Privacy

This page explains what personal data we hold about you when you use the website and buy tickets from Værftet, why we have it, who sees it, how long we keep it and what rights you have. We have tried to keep it simple.

In short

• We store what we need to sell you tickets and run the events: contact and profile details, orders and tickets.
• We do not store your card number. Payment happens at Kustom.
• You get marketing from us only if you said yes, and you can withdraw it at any time. You never have to say yes to marketing to buy a ticket.
• We do not sell your data and do not use it for other companies' ads.
• You can ask at any time to see, correct or delete your data: post@vaerftet.no.

1. Who is responsible

Værftet Or Nowhere AS, organisation number 938 143 404, Langgata 25b, 0566 Oslo, Norway is the controller for the personal data described here. You can contact us about privacy at post@vaerftet.no.

2. What data we hold, and why

• Account and sign-in. Mobile number (verified with an SMS code), email address and name. We use them to create and keep your account, sign you in safely and send tickets and receipts. (Basis: contract, GDPR art. 6(1)(b).)
• Profile. Date of birth, gender (you can choose "prefer not to say"), postal code and country. We use them for age limits, for statistics about who attends and for planning events. We do not store your street address. (Basis: legitimate interest, art. 6(1)(f). We have an interest in knowing who our audience is and in following age limits.) A profile picture is optional. You upload it yourself and can remove it at any time. (Basis: consent.)
• Orders, payment and tickets. What you bought, the amount, the time, a reference to the payment and your tickets with their QR code. When your ticket is scanned at the entrance we store that it was scanned, when and where. We use them to deliver the ticket, send a receipt, give refunds and keep accounts. (Basis: contract, and legal obligation under the Norwegian Bookkeeping Act, art. 6(1)(c).)
• Your choices. That you accepted the terms and this policy (and which version), and whether you said yes to marketing, with the time and where you answered. We use it to be able to show what you agreed to. (Basis: legal obligation and legitimate interest, cf. art. 7(1).)
• Messages we sent you. Which channel and template, whether the message arrived, and for marketing email whether it was opened or clicked. We use it to show what we sent, avoid sending twice and find faults. (Basis: consent for marketing, otherwise contract or legitimate interest.)
• Use of the website. Which pages you view, how far you got in the purchase, approximate place (country and city, rounded), where you came from (the site you came from, or a campaign tag in the link) and a random visitor id. We do not store your IP address in the visit statistics. When you are signed in, we link the visit to your account. We use it to run the ticket shop, see what works and see how many are here right now. (Basis: legitimate interest. You can object, see section 8.)
• Errors and performance. Error messages and measurements of how fast pages load in your browser. We do not record your screen or what you type. We use it to find and fix faults. (Basis: legitimate interest.)
• Contact form. What you write, the language and which page you sent it from. We use it to answer you. (Basis: legitimate interest.)

3. Where the data comes from

• From you, when you create an account, fill in your profile, buy or contact us.
• From Kustom, when you pay. We receive your mobile number and the name and email you give when paying. If you do not have an account with us, we create one on the mobile number you pay with. You fill in the rest of the profile when you sign in.
• From us, if someone at Værftet gives you a free ticket or an invitation. Then we were given your mobile number and name by the person who sent it. We use them only to send you the ticket and create your account.
• From your browser, for visit statistics and error reports.

4. Do you have to give us the data?

To get an account and a ticket you must give your mobile number, email and name. Without them we cannot deliver the ticket. In the profile we also ask for date of birth, gender, postal code and country. If you do not want to give your gender, choose "prefer not to say". You give payment details to Kustom to be able to pay. You choose yourself whether to say yes to marketing, and you can always buy without it.

5. Messages from us

• Practical information. If you hold a ticket we may send practical information about the event, such as doors, parking or changes to the programme, and messages about your order. This does not need consent and contains no promotion.
• Marketing. We send newsletters and offers by email and SMS only if you said yes. One choice covers both email and SMS. You can withdraw it at any time, with one click in the message or under My consents in My Værftet. It does not affect your tickets.
• Who receives marketing. Among those who said yes, we may choose recipients by what you bought (for example a ticket to an earlier event), postal code and language. We make no decisions based only on automated processing that have a legal effect on you.
• What we see. In marketing email we can see, through the email service we use, whether and how many people open and click. SMS is sent from a sender name and cannot be answered.
• Addresses that do not work. If we learn that an address does not work, or you complain about an email, we stop sending there. We then keep the address in an unreadable form, so the stop still applies.

6. Who we share data with

We do not sell personal data. We use providers to run the service, and they process the data only on our instructions (processors):

• providers of the database and the hosting of the website,
• providers that send SMS and email,
• providers of error monitoring and backup.

Your payment is handled by Kustom. They are responsible for the payment details themselves. We receive a reference to the payment, not the card details.

Some pages can show videos from YouTube or music from Spotify. When the content loads or plays, your browser connects to them, and they can set their own cookies under their own terms.

We may also disclose data to authorities when the law requires it, for example accounting authorities.

You can ask us for a list of the providers by writing to post@vaerftet.no.

7. Outside the EU/EEA

Some providers have a parent company or operations outside the EEA, including in the USA. Transfers then take place on the basis of [transfer mechanism, for example the EU standard contractual clauses or the provider's certification under the EU–US Data Privacy Framework]. You can ask for a copy of the safeguards by writing to us.

8. How long we keep data

• Profile: as long as the account exists. When you ask for deletion, we anonymise it.
• Orders and payments: 5 years after the purchase (Bookkeeping Act). When you ask for deletion, we remove your name, but we must keep amounts and dates.
• Tickets: the time of the event and 2 years after.
• Scans at the entrance: 2 years.
• Consents: until you ask for deletion, and 3 years after, to be able to show what you agreed to.
• Message log: 1 year. After that we remove the address and the text and keep only status and numbers.
• Visit statistics: 12 months for single events (which pages were opened and when, tied to a random visitor id). After that we keep only figures without a person.
• Log of changes in the administration: 5 years.
• Contact form: until the message is answered and no longer needed. Then we delete it.
• Backups: the encrypted copies are kept for up to 12 months. Something you asked us to delete can therefore sit in a copy until it expires. We use the copies only to restore the service after a serious fault, and the deletion is then done again.

9. Your rights

You can at any time:

• find out what we hold about you and get a copy (access and data portability),
• correct data: sign in and go to My profile,
• withdraw marketing consent: My consents in My Værftet, or the link in the message,
• ask us to delete your account. Data we must keep under the Bookkeeping Act stays, without name and contact details,
• ask for restriction of processing,
• object to processing based on legitimate interest, for example the visit statistics.

Email us at post@vaerftet.no and we will answer within one month at the latest. We need to be able to confirm that it is you. If you disagree with how we process your data, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

10. Cookies and browser storage

• Visitor id (gh_visitor). A random id that tells visitors apart in our own visit statistics. It is not a login and not a name. It is linked to your account when you sign in and unlinked when you sign out. Lasts 1 year.
• Language (gh.web.locale). Remembers the language you chose. Lasts 1 year.
• Sign-in. Keeps you signed in. It sits in the browser's storage, not in a cookie, and stays until you sign out.
• Basket (gh.cart). Remembers the tickets you put in the basket, so they are still there if you reload the page. It stays in your browser until you clear it or buy.
• Access code (gh.eventCode:…). If you entered an access code for an event, the browser remembers it so you do not have to type it again.
• Temporary values while signing in. While you sign in with an SMS code, the browser keeps short helper values (for example the countdown before you can ask for a new code). They disappear when you close the tab.
• Payment. The payment window comes from Kustom and can use its own cookies to complete and secure the payment.
• Embedded content from YouTube and Spotify, see section 6.

We use no cookies for advertising, and we do not share the visitor id with anyone.

11. Security

All connections are encrypted. Tickets carry a signature so they cannot be forged. We never store card details or the one-time code you sign in with. Only staff who need it can see customer data, and changes in the administration are logged.

12. Changes

If we change this policy in a material way, we will tell you. When you create an account or buy, we store which version of the text you accepted. The time of the latest change is shown at the top of the page.