Privacy and cookies

Enquiries

GUMPEN GUNDERSEN WEB (Guwe) is the controller. Contact details are below. When you contact us, we use your name or company name, email address and message to respond and follow up. Contact is voluntary, but these fields are required to submit the form. Avoid sensitive information.

The basis is taking steps before a contract with you (GDPR Art. 6(1)(b)), or our legitimate interest in answering other enquiries (Art. 6(1)(f)). Closed enquiries that do not become projects are deleted within 12 months of the last substantive contact, or earlier when no longer needed. Necessary project, accounting or dispute records are kept separately according to their purpose and applicable obligations.

Visits and analytics

Cloudflare processes IP addresses and requests to deliver and protect the website, based on our legitimate interest in secure operation (Art. 6(1)(f)). Our Cloudflare logs are disabled. Browsers may still send connection-error reports to Cloudflare.

With your consent to statistics (Art. 6(1)(a)), we use PostHog in the EU to measure page views and time on page, where the visit came from (referring website, campaign parameters such as utm_source, and whether the visit came from a Google ad), clicks on buttons and links to contact, pricing, services and other websites, and whether the contact form is started, fails or is sent. Events contain browser and session identifiers, page paths, device information and language. Events are sent through our own domain without your IP address, and IP enrichment is disabled. Names, email addresses, messages, form contents and ad click IDs are not sent to analytics. We do not use session recordings or automated individual decisions.

With your consent to ad measurement (Art. 6(1)(a)), we load the Google Ads tag to measure whether clicks on our ads lead to enquiries. Google then receives information such as your IP address, browser details, the page address and any ad click ID, and may process it in the USA under Google's terms. We turn off remarketing, personalised ads and Google Analytics. Without this consent the tag is not loaded.

Analytics events are deleted within 12 months of collection. Reject or withdraw consent below without losing website access. Withdrawal stops new analytics but does not delete earlier events or affect the lawfulness of earlier processing. PostHog also supplies shared navigation settings without receiving visitor details.

Providers and storage

Resend delivers enquiries to Google Workspace, where we handle email. Our Resend Free plan retains email and logs for 30 days and backups for seven days. Google has separate recovery and deletion periods; mailbox deletion does not immediately remove every provider copy.

Resend stores data in the USA. Google Workspace, Cloudflare and PostHog subprocessors may process data outside the EEA. Provider terms describe transfer safeguards, including EU standard contractual clauses where applicable. Contact us for a copy and information about the safeguards for your data.

Cookies

Necessary storage: guwe_consent remembers your statistics and ad measurement choices for 180 days. SvelteKit stores navigation state for the browser tab session (sveltekit:history-info, sveltekit:snapshot and sveltekit:navigation-snapshot).

After consent to statistics, PostHog uses first-party cookies ph_<project-token>_posthog (visitor and session identifiers) and __ph_opt_in_out_<project-token> (analytics choice), with a renewable 180-day lifetime. ph_<project-token>_window_id, ph_<project-token>_primary_window_exists, ph_<project-token>_posthog and ph_<project-token>_session_registered_properties use tab session storage. After consent to ad measurement, Google Ads sets _gcl_au and possibly _gcl_aw for up to 90 days. Rejection or withdrawal removes these identifiers; a preference marker may remain. None of this starts before consent.

Your rights

Contact us for access, correction, deletion or restriction. You may object to processing based on legitimate interests; we can explain the balancing assessment. Portability applies when its conditions are met for automated processing based on consent or contract. We may need information to locate your data and verify your request.

We respond free of charge without undue delay, normally within one month. For a lawful extension, we explain the reason within that deadline. You can complain to the Norwegian Data Protection Authority (Datatilsynet). We notify you of material processing changes before they take effect.

• Datatilsynet