1. General provisions
This privacy policy (hereinafter the "Policy") explains which personal data the website drewmandeldesign.com (hereinafter the "Website", "we") collects, for what purposes it is processed, how it is stored and what rights you have over your own data.
The Website belongs to an interior design studio operating under the domain name drewmandeldesign.com and providing interior design services for residential and commercial properties in Norway.
By using the Website and submitting data through the contact forms, you confirm that you have read this Policy and accept the data processing terms described in it. If you do not agree with any of the provisions of the Policy, we ask you not to send us data through the forms on the Website.
Personal data is processed in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).
2. What data we collect
We follow the principle of data minimisation: we collect only the data that is genuinely necessary to answer your enquiry and to carry out the subsequent work on the project.
2.1. Data you provide deliberately
- Name — so that we can address you properly in our correspondence.
- Email address — the only channel through which we send replies to enquiries.
- Property type (apartment, detached house, office or other) — to pass the enquiry on to the right designer.
- Message text — any information you choose to provide: floor area, location, the current state of the space, style preferences.
- Record of consent — the tick box consenting to the processing of personal data, together with the date and time the form was submitted.
We do not ask for and do not need identity documents, bank details, national identity numbers or other sensitive data. We ask you not to provide such information in the "Message" field.
2.2. Technical data
- IP address and approximate location at country or city level;
- browser type and version, operating system, device type and screen resolution;
- date and time of the visit, the pages you viewed, where you came to the Website from;
- identifiers of cookies and similar technologies.
Technical data is processed in aggregated form and is used to analyse traffic, detect technical faults and protect the Website against automated abuse. More on this in the cookie policy.
2.3. Children's data
The Website is not directed at persons under 16 years of age, and we do not knowingly collect their personal data. If you become aware that a child has given us their data, please let us know at [email protected] — we will delete it as quickly as possible.
3. Purposes and legal bases for processing
| Purpose of processing | Categories of data | Legal basis |
|---|---|---|
| Replying to enquiries sent through the contact form | Name, email, property type, message text | The user's consent |
| Preparing proposals and clarifying the terms of collaboration | Name, email, details of the property | Pre-contractual steps at the data subject's request |
| Project communication while the work is in progress | Contact details, correspondence, data about the property | Performance of a contract |
| Traffic analysis and improvement of the Website | Technical data, cookie identifiers | Legitimate interest / consent to analytical cookies |
| Protecting the Website against spam and automated requests | IP address, technical data about the request | Legitimate interest |
| Compliance with legal requirements and handling of disputes | Correspondence, contract data | Legal obligation / legitimate interest |
4. Retention periods
- Enquiries without further collaboration — up to 12 months from the last email, after which the data is deleted or anonymised.
- Client data for completed projects — for the term of the contract and 3 years after it ends (the limitation period).
- Technical and analytical data — up to 26 months in anonymised form.
- Records of consent given — for the whole duration of the consent and 3 years after it is withdrawn, as evidence that the processing was lawful.
Once the relevant period has expired, the data is deleted from our working systems and backups within the technically possible rotation periods.
5. Who we share data with
We do not sell, rent out or trade your personal data. The following may have access to it:
- Employees and designers of the studio — exclusively to the extent necessary to work on your enquiry;
- Hosting and domain service provider — as the technical operator of the Website's infrastructure;
- Email service provider — for receiving and storing correspondence;
- Web analytics services — in anonymised or pseudonymised form;
- Project subcontractors (visualiser, structural engineer, tradespeople) — only on your explicit instruction and to the minimum extent possible;
- Public authorities — on the basis of a reasoned request drawn up in accordance with the law.
Confidentiality and data processing agreements have been concluded with all subcontractors who process data on our behalf.
6. Transfers abroad
Some technical services (hosting, email, analytics) may store data on servers outside Norway and the EEA. In such cases we choose providers that ensure an adequate level of protection — through standard contractual clauses or equivalent mechanisms.
7. Information security
To protect personal data we use organisational and technical measures:
- an encrypted connection over HTTPS (TLS) on all pages of the Website;
- differentiated access rights — only those employees who need the data for their work can see it;
- two-factor authentication for email and hosting accounts;
- regular software updates and backups;
- internal procedures for handling confidential information and non-disclosure agreements with the team.
At the same time, no method of transmitting data over the internet is completely secure, and we therefore cannot guarantee the full security of information sent through open communication channels.
8. Your rights
In relation to your own personal data you have the right to:
- find out which data about you is being processed, for what purposes and with whom it is shared;
- obtain a copy of your data in a structured, machine-readable format;
- rectify inaccurate data or complete incomplete data;
- erase data where the purpose of processing no longer applies or consent has been withdrawn;
- restrict processing or object to it;
- withdraw your consent at any time — this does not affect the lawfulness of processing carried out before the withdrawal;
- lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or another competent supervisory authority.
To exercise any of these rights, send a request to [email protected]. We reply within 30 calendar days. To verify your identity we may ask clarifying questions about enquiries submitted previously.
9. Cookies
The Website uses cookies and similar technologies. A full overview of the categories, purposes, storage periods and how to manage them is set out in a separate document — the cookie policy.
10. Links to external resources
The Website may contain links to third-party resources. This Policy does not apply to them: when you follow an external link, the processing of your data is governed by the privacy rules of the resource in question. We recommend that you review them separately.
11. Changes to the Policy
We may update this Policy — for example if the range of services or the legal requirements change. The current version is always available at this address, and the version date is stated at the top of the page. We give notice of material changes on the home page of the Website or by email, if we have your address.
12. Contact
Questions about the processing of personal data: [email protected]
General enquiries: [email protected]
Studio address: Oslo, Torggata 15, office 14. Visits — by prior arrangement over email only.