation (article 6(1)(c)).
- Preventing abuse and securing the service. Basis: legitimate interest.
4. Processors
We use the following providers, who process data on our behalf:
- Vercel Inc. (hosting and image storage)
- Neon Inc. (database)
- Upstash Inc. (queue and rate limiting)
- Vipps MobilePay AS (payments)
- Stripe Payments Europe Ltd. (card payments)
- Email provider (sending email)
Some providers process data outside the EEA. Transfers rely on the EU Commission’s standard contractual clauses or equivalent safeguards.
5. Retention
- Photos are deleted 12 months after delivery. This is also shown in the service.
- Greetings and the card are kept as long as the recipient has access, and deleted on request.
- Payment references are kept as long as the Bookkeeping Act requires (five years).
- Waitlist addresses are deleted at launch or when you ask.
- IP addresses are deleted within 30 days.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest. Consent can be withdrawn at any time. Email kontakt@viafolk.no and we reply within 30 days. The organiser can also delete greetings and photos from their card page.
If you believe we process personal data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).
7. Cookies
We use only necessary cookies: for organiser login, so you can edit your own greeting from the same device, and for language choice. No third-party tracking.
8. Changes
We update this policy as needed. The date at the top shows the latest change.