Privacy policy

This Privacy Policy explains how Norway-vps.com collects and uses personal data when you visit norway-vps.com, create an account or use our virtual private server (VPS) services. We are the data controller for the processing described in this policy, except where section 7 says that we act as a processor.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) as implemented in Norway through the Personal Data Act (personopplysningsloven).

1. Contact
If you have questions about this policy or want to exercise your rights, contact us at support@norway-vps.com

2. What personal data we collect
Account and contact data. Name, email address, phone number (if provided), company name and organisation number (for business customers), billing address, country, and login credentials (passwords are stored hashed, never in plain text). Two-factor authentication details and SSH public keys you upload.

Order and billing data. Which services you order, plan and price, invoices, payment status and history. We do not store full payment card numbers. Card and wallet payments are handled by our payment providers (see section 5).

Technical and usage data. IP addresses used to log in to your account, browser and device information, timestamps, actions in the control panel, and security logs. For your Servers, we collect resource usage and traffic statistics (such as CPU, memory, disk, and amount of network traffic) for operations, billing and enforcement of plan limits.

Network and abuse-handling data :
IP addresses assigned to your Servers, and information we receive in abuse complaints, from our upstream provider, or from authorities, together with our records of how we handled the matter.

Support communication :
Messages and attachments you send to us by email or through support tickets.

Website data :
Limited data collected when you visit our website, such as IP address, pages visited and referrer. See section 9 on cookies.
We do not intentionally collect special categories of personal data (such as health data) and ask you not to send them to us.

3. Why we use your data and our legal basis
• To provide the Services and manage your account (create and operate Servers, provide the control panel, give support). Legal basis: performance of a contract, GDPR Article 6(1)(b).
• To process orders, payments and invoices. Legal basis: performance of a contract, Article 6(1)(b).
• To meet legal obligations, such as bookkeeping and accounting rules, tax law, and requests from authorities. Legal basis: legal obligation, Article 6(1)(c).
• To keep the platform secure and prevent fraud and abuse, including monitoring for attacks, handling abuse complaints, and suspending misuse. Legal basis: our legitimate interest in protecting our network, our customers and ourselves, Article 6(1)(f).
• To communicate with you about your Services, such as notices about maintenance, billing, security and changes to our terms. Legal basis: performance of a contract and legitimate interest, Article 6(1)(b) and (f).
• To improve our services and website, using aggregated or limited usage data. Legal basis: legitimate interest, Article 6(1)(f).
• To send marketing emails, only if you have opted in or where the law allows it for similar products. You can unsubscribe at any time. Legal basis: consent, Article 6(1)(a), or legitimate interest, Article 6(1)(f), together with the Norwegian Marketing Control Act.
• To establish, exercise or defend legal claims. Legal basis: legitimate interest, Article 6(1)(f).
Where we rely on legitimate interest, we have weighed our interests against your rights and freedoms. You can ask us for details about that assessment.
4. How long we keep your data
We keep personal data only as long as necessary for the purposes above.
• Account data: for as long as you have an account, and for [12] months after the end of the customer relationship in case of questions, disputes or reactivation, unless a longer period is required by law.
• Billing and accounting records: for the period required by the Norwegian Bookkeeping Act (bokføringsloven), currently five years after the end of the financial year.
• Security and access logs: for [90] days, unless they relate to an incident or abuse case, in which case we keep them as long as needed to handle it.
• Support communication: for [24] months after the case is closed.
• Server data: see our Terms and Conditions. After termination, we delete your Server data permanently after the retention period stated there.
• Marketing: until you withdraw your consent or unsubscribe.
We will delete or anonymise data when it is no longer needed.

5. Who we share data with
We do not sell your personal data. We share it only as described here.
• Service providers (processors) that help us run the service, under data processing agreements, such as: payment providers (for example Stripe and PayPal), email and support tools, billing and accounting software, hosting and infrastructure providers, and monitoring tools.
• Internet and network providers. Our upstream provider may receive information about IP address usage, for example in abuse cases.
• Authorities and courts, when required by law, a court order, or to protect rights, property or safety.
• Professional advisers, such as accountants, auditors, lawyers and insurers, who are bound by confidentiality.
• Business transfers, if we sell or restructure the business. We will notify you if your data is transferred and becomes subject to a different policy.

6. Transfers outside the EU/EEA
We aim to keep personal data within the EU/EEA. If a provider processes data in a country outside the EU/EEA, we ensure an adequate level of protection, for example through an EU adequacy decision, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework, as applicable. You can ask us for a copy of the safeguards used.

7. Data stored on your Server
The content of your Server (files, databases, emails, logs and everything else you store or process on it) is yours. If that content includes personal data about other people, you are the controller (or a processor acting for your own client) and are responsible for complying with data protection law. In that situation we act as your processor. We process that data only to provide the hosting service on your instructions, and we do not look at it except where needed for operation, security, abuse handling, support at your request, or where law requires it. We can provide a data processing agreement (DPA) on request. You can contact us at support@norway-vps.com to obtain one.

8. Security
We use technical and organisational measures to protect personal data, including access controls, encrypted connections for the control panel, network segmentation, logging and regular updates. No system is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the Norwegian Data Protection Authority (Datatilsynet) as the law requires.

9. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary for the website and control panel to work, for example to keep you logged in and to protect against attacks.
We will ask for your consent before setting any cookies that are not strictly necessary, as required by the Norwegian Electronic Communications Act (ekomloven).

10. Your rights
Under the GDPR you have the right to:
• Access the personal data we hold about you and get a copy of it.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted, where the law gives you that right. We may have to keep some data, for example accounting records.
• Restriction: ask us to limit how we use your data in certain cases.
• Data portability: receive data you gave us in a structured, commonly used and machine-readable format, where we process it based on contract or consent.
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where processing is based on consent. This does not affect processing before withdrawal.
To exercise your rights, contact us at support@norway-vps.com. We will respond without undue delay and within one month. We may ask you to verify your identity first. There is normally no charge.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no, or with the supervisory authority in the country where you live or work. We would appreciate the chance to resolve your concern first.

11. Automated decisions
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling. We may use automated tools for fraud detection and security. If this results in a suspension, you can ask for a human review.

12. Children
Our services are not directed at persons under 18, and we do not knowingly collect personal data from them. If you believe a child has provided data to us, contact us and we will delete it.

13. Changes to this policy
We may update this policy when our services or the law change. We will publish the new version on this page with a new date. For material changes, we will notify you by email or through the control panel before they take effect.

Imprint · Privacy · Terms