Privacy policy
Version 2026-08-12
This policy fulfils the information duty in GDPR article 13. We have written it so it can actually be read.
The short version
- We never ask for your name, address or phone number.
- We need your email address to deliver what you bought. It is stored encrypted.
- We never see your card number. Only the payment partner handles it.
- IP addresses are never stored in clear text — only as a one-way hash, for max 90 days.
- We have no third-party tracking. No Google Analytics, no Meta Pixel.
- Our analytics cannot follow you from one day to the next.
1. Data controller
Volum Media ENK, company no. 932 660 899, Linderngata 2, 0455 Oslo.
Privacy enquiries: personvern@mija.no
We have no data protection officer. The requirement in article 37 does not apply, because we are neither a public authority, nor carry out large-scale systematic monitoring, nor process special categories of personal data.
2. What we process, why, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address (encrypted + hashed) | Deliver the purchase, send the receipt, handle defect claims | Art. 6(1)(b) — performance of the contract | 5 years, then anonymised |
| Order data: amount, currency, country code, timestamp | Accounting and VAT documentation | Art. 6(1)(c) — legal obligation (Norwegian Bookkeeping Act s. 13) | 5 years |
| Documentation of the withdrawal waiver | Proving the statutory conditions for the waiver were met | Art. 6(1)(c) | 5 years |
| Download events (hashed IP and browser) | Preventing sharing and abuse of download links | Art. 6(1)(f) — legitimate interest | 90 days |
| Consent log (choice, version, hashed IP) | Documenting consent, cf. art. 7(1) | Art. 6(1)(c) | 26 months |
| Analytics (daily rotating session hash) | Seeing which wallpapers people look at | Art. 6(1)(a) — consent | 14 months |
3. How we protect your email address
The address is stored twice, and neither copy is readable in the database: once as a one-way hash (HMAC-SHA256 with a secret key) for lookup, and once encrypted (AES-256-GCM) so we can resend your receipt if you ask. If someone gets the database without the key, they get no addresses.
4. Who we share with
| Recipient | What they receive | Role |
|---|---|---|
| Payment partner (merchant of record) | Email, payment details, country code | Independent controller — they are the legal seller |
| Supabase (database and file storage, EU region) | Everything stored | Processor, data processing agreement in place |
| Netlify (hosting the site) | Technical logs | Processor |
| Resend (sending email) | Email address and the contents of the receipt | Processor |
We never sell personal data, and we do not share it for marketing purposes — neither ours nor anyone else’s.
5. Transfers outside the EEA
The database and files are in the EU. Some suppliers are American. For those we base the transfer on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU standard contractual clauses together with a transfer impact assessment. You can request a copy of the basis.
6. Your rights
You have the right of access (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), data portability (art. 20) and to object (art. 21). You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
We reply within one month, cf. art. 12(3). If we need more time, you hear from us within that same month. It costs nothing.
Send the request via the form on My orders or to personvern@mija.no.
One limit on erasure
Sales documentation must be kept for five years under the Norwegian Bookkeeping Act section 13. We therefore cannot delete purchase data before that period ends. The basis is GDPR article 17(3)(b). Everything else — download history, access, analytics — is deleted immediately, and purchase data is anonymised automatically once the period has passed.
7. Complaints
You may complain to the Norwegian Data Protection Authority. We would appreciate hearing from you first, but it is not a requirement.
8. Automated decisions
We use AI to make the images and to write social media posts. We do not use automated decisions or profiling that has legal effect on you or significantly affects you, cf. article 22. The price is the same for everyone.
9. Cookies
See the separate page about cookies.