Privacy Policy
Last updated: April 15, 2026
1. Data controller
Gullbekk Visuals AS (org. no. 936 235 891) is the data controller for personal data collected through this website and related services.
Contact:
Email: sverre@gullbekkvisuals.no
Address: Oslo, Norway
2. What personal data we collect
- Contact information (name, email, phone number) from bookings and forms
- Payment information via Stripe (we do not store card numbers)
- Wedding date, venue, and preferences you provide during the booking process
- Photos and video we produce as part of the assignment
- User account info for course and real estate accounts (email, password hash)
- Technical data: IP address, browser type, and cookies (see our cookie policy)
3. Purpose and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Deliver services you order (photo, film, courses, retreats) | Art. 6(1)(b) — contract |
| Send invoices and receipts | Art. 6(1)(b) — contract |
| Respond to enquiries via contact form or chat | Art. 6(1)(f) — legitimate interest |
| Manage user accounts (courses, real estate) | Art. 6(1)(b) — contract |
| Send marketing and newsletters | Art. 6(1)(a) — consent |
| Analytics and website improvement | Art. 6(1)(a) — consent (via cookie consent) |
| Comply with accounting and tax obligations | Art. 6(1)(c) — legal obligation |
4. Who we share data with
We only share data when necessary to deliver our services:
- Stripe — payment processing (USA, EU Standard Contractual Clauses)
- Supabase — database and authentication (EU region)
- Vercel — hosting (global CDN, primary server in EU)
- Resend — email delivery
- Subcontractors (videographers, editors) — only data necessary for the assignment
We have Data Processing Agreements (DPA) with all providers that process personal data on our behalf.
5. Transfers outside the EU/EEA
Some of our providers are based in the USA. Transfers are made pursuant to EU Commission Standard Contractual Clauses (SCC) or an adequacy decision for the relevant country. Contact us for more information.
6. Retention periods
- Customer data: during the contract period + 3 years after the last assignment
- Accounting data: 5 years after the end of the fiscal year (Norwegian Bookkeeping Act)
- Marketing consent: until you withdraw it
- User account data: until you delete your account
- Cookie consent: 12 months, then we ask again
7. Your rights
Under the GDPR you have the right to:
- Access — request a copy of the data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of data we no longer have grounds to store
- Restriction — request that we restrict processing
- Data portability — receive your data in a machine-readable format
- Object — to processing based on legitimate interest
- Withdraw consent — at any time, without affecting the lawfulness of prior processing
Send requests to sverre@gullbekkvisuals.no. We respond within 30 days.
8. Information security
We protect personal data with appropriate technical and organisational measures, including encrypted transmission (HTTPS/TLS), access controls, two-factor authentication for administrators, and regular software updates.
9. Right to lodge a complaint
If you believe we are not processing your personal data in accordance with the regulations, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
10. Changes
We may update this policy as needed. Material changes will be communicated via email or a banner on the website. The current version is always available on this page.