Legal
Privacy Policy
We collect as little personal data as we can, use it only to run the shop, and never sell it. This page explains what we collect, why, who helps us, and your rights.
Last updated:
1. Who is responsible
The controller for personal data collected through FootyFrame is FX Media AS, Ringlevegen 4, 7655 Verdal, Norway. Contact us about anything on this page at info@fx-media.no or +47 401 85 596.
We follow the EU General Data Protection Regulation (GDPR) as incorporated into Norwegian law by the Personal Data Act (personopplysningsloven), and, for customers in the United Kingdom, the UK GDPR and the Data Protection Act 2018.
2. What we collect, why, and for how long
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Placing and delivering an order | Name, email, phone, delivery and billing address, the items you ordered, any personalisation text, payment status (not your card number) | Contract (GDPR art. 6(1)(b)) | 5 years after the end of the financial year, as Norwegian bookkeeping law requires for sales records; other order details up to 3 years for complaints |
| Bookkeeping and tax | Order, payment and invoice records | Legal obligation (art. 6(1)(c)) — the Norwegian Bookkeeping Act (bokføringsloven) | 5 years after the end of the financial year |
| Answering your messages | Name, email, order number and what you write to us | Legitimate interest in replying to you (art. 6(1)(f)), or contract if it concerns an order | Up to 12 months after the conversation ends, longer if it concerns a complaint |
| Newsletter | Email address, the consent wording you agreed to, and when | Consent (art. 6(1)(a)) — you can withdraw it any time | Until you unsubscribe; proof of consent kept up to 3 years afterwards |
| Running and securing the site | IP address, browser type, pages requested, timestamps (server logs) | Legitimate interest in a secure, working website (art. 6(1)(f)) | Kept by our hosting provider for a short period, typically days to weeks |
You don’t have to give us personal data, but we can’t deliver an order without a name, address and email. We don’t make decisions about you by automated means, and we don’t build marketing profiles.
3. Who we share it with
We use a small number of trusted providers, each only for its task:
- Stripe (Stripe Payments Europe Ltd., Ireland) processes payments on its own checkout page and sends payment receipts. For fraud prevention and its legal duties Stripe acts as an independent controller — see stripe.com/privacy.
- Our print-on-demand production partner receives your name, delivery address, email/phone (for the carrier) and the print file, to produce and ship your order from the facility nearest you, and passes your address to the delivery carrier.
- Cloudflare (Cloudflare, Inc., USA) hosts the website on its edge network, processes server logs and renders the print files for your order; it may also store contact and newsletter submissions for us.
- Our form inbox provider, if we use one to receive contact messages and newsletter sign-ups (for example a spreadsheet or automation service), stores what you submit on our behalf.
- Our accountant and public authorities, where the law requires it.
Where these providers act on our behalf, they are bound by data processing agreements. We never sell your data or share it for others’ advertising.
4. Transfers outside the EEA and UK
Some providers (for example Cloudflare, and our production partner’s print houses when you order to the US or Canada) process data outside the EEA and the UK. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework and the UK extension to it, for certified companies) or the European Commission’s standard contractual clauses and the UK addendum. Contact us for a copy of the relevant safeguards.
5. Cookies and local storage
We only use what the shop needs to work: your cart is saved in your browser’s local storage and your currency in one small cookie. No analytics or advertising cookies. Details in the Cookie notice.
6. Your rights
Under the GDPR and UK GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data erased, where we no longer need it or you withdraw consent (unless the law requires us to keep it, such as bookkeeping records);
- restrict or object to processing based on legitimate interests;
- data portability for data you gave us under contract or consent;
- withdraw consent at any time (for the newsletter: use the unsubscribe link or email us) — this doesn’t affect earlier processing.
Email info@fx-media.no to use any of these rights. We answer within one month and may ask you to confirm your identity.
7. Complaints
If you think we handle your data unlawfully, please tell us first so we can fix it. You also have the right to complain to a supervisory authority: in Norway the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no); in the UK the Information Commissioner’s Office (ico.org.uk); in the EU the data protection authority where you live or work.
8. Children
Our shop is meant for adults. We don’t knowingly collect data from children under 16; orders should be placed by a parent or guardian.
9. Security
The site is served only over HTTPS. Payments are handled entirely by Stripe, and access to order data is limited to the people who need it to fulfil your order.
10. Changes
We’ll update this policy when our processing changes and change the date at the top. Significant changes will be highlighted on the site.
Questions? Contact us
FX Media ASRinglevegen 4, 7655 Verdal, Norway
Org. nr. 930 724 548 MVA
Email: info@fx-media.no
Phone: +47 401 85 596Contact us