Privacy Policy

Last updated: 3 August 2026

1. Data Controller

Hagekrets AS
Markveien 35, 0554 Oslo, Norway
Email: [email protected]
Phone: +47 22 35 71 40

Hagekrets AS is the data controller responsible for the processing of personal data described in this policy, in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

2. Scope

This Privacy Policy applies to all personal data we collect through our website (hagekrets.no), contact forms, email correspondence, telephone communication, site visits, and contractual relationships with clients. It does not apply to third-party websites linked from our site.

3. Categories of Personal Data We Collect

3.1 Identity and contact data

Full name, postal address, email address, telephone number, and property address in Oslo or surrounding areas.

3.2 Project and inquiry data

Descriptions of your garden project, plot dimensions, photographs of your property (with your consent), site assessment notes, and correspondence related to proposals and plans.

3.3 Financial and transaction data

Invoice details, payment records, bank transfer references, and billing address. We do not store full credit card numbers on our systems.

3.4 Technical and usage data

IP address, browser type, device information, pages visited, time spent on pages, and referral source. See our Cookie Policy for details on cookies and similar technologies.

3.5 Communication records

Email threads, contact form submissions, and notes from telephone conversations related to your inquiry or project.

4. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to deliver garden planning services, prepare proposals, and fulfil our contractual obligations.
• Legitimate interests (Art. 6(1)(f)): Responding to inquiries, improving our services, maintaining business records, and ensuring website security. Our legitimate interests do not override your fundamental rights.
• Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for marketing communications or non-essential cookies. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with Norwegian accounting, tax, and regulatory requirements.

5. Purposes of Processing

We use your personal data for the following purposes:

• Responding to contact form submissions and scheduling site reviews
• Preparing and delivering garden planning proposals and final plans
• Conducting on-site assessments at your Oslo property
• Processing invoices and managing payment
• Communicating about project progress, revisions, and delivery
• Maintaining client records and project archives
• Improving our website and services through anonymised analytics
• Complying with legal and regulatory obligations
• Sending service-related notifications (not marketing) about your active project

6. Data Retention

We retain personal data only for as long as necessary for the purposes described above:

• Inquiry data: Up to 24 months from last contact if no contract is entered into.
• Contract and project data: Duration of the project plus 5 years, in accordance with Norwegian accounting requirements.
• Financial records: 5 years from the end of the fiscal year, as required by the Norwegian Bookkeeping Act.
• Marketing consent records: Until consent is withdrawn, plus 12 months for audit purposes.
• Website analytics: Up to 26 months in anonymised or pseudonymised form.
• Communication records: Duration of the business relationship plus 3 years.

After the retention period, data is securely deleted or anonymised.

7. Data Sharing and Recipients

We do not sell your personal data. We may share data with the following categories of recipients where necessary:

• Service providers: IT hosting, email services, accounting software, and payment processors bound by data processing agreements.
• Professional advisors: Accountants and legal counsel bound by confidentiality obligations.
• Recommended contractors: Only with your explicit consent, and limited to information necessary for implementation of your garden plan.
• Public authorities: Where required by law, court order, or regulatory request.

All processors are required to implement appropriate technical and organisational measures to protect your data.

8. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If we transfer data to countries outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or adequacy decisions. You may request details of any such transfers by contacting us.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data where there is no compelling reason for continued processing.
• Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal effects.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Right to Lodge a Complaint

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet):

Datatilsynet
Postboks 458 Sentrum, 0105 Oslo
Website: www.datatilsynet.no

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, secure storage, and staff training on data protection. While we take reasonable precautions, no method of transmission over the internet is completely secure.

12. Children's Data

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact

For questions about this Privacy Policy or to exercise your data protection rights:

Hagekrets AS
Markveien 35, 0554 Oslo, Norway
Email: [email protected]
Phone: +47 22 35 71 40