Onezipp Norge AS · Oslo · clients in Norway, the EU and the US[email protected]+47 93 94 08 70
AutomationWebshop (Medusa)PricingAboutContactLet's Talk

Privacy Policy

Last updated: March 1, 2026

This Privacy Policy explains how Onezipp Norge AS ("Company", "we", "us", or "our") collects, uses, stores, and protects your personal data when you visit onezipp.com or engage our automation services. We are committed to GDPR compliance and transparent data handling.

1. Data Controller

The data controller responsible for the processing of your personal data is:

2. Data We Collect

2.1 Information You Provide Directly

  • Contact information: Name, email address, phone number, company name when you book a call, fill in a contact form, or email us
  • Project information: Business process details, technical requirements, and integration specifications shared during consultations
  • Payment information: Invoicing details and payment records processed via our accounting systems

2.2 Information Collected Automatically

  • Analytics data: Page views, session duration, referrer source, browser type, screen resolution, and approximate geographic location (country-level)
  • Technical data: IP address (anonymised where possible), device type, operating system

3. How We Use Your Data

Purpose Legal Basis (GDPR)
Responding to enquiries and booking calls Legitimate Interest (Art. 6(1)(f))
Delivering automation services under a contract Contractual Necessity (Art. 6(1)(b))
Sending project updates and service communications Contractual Necessity (Art. 6(1)(b))
Processing payments and invoicing Contractual & Legal Obligation (Art. 6(1)(b), (c))
Website analytics and performance monitoring Legitimate Interest (Art. 6(1)(f))
Improving our website and services Legitimate Interest (Art. 6(1)(f))

4. Analytics & Cookies

4.1 Umami Analytics

We use Umami, a privacy-focused, open-source analytics platform that is self-hosted on our own infrastructure. Umami does not use cookies, does not collect personal data, and does not track users across websites. All analytics data is anonymised and aggregated. No personal information is shared with third parties through our analytics.

4.2 Cal.com Scheduling

When you book a call, we use Cal.com for scheduling. Cal.com processes the information you voluntarily enter (name, email, optional notes) to create a calendar event. Please refer to Cal.com's Privacy Policy for their data handling practices.

4.3 Cookies

Our website uses minimal cookies. We do not use advertising cookies, tracking cookies, or third-party marketing cookies. Essential cookies may be set by third-party services (Cal.com, chat widget) strictly for functionality purposes.

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with:

  • Service providers: Hosting providers, email services, and invoicing tools necessary to deliver our services — all bound by data processing agreements
  • Legal requirements: When required by law, court order, or regulatory authority
  • Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction

6. Data Retention

  • Contact enquiries: Retained for 12 months after last interaction, then deleted
  • Client project data: Retained for the duration of the engagement plus 24 months for support and warranty purposes
  • Financial records: Retained for the minimum period required by Norwegian tax law (currently 5 years)
  • Analytics data: Automatically aggregated and anonymised; no personal data is retained

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

  • Right of Access (Art. 15): Request a copy of the personal data we hold about you
  • Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
  • Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
  • Right to Restrict Processing (Art. 18): Request limited processing of your data
  • Right to Data Portability (Art. 20): Receive your data in a structured, commonly used format
  • Right to Object (Art. 21): Object to processing based on legitimate interest

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

8. Protecting Your Data

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption in transit (TLS 1.3) and at rest
  • Access controls and role-based permissions
  • Self-hosted infrastructure where possible to minimise third-party data exposure
  • Regular reviews and updates of these measures
  • Employee confidentiality agreements

9. International Data Transfers

Onezipp operates from Norway (within the EEA). Where data is processed outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or an adequacy decision.

10. Children's Data

Our services are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

11. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet):

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact

For any privacy-related enquiries, contact us: