Privacy policy
Last updated: [date to be added at launch]
1. Data controller
Handeland Fashion (“we”, “us”) is the data controller for the personal data collected through this website. Handeland Fashion is a personal project run by Ruben Handeland, Stavanger region, Norway. There is no registered company behind the website today, so the data controller is Ruben Handeland personally.
Contact: post@handeland.fashion
2. What information we collect
- Name and email address when you create an account
- Password - we never store your password in plain text. It's hashed with Argon2id before storage, and we can't see your original password.
- Shipping address and any note provided with a preorder
- Order history linked to your account
- Technical information needed for login to work (a login session stored in a cookie)
3. Purpose and legal basis
- Account creation and login: necessary to perform our agreement with you (GDPR Art. 6(1)(b)).
- Processing preorders: necessary to perform or enter into an agreement with you (GDPR Art. 6(1)(b)).
- Security and fraud prevention (e.g. login rate-limiting): legitimate interest (GDPR Art. 6(1)(f)).
4. Cookies
Today we use only one cookie: a strictly necessary login session that keeps you signed in. This is exempt from the consent requirement under section 2-7b of the Norwegian Electronic Communications Act (ekomloven), because it's necessary for the service to work. We don't use analytics or marketing cookies today. If that changes in the future, we'll ask for your consent first.
5. Retention period
Account information is stored for as long as you have an active account with us. Information related to completed purchases (including order data) is stored in accordance with Norwegian bookkeeping law requirements, normally for 5 years after the end of the accounting year. You can ask to have your account deleted at any time, see section 6.
6. Your rights
Under the GDPR you have the right to:
- Request access to the information we hold about you
- Request correction of inaccurate information
- Request deletion of information (unless we're legally required to keep it). You can delete your account yourself under My page - if you've placed an order, we're legally required to keep the order itself for five years, in which case we remove your name and address from it instead.
- Request restriction of processing
- Receive your information in a structured format (data portability)
- Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no)
Contact us to exercise any of these rights: post@handeland.fashion.
7. Sharing with third parties
We never sell your personal data. Once a payment solution (e.g. Stripe or Vipps) is put into use, the information necessary to complete payment will be shared with that provider as a data processor. This policy will be updated when that happens.
8. Security
All traffic to the website is encrypted with HTTPS. Passwords are stored only as Argon2id hashes, never in plain text. Access to production data is limited to people who need it to run the service.