Privacy Policy

Introduction

Hjemmebakt respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, share and protect your personal data when you visit our website.

Personal data we collect

We do not store user registrations or customer accounts on the website. Some personal data may be processed temporarily through technical operations, advertising and integrations with Instagram (see the dedicated section below).

Technical information is collected automatically when you visit our website:

• Server logs: Our server may automatically log IP addresses, browser type, operating system, time of visit and referring websites. These logs are stored temporarily for technical operations and troubleshooting.
• Cookies via advertising (Sovrn): Our advertising partner Sovrn and its partners may set first- and third-party cookies on your device to display relevant advertisements. See the section on Sovrn and advertising below for more information.

Important: Sovrn and its partners collect and store information about you in order to deliver interest-based advertising. This is described in more detail in the section on Sovrn and advertising.

How we use personal data

We use the personal data we collect to:

• Improve and optimize our website
• Analyze usage patterns and traffic
• Display relevant advertisements through Sovrn
• Comply with legal obligations

Sovrn and advertising

The Website works with Sovrn (Sovrn, Inc.) to manage and display third-party interest-based advertising appearing on the Website. Sovrn and its advertising partners may use first- and third-party cookies and similar technologies when you visit the Website. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

Sovrn and its partners may collect and process the following data when serving ads:

• IP address
• Device and browser information (type and settings)
• Operating system
• Approximate geographic location
• Pages you visit and interaction with advertisements
• Unique advertising IDs used to create audience segments

Sovrn and its partners may use this data to link it to other information the partner has independently collected in order to deliver targeted advertisements across devices, browsers and apps, as well as to measure the effectiveness of advertising and to prevent fraud and abuse.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about how Sovrn collects and processes personal data, please visit Sovrn’s Privacy Policy.

Use of the Instagram API and processing of Instagram data

Hjemmebakt uses the Instagram Graph API provided by Meta Platforms Ireland Limited to manage and publish content as well as to handle messages and comments on connected Instagram accounts.

What information may be processed

• Instagram username
• User ID
• Comments on posts
• Direct messages sent to the account
• Metadata related to messages and comments

Purpose of the processing

• Publishing and managing content
• Responding to comments and messages
• Automated customer communication
• Content moderation

We do not use this information for marketing outside Instagram and do not share it with third parties beyond what follows from Meta’s platform terms.

Storage of Instagram data

Instagram data is stored only when necessary to operate the service. Message content and comments are not stored permanently, except when necessary for technical troubleshooting or documentation. Any stored data is deleted within a reasonable time and no later than within 90 days, unless the law or an agreement requires longer retention.

Deletion: You can request access to, rectification of, or deletion of information we process from Instagram by contacting us (see Contact us). We delete or anonymize data in accordance with our retention period and upon request when compatible with the law.

When using webhooks, data is received from Meta via secure webhook endpoints that are verified with a token. Only verified requests are processed.

Legal basis (GDPR)

The processing of Instagram data is based on legitimate interest under GDPR Article 6(1)(f) (operation of social channels and customer dialogue). When you actively contact us via a message, the processing may in addition be necessary to fulfil a contract under Article 6(1)(b).

Your rights regarding processing via Instagram

If you have interacted with us via Instagram and wish to request access to, rectification of, or deletion of information we process, you can contact us at kontakt@hjemmebakt.com. You can also manage privacy settings directly in Instagram and at Meta.

More information about Meta’s and Instagram’s privacy practices can be found in Instagram’s privacy policy and Meta’s privacy policy.

Cookies

We use cookies to improve the user experience and to display advertisements. Cookies are small text files that are stored on your device when you visit a website.

Types of cookies we use:

• Necessary cookies: These are required for the website to function correctly and cannot be disabled.
• Analytics cookies: These help us understand how visitors use our website.
• Advertising cookies: These are used by Sovrn and its partners to display relevant advertisements.

You can control and manage cookies through your browser settings. Note that disabling cookies may affect the functionality of the website.

Your rights (GDPR)

Under the GDPR (General Data Protection Regulation) you have the following rights:

• Right of access: You have the right to obtain information about which personal data is processed about you. We can provide information about technical information in server logs (if available), Instagram data (see the Instagram section) and refer to Sovrn and its partners for information about their processing.
• Right to erasure: You have the right to request the deletion of personal data. Server logs and temporarily stored data are deleted after the retention period. For Instagram data you can contact us. For data collected by Sovrn and its partners, you can use the opt-out links in the section on Sovrn and advertising.
• Right to restriction: You have the right to request the restriction of the processing of your personal data.
• Right to data portability: You have the right to receive your personal data in a structured format. This applies to data we process (e.g. upon a request regarding Instagram data) and is also relevant for data collected by Sovrn and its partners.
• Right to object: You have the right to object to the processing of your personal data. You can do this by disabling cookies or by contacting us.
• Right to withdraw consent: You can at any time opt out of personalized advertising via the opt-out links (NAI, DAA and the Network Advertising Initiative) in the section on Sovrn and advertising.

For data processed by Sovrn and its partners: See the section on Sovrn and advertising and Sovrn’s Privacy Policy for information about how to exercise your rights.

For questions about our processing of technical information (server logs), you can contact us by email (see contact information below).

Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration. However, no method of transmission over the internet or electronic storage can be 100% secure.

Hosting and sub-processors: The website is hosted on servers in the EU/EEA at Hetzner. Where sub-processors are used (e.g. hosting, email, CDN), they are contractually obligated to process data in accordance with data protection legislation.

Sharing of personal data

We do not share your personal data with third parties, except:

• Sovrn and its partners: To display relevant advertisements (see the section on Sovrn and advertising above).
• Service providers: We may share information with third-party service providers that help us operate the website (e.g. hosting, analytics). These providers are contractually obligated to protect your personal data.
• Legal requirements: We may share information if required by law or to protect our rights.

Retention of personal data

We do not store user registrations or customer accounts. Some personal data is processed temporarily (see the sections on server logs, Sovrn and Instagram).

Server logs: Technical information such as IP addresses in server logs is stored temporarily (typically 30-90 days) for technical operations and troubleshooting, and is then deleted automatically.

Instagram: Instagram data (messages, comments, etc.) is stored only temporarily and deleted within 90 days, cf. the Instagram API section.

Sovrn and advertising partners: Sovrn and its partners store personal data in accordance with their own privacy policies. For information about retention practices, see Sovrn’s Privacy Policy.

Changes to this privacy policy

We may update this privacy policy from time to time. Any changes will be published on this page with an updated “Last updated” date. We encourage you to review this page regularly to stay informed about how we protect your personal data.

Contact us

If you have questions, concerns or wish to exercise your rights under the GDPR, you can contact us:

Complaint to the Norwegian Data Protection Authority

If you believe that the processing of your personal data violates data protection legislation, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet):