Privacy Policy
This privacy policy explains which personal data Grizzly Games processes, why, and what rights you have. Processing follows the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.
Data controller
Grizzly Games, org. no. (oppdateres), (oppdateres). Privacy contact: (oppdateres).
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering orders, customer service, returns and complaints | Name, address, email, phone, ordered items, order history, correspondence | Contract (GDPR Art. 6(1)(b)) | As long as needed to complete the purchase and handle claims, normally until the complaint period ends |
| Accounting | Order and payment details, receipts | Legal obligation (Art. 6(1)(c)), Norwegian Bookkeeping Act | 5 years after the end of the financial year |
| Customer account (optional) | Name, email, password (encrypted), addresses, order history | Contract (Art. 6(1)(b)) | Until you delete the account |
| Newsletter (optional) | Email address, time of consent, language | Consent (Art. 6(1)(a)) | Until you unsubscribe |
| Product reviews | Name, email, the review | Consent (Art. 6(1)(a)) | Until you ask for deletion |
| Security, fraud prevention and running the website | IP address, technical logs, browser type | Legitimate interest (Art. 6(1)(f)) | Short term, in line with the host’s logs |
| Statistics and marketing (only with consent) | Cookies and usage data | Consent (Art. 6(1)(a)), Electronic Communications Act | See cookie policy |
We never store your card number. Card details are processed directly by the payment provider.
Who we share data with
- Payment providers (for example Stripe or Vipps MobilePay, depending on the method you choose) – to complete and secure the payment. They are independent controllers for their own processing.
- Carrier ((oppdateres)) – name, address, phone and email to deliver the parcel and notify you.
- Web host (Hostinger) – hosting the website and database, as a data processor.
- Bunny Fonts (BunnyWay d.o.o., Slovenia) – fonts are loaded from fonts.bunny.net, which technically receives your IP address. The service sets no cookies.
- Google (Analytics and Ads) – only if you have consented to analytics or marketing cookies.
- Accountant and public authorities – where required by law.
We never sell personal data. If data is transferred outside the EEA (for example to the USA), this happens on a valid transfer basis such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Your rights
- Access to the data we hold about you
- Rectification of incorrect data
- Erasure of data we no longer need or are not entitled to process
- Restriction of processing
- Data portability – receiving your data in a machine-readable format
- Objection to processing based on legitimate interest
- Withdrawing consent at any time, without affecting processing before the withdrawal
To request access or deletion: email (oppdateres). We reply within 30 days and may ask you to confirm your identity. Data we must keep under the Bookkeeping Act cannot be deleted before the retention period ends.
You can unsubscribe from the newsletter at any time by contacting us. Cookie consent can be changed at any time:
Complaints
If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet). We appreciate it if you contact us first so we can put things right.
Changes
We may update this policy when our service or the rules change. The current version is always available on this page.