Privacy Policy

Who is responsible

VIK CREATIVE TECH is the controller of the personal data described here.

We reply to email within 2 business days.

Because we are established in Norway, this policy follows the EU/EEA General Data Protection Regulation (GDPR) as it applies in Norway through the Personal Data Act. Our supervisory authority is Datatilsynet (the Norwegian Data Protection Authority).

Visiting this website

This site sets no cookies. It has no analytics, no tracking pixels, no advertising tags, no social embeds, no user accounts and no forms. Nothing is stored in your browser. There is nothing to accept or decline, which is why you were not asked.

The only way to contact us from this site is an ordinary email link.

The site is hosted by Cloudflare, which processes technical data — including your IP address — to deliver the pages and protect the service against attack, and which records network delivery errors. That happens at the infrastructure level, for security and reliability, and we do not use it to identify or profile visitors.

If you email us

We receive your email address, your name if you give it, and whatever you choose to write.

We use it to answer you. The legal basis is our legitimate interest in responding to people who contact us (Article 6(1)(f)), or, if you are asking about buying a website, the steps taken at your request before entering a contract (Article 6(1)(b)).

Mail sent to hello@vikcreativetech.com is routed by Cloudflare Email Routing into a Google Gmail mailbox. That mailbox is a personal Google account, so Google handles the mail in it under Google’s own consumer terms and privacy policy, as a controller in its own right — not under a data processing agreement with us. Please keep that in mind before sending us anything sensitive by email.

If we contact you about your business

We sell websites by writing to small businesses that we think we can help. If you received an email from us, this section is the part that concerns you.

Where we got your details. From your business’s own published material — usually your website — or from a public register, or from a commercial data source whose terms permit this use. We record the source of every detail we hold. We did not buy your details from a list broker of unknown provenance, and we do not use contact forms for sales messages.

What we hold. Your business name, website address, published business contact details, and our own notes and observations about your existing website. Where an owner’s name is published on the business’s own site, that too. That is all.

Why. To decide whether your business is one we can genuinely help, and to contact you once about it — with a working example rather than a generic pitch.

Legal basis: legitimate interests (Article 6(1)(f)). Our interest is in finding customers for a service that is relevant to businesses in your position. We balance that against your interests by keeping the data minimal and public-sourced, contacting you at most twice, writing to you personally rather than at volume, and stopping permanently the moment you say so.

We score businesses automatically to decide who is worth contacting. This produces no legal or similarly significant effect on anyone — it only decides whether we get in touch.

If we built you a demo. We sometimes build a sample version of a business’s website using information published on that business’s own site, and link to it in our email. A demo is marked as an unofficial concept, is not affiliated with or endorsed by the business, and is excluded from search engines. Ask us and we will take it down.

Your right to stop this. You can object at any time, for any reason or none. We act on it as soon as we receive it and stop using your details for direct marketing. Reply to any email from us, or write to hello@vikcreativetech.com.

How we make that permanent. We keep a suppression list so the objection holds. It contains only what is needed to recognise you and not contact you again — email address, website domain, phone number — and the date you objected.

That record exists for one purpose: to make sure you are not contacted again. We never use it for marketing, we never use it to build a profile, and we never share or sell it. It survives any rebuild of our systems, because a suppression list that is lost in a migration is how people get contacted a second time.

We may retain the minimum information necessary to ensure that your objection continues to be respected, for as long as that is necessary. We use this record only for suppression, never for marketing.

You can ask us what it holds about you and ask us to correct it. If you ask us to erase it, we will assess the request under applicable data protection law, do what that assessment requires, and explain to you any information we need to keep and why.

If you become a customer

To build and hand over your website we handle:

• Your business name, contact name, email, phone and any address you want published
• The materials you send us — photos, logos, text, service details
• Your domain and hosting details, and temporary access where you grant it
• The email address where you want form enquiries delivered

Legal basis: performance of our contract with you (Article 6(1)(b)), and legal obligation (Article 6(1)(c)) for the accounting records we are required to keep.

We remove our access to your accounts at handover, as the Terms say. The website’s enquiry form belongs to your account and sends to your inbox — we are not a recipient of your customers’ enquiries, by design. What your website collects from your own customers after handover is yours to govern, and you become the controller of it.

Payments

Payments are processed by Stripe. Card details go directly to Stripe and we never see or store them.

We see and keep what appears on the payment and the invoice: business name, contact name, email, billing address, amount, date and payment status. Norwegian bookkeeping law requires us to keep invoices and their supporting documentation.

Stripe does not only act on our behalf. For the payment services it provides to us, Stripe acts as our processor. But Stripe also uses payment data as a controller in its own right — to detect and prevent fraud, to meet its own legal obligations including anti-money-laundering and know-your-customer requirements, and to analyse and improve its own services. We do not control that processing and cannot switch it off. Stripe describes it in its own privacy policy, which we encourage you to read.

Who else handles your data

We use a small number of providers. Their roles are not all the same, and it matters, so here they are as they actually stand:

We do not sell personal data, and we do not share it for anyone else’s marketing.

Where a provider is a controller rather than our processor, its own privacy policy governs what it does with the data, and your rights against it are exercised with that provider directly. We will tell you which provider is involved in any specific case if you ask.

Where your data is processed

We are based in Norway. The providers described above operate globally, and personal data covered by this policy may be processed in or transferred to countries outside the European Economic Area, including the United States.

Each provider publishes the safeguards it applies to those transfers:

• Cloudflare — its customer data processing agreement provides for the European Commission’s standard contractual clauses, and treats transfers made under the EU–U.S. Data Privacy Framework as covered by that framework.
• Stripe — its data processing agreement provides for the Data Privacy Framework, the EEA standard contractual clauses and the UK international data transfer addendum, and states that personal data may be transferred to Stripe’s United States entity.
• Google — states that Google LLC has certified its adherence to the EU–U.S. Data Privacy Framework principles, and that it also relies on adequacy decisions and standard contractual clauses where those apply.
• Anthropic — states that it relies on adequacy decisions and standard contractual clauses. Its privacy policy does not name the Data Privacy Framework.

Where a provider acts as a controller in its own right — Google and Anthropic in the table above — the transfer is made under that provider’s own privacy policy and the safeguards it publishes there, rather than under an arrangement between you and us.

If you want to know which of these applies to a particular piece of information about you, ask us and we will tell you. If a mechanism above changes, we will update this page.

How long we keep things

The first four periods are our own limits — we chose them, they are not statutory minimums, and we can shorten them. The last one is set by law.

Your rights

You can ask us to:

• Tell you what we hold about you, and give you a copy
• Correct anything that is wrong
• Delete it
• Restrict what we do with it while a question is being resolved
• Send it to you or another provider in a portable format, where that right applies
• Stop — see the objection right above

Write to hello@vikcreativetech.com. We will answer within one month. There is no charge, and you do not need to give a reason.

These rights have limits set by law. Where we cannot do everything you ask — for example, deleting an invoice we are legally required to keep — we will tell you what we are keeping and why, rather than simply declining.

We may ask you to confirm who you are before we act on a request, so that we do not hand your data to someone else.

Complaints

Tell us first if you can — hello@vikcreativetech.com — because most things are fixable in a day.

You also have the right to complain to a data protection authority. Ours is Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway — datatilsynet.no. If you are in another country, you may complain to your own authority instead.

Changes

If we start doing something this policy does not describe — adding analytics, a contact form, or a new provider — we will update this page and change the date at the top before we start, not after.

Contact