Villfaret respects your privacy and processes personal data in accordance with the UK and EU General Data Protection Regulation (GDPR) and applicable data protection law. This document explains what personal data we collect, why we collect it, how we use it, and your rights.

Data we collect when you use our contact form or purchase a service from us:

• Identity data: name, title.

• Contact data: email address, postal address, telephone number.

• Transaction data: payment details and records of purchases or donations (payment data processed via third-party providers).

• Technical data: IP address, device and browser information, cookies and similar tracking technologies.

• Communications: correspondence, enquiries, support requests, and any content you provide when you contact us.

Legal bases for processing

We process personal data only where we have a lawful basis:

• Performance of a contract: to provide goods, services, deliveries or subscriptions you request.

• Legal obligation: to comply with legal or regulatory requirements.

• Legitimate interests: for purposes such as improving our website, preventing fraud, and administering our business (we will balance our interests against your rights).

• Consent: where you have given clear consent (for example for marketing or certain cookies).

• Vital interests: where necessary to protect someone’s life in an emergency.

How we use your data

• To provide and manage services, purchases, subscriptions and bookings.

• To process payments and prevent fraud.

• To communicate about orders, updates, enquiries and support.

• To send marketing communications where you have consented or where we have a legitimate interest and you have not opted out.

• To administer surveys, research, and other activities related to our work.

• To comply with legal obligations and respond to lawful requests from authorities.

• To improve and secure our website and services.

Sharing your data

We may share data with:

• Service providers and processors (payment processors, hosting, email and marketing platforms, analytics providers) who act only on our instructions.

• Professional advisers, auditors and insurers where necessary.

• Legal or regulatory authorities if required by law.

• Other third parties with your consent.

International transfers

Some service providers may process data outside Norway, the UK or EEA. Where we transfer data internationally we will ensure appropriate safeguards are in place (such as adequacy decisions, standard contractual clauses, or other legally recognised measures).

Data retention

We retain personal data only as long as necessary for the purposes set out in this policy, or to meet legal, regulatory or tax obligations. Retention periods vary by data type; typical periods range from the duration of your relationship with us plus a limited period afterwards, to statutory retention periods required by law.

Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. While we strive to protect your data, no system is completely secure; we cannot guarantee absolute security.

Cookies and tracking

We use cookies and similar technologies to operate our website, enhance user experience and measure performance. You can control cookie preferences via your browser settings and any consent mechanisms provided on our site.

Your rights

You have rights under data protection law subject to legal conditions, including:

• Right of access: obtain copies of your personal data.

• Right to rectification: correct inaccurate or incomplete data.

• Right to erasure: request deletion of your data in certain circumstances.

• Right to restriction: request limitation of processing in certain circumstances.

• Right to data portability: receive your data in a structured, commonly used format where applicable.

• Right to object: object to processing based on legitimate interests or direct marketing.

• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact us using the details above. We will respond within the timeframes required by law. You also have the right to lodge a complaint with a supervisory authority.

Children

We do not knowingly collect personal data from children under 16 without parental consent. If you believe we have collected such data, please contact us to request deletion.

Changes to this policy

We may update this policy from time to time. We will publish the revised policy on our website with the date of last revision.

Last updated 08/09/2026