Privacy policy
Version 2026-08-12
This policy fulfils the information duty in GDPR article 13. We have written it so it can actually be read.
The short version
- We never ask for your name, address or phone number.
- We need your email address to deliver what you bought. It is stored encrypted.
- We never see your card number. Only the payment partner handles it.
- IP addresses are never stored in clear text — only as a one-way hash, for max 90 days.
- We have no third-party tracking. No Google Analytics, no Meta Pixel.
- Our analytics cannot follow you from one day to the next.
- If you ask for a free wallpaper, we keep your address until you unsubscribe — one click, in every email.
1. Data controller
Volum Media ENK, company no. 932 660 899, Linderngata 2, 0455 Oslo.
Privacy enquiries: personvern@mija.no
We have no data protection officer. The requirement in article 37 does not apply, because we are neither a public authority, nor carry out large-scale systematic monitoring, nor process special categories of personal data.
2. What we process, why, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address (encrypted + hashed) | Deliver the purchase, send the receipt, handle defect claims | Art. 6(1)(b) — performance of the contract | 5 years, then anonymised |
| Order data: amount, currency, country code, timestamp | Accounting and VAT documentation | Art. 6(1)(c) — legal obligation (Norwegian Bookkeeping Act s. 13) | 5 years |
| Documentation of the withdrawal waiver | Proving the statutory conditions for the waiver were met | Art. 6(1)(c) | 5 years |
| Download events (hashed IP and browser) | Preventing sharing and abuse of download links | Art. 6(1)(f) — legitimate interest | 90 days |
| Consent log (choice, version, hashed IP) | Documenting consent, cf. art. 7(1) | Art. 6(1)(c) | 26 months |
| Analytics (daily rotating session hash) | Seeing which wallpapers people look at | Art. 6(1)(a) — consent | 14 months |
| Email address on the wallpaper list (encrypted + hashed) | Sending you the free wallpaper you asked for, and telling you when a new drop goes live | Art. 6(1)(a) — consent | Until you unsubscribe |
3. How we protect your email address
The address is stored twice, and neither copy is readable in the database: once as a one-way hash (HMAC-SHA256 with a secret key) for lookup, and once encrypted (AES-256-GCM) so we can resend your receipt if you ask. If someone gets the database without the key, they get no addresses.
4. The free wallpaper and the email list
Spinning the wheel on the front page requires nothing from you. We only ask for an email address when you want the wallpaper delivered, and only if you tick the box yourself — it is never pre-ticked, because a pre-ticked box is not consent (GDPR art. 4(11)).
We store the address the same way as a purchase: hashed for lookup, encrypted for sending. Alongside it we record what the box said, which version of this policy it pointed to, and when you ticked it. That is our proof under art. 7(1) — and it means we can always show you what you actually agreed to, even if we reword the box later.
Every email has an unsubscribe link, and your mail app can show its own unsubscribe button. One click ends it, we ask nothing, and you keep every wallpaper you downloaded. The list is not sales documentation, so unlike purchase data it can be deleted straight away if you ask.
5. Who we share with
| Recipient | What they receive | Role |
|---|---|---|
| Payment partner (merchant of record) | Email, payment details, country code | Independent controller — they are the legal seller |
| Supabase (database and file storage, EU region) | Everything stored | Processor, data processing agreement in place |
| Netlify (hosting the site) | Technical logs | Processor |
| Resend (sending email) | Email address and the contents of the receipt | Processor |
We never sell personal data, and we do not share it for marketing purposes — neither ours nor anyone else’s.
6. Transfers outside the EEA
The database and files are in the EU. Some suppliers are American. For those we base the transfer on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU standard contractual clauses together with a transfer impact assessment. You can request a copy of the basis.
7. Your rights
You have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), data portability (art. 20) and to object (art. 21). You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
We reply within one month, cf. art. 12(3). If we need more time, you hear from us within that same month. It costs nothing.
Send the request via the form on My orders or to personvern@mija.no.
One limit on erasure
Sales documentation must be kept for five years under the Norwegian Bookkeeping Act section 13. We therefore cannot delete purchase data before that period ends. The basis is GDPR article 17(3)(b). Everything else — download history, access, analytics — is deleted immediately, and purchase data is anonymised automatically once the period has passed.
8. Complaints
You may complain to the Norwegian Data Protection Authority. We would appreciate hearing from you first, but it is not a requirement.
9. Automated decisions
We use AI to make the images and to write social media posts. We do not use automated decisions or profiling that has legal effect on you or significantly affects you, cf. article 22. The price is the same for everyone.
10. Cookies
See the separate page about cookies.