Privacy Policy

Estara Group AS (org. no. 932148013), Tvetenveien 32, 0666 Oslo, Norway, is the data controller for the processing described in this policy.

Questions about privacy can be sent to info@estara.no.

• Account information: name, email address, password (stored only as a secure hash), phone number and saved delivery addresses.
• Wholesale customers: company name, organisation number and contact person details provided in the wholesale application.
• Order information: products purchased, prices, delivery address, chosen shipping and payment method, order status and return requests.
• Payment information: payment status and transaction references. Card details are entered directly with Stripe and Vipps phone numbers with Vipps MobilePay — we never see or store full card numbers.
• Wishlist and shopping cart contents when you are logged in.
• In-store purchases: order details and, if you choose to give them, your name, email or phone number for a receipt.
• Technical data: IP address, browser language and approximate country (used to choose the language of the website), as well as security logs.
• Communication: messages you send us by email or through customer service.

• To process and deliver your orders, handle payments, returns and complaints — necessary to perform our contract with you (GDPR art. 6(1)(b)).
• To create and manage your customer account — performance of contract (art. 6(1)(b)).
• To send order confirmations, shipping updates and other service emails — performance of contract (art. 6(1)(b)).
• To keep accounting records as required by the Norwegian Bookkeeping Act (bokføringsloven) — legal obligation (art. 6(1)(c)).
• To keep the website secure, prevent fraud and fix errors — our legitimate interest in operating a safe service (art. 6(1)(f)).
• To show the website in your preferred language — our legitimate interest in providing a good user experience (art. 6(1)(f)).
• To send newsletters or marketing — only if you have given consent (art. 6(1)(a)). You can withdraw consent at any time.

We do not sell your personal data. We use the following service providers (data processors), who only process data on our behalf and under a data processing agreement:

• Stripe — card payments.
• Vipps MobilePay — mobile payments.
• Vercel — website hosting.
• Neon — database hosting.
• Resend — sending emails.
• Shipping carriers — your name, address and contact details are shared with the carrier delivering your order.

Stripe and Vipps MobilePay are also independent data controllers for some of the processing related to payments, such as fraud prevention and their own legal obligations.

We may also disclose data to public authorities when required by law.

Some of our providers are based in, or may access data from, the United States. In such cases the transfer is based on the EU–U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary.

• Account data is kept as long as you have an account with us. If you delete your account, we delete or anonymise the data unless we are required to keep it.
• Order and payment records are kept for up to 5 years after the end of the financial year, as required by the Bookkeeping Act.
• Data needed to handle complaints is kept until the complaint period has expired (up to 5 years after delivery).
• Security logs are kept for a limited period and then deleted.

We only use cookies and similar technologies that are strictly necessary for the website to work:

• Login session cookies, so you stay signed in.
• A language cookie that remembers your chosen language.
• Security cookies that protect forms against misuse.
• Local storage in your browser used temporarily during Vipps checkout to complete your order.

We do not use cookies for advertising or third-party tracking. Our payment providers may set their own necessary cookies when you pay. If we introduce analytics or marketing cookies in the future, we will ask for your consent first.

You have the right to:

• Access the personal data we hold about you.
• Have incorrect data corrected.
• Have your data deleted, unless we are required to keep it.
• Restrict or object to our processing.
• Receive your data in a portable format (data portability).
• Withdraw any consent you have given.

To exercise your rights, contact us at info@estara.no. We will respond within 30 days. You can also update most account details yourself under "My account".

If you believe we process your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no.

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, access control for staff based on roles, and logging of administrative actions.

Our online store is not intended for children under 16. We do not knowingly collect personal data from children under 16 without consent from a parent or guardian.

We may update this policy from time to time. The latest version is always available on this page, and the date at the top shows when it was last changed. We will notify you of significant changes by email or on the website.

Estara Group AS, Tvetenveien 32, 0666 Oslo, Norway. Email: info@estara.no.