Privacy Policy for karinsundbye.no

We only collect personal data that is necessary to run the website and respond to enquiries. The website has no login, no subscription arrangement and no shopping basket.

When you submit the contact form, we store:

• your name
• your email address
• what you have ticked as the subject of your enquiry
• the content of the message you write
• which work the enquiry concerns, if you came here from a particular work in the archive
• the time the message was sent

In addition, the web server automatically records technical information about the visit, such as IP address, browser type and which pages are opened. See point 5.

We do not ask for a telephone number, address, date of birth or any information other than that listed above.

The contact form appears on the front page and on the contact page, and it is the same form in both places. When you submit it, two things happen: the message is stored in the website's database, and it is forwarded as an email to us, so that we can read it and reply.

Legal basis: legitimate interest in being able to respond to enquiries, or an agreement or request from you, depending on what the enquiry concerns.

The archive depends on contributions from the public, and many works are missing information. If you write to us about a work, the information you provide may be used to complete the description of the work on the website. Your name and your email address are never published.

Submitted messages are not publicly available. They can only be read by logged-in administrators in the website's administration panel.

This website sets no cookies. We have no analytics tools, no marketing tracking and no embedded services that follow you between websites. There is therefore no consent banner for you to deal with either.

Should this change, this page will be updated at the same time, and any cookies that are not strictly necessary will not be used until you have given your consent.

The website uses a small number of providers. These are the only ones that may receive information about your visit:

• Vercel — hosting of the website. All pages are delivered from here, and the server keeps operational logs.
• Neon — the database where content and submitted messages are stored. The database is located in Frankfurt, that is, within the EU.
• Vercel Blob — storage of the images on the website. The image files are held in the EU region and are publicly readable, as images on a website are.
• Adobe Fonts — the typeface in the headings. Your browser fetches this file from Adobe each time you open a page, and Adobe then sees your IP address.
• Mailgun — sending of email. Used when the contact form notifies us.

The website makes no requests to Google. That is a deliberate choice: the body text uses the typeface Nunito Sans, which sits on our own server instead of being fetched from Google Fonts, and the form uses no Google-based robot checks.

When you visit the website, the server automatically records technical information such as IP address, time, browser type and which pages are opened. These are ordinary operating logs kept by Vercel, not visitor statistics that we collect or analyse.

The logs are used to:

• ensure stable operation of the website
• prevent misuse, spam and attacks
• troubleshoot technical problems

Legal basis: legitimate interest in operating a secure and well-functioning website.

We do not sell personal data, and we do not share it with anyone other than the providers listed in point 4, who process it solely on our behalf and on our instructions.

The content of the contact form is stored in the EU, with Neon in Frankfurt. Vercel, Adobe and Mailgun are companies that also operate outside the EU and the EEA. Where data is transferred out of the EEA, this takes place on the basis of the providers' data processing agreements and the EU's standard contractual clauses.

We store personal data for as long as it is necessary for the purpose it was collected for.

Enquiries sent through the contact form are stored for as long as they are relevant to the work of documenting Karin Sundbye's artistic practice, and are deleted when they are no longer relevant. You can ask us at any time to delete your message, and we will delete it.

Technical operating logs are deleted or anonymised after a short time, in line with the provider's routines.

You have the right to:

• request access to the personal data we hold about you
• request correction of inaccurate or incomplete data
• request erasure of personal data
• request restriction of processing
• object to processing based on legitimate interest
• lodge a complaint with Datatilsynet if you believe the processing breaches data protection law

To exercise your rights, get in touch with us. The address is on the contact page, and you can also use the contact form.