Privacy notice

1. Controller

The legal entity, registration number, address and privacy contact must be inserted before launch. Domenebutikken controls account, purchase, support, security and product operations. Realtime Register processes registrant data on our behalf when supplying registrar services.

2. Data we process

We process account and registrant contact data, order and payment references, domains and DNS settings, and operational and security logs. Stripe processes card data, which Domenebutikken does not store. Norwegian national identity numbers must not be stored in the domain core.

3. Purposes and legal bases

Contract data is used to create accounts, quote, register and manage domains, collect payment and provide support. Accounting data is kept for legal obligations. Necessary security and troubleshooting may rely on documented legitimate interests. Consent-based marketing is optional and revocable.

4. Recipients

Necessary data is shared with the sponsoring registrar and registry, Stripe, Supabase, Vercel, Resend and providers the customer connects. Authorities and dispute bodies receive data where legally required. Registration data may appear in RDAP/WHOIS or be disclosed under applicable policy.

5. Transfers outside the EEA

Actual processing locations and safeguards such as adequacy decisions or EU standard contractual clauses must be documented before launch and described here.

6. Retention

Data is retained while required for the contract, evidence, disputes and legal duties. Accounting records follow statutory periods; logs need fixed deletion schedules. Exact periods will be added after the processing record and supplier agreements are complete.

7. Your rights

You may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent. Some data must remain for legal duties or an active domain. Complaints may be made to the Norwegian Data Protection Authority.

• Norwegian Data Protection Authority

8. Security and changes

We use access controls, encrypted transport, event logging, least privilege and supplier oversight. Material incidents are handled and notified under applicable rules. Material notice changes will be communicated and prior versions retained internally.