Privacy and processing of personal data

Sturlason AS Polyfoto, organisation number 915 228 887, is the data controller for personal data collected through our websites and services.

As data controller, we determine why and how personal data is processed.

Contact information

We only process personal data necessary to provide our services, respond to enquiries and administer customer relationships.

Depending on the service you use, this may include:

• name
• email address
• telephone number
• company, organisation, employer or client
• information about the requested photography service
• date, location, number of people, selected services and practical details relating to the assignment
• quotation, order and delivery information
• billing information
• photographs and image data produced as part of a photography assignment
• information relating to a personal online account and image delivery
• messages you enter in the Snorre AI chat

We do not normally request special-category personal data.

Information is mainly collected when you:

• complete booking, quotation, event or enquiry forms on our websites
• email us
• contact us by telephone
• book a photography session
• use the Snorre AI chat
• receive access to a personal online account or image gallery

For photography arranged through a third party, such as an employer, organisation or school, the client may provide us with information necessary to carry out the assignment.

Sturlason has a historical photographic archive dating back to 1933. Photographs produced through our services become part of our professional image archive and are retained permanently as part of our business, documentation and ability to provide image files, prints and other products in the future.

Photographs are copyright-protected works and are handled in accordance with applicable copyright law. The photograph itself is therefore not deleted in response to a request to erase personal data.

Customers may request that personal data associated with a photograph, such as names and contact information, be considered for deletion or anonymisation where this is possible.

When you use our booking, quotation, event or enquiry forms, we process the information you provide in order to:

• respond to and follow up enquiries
• plan photography and check availability
• prepare and send quotations or price information
• send booking confirmations and practical information by email and, where relevant, SMS
• register the appointment in our calendar and fulfil the booking
• communicate with you before, during and after the photography

This may include:

• requested service
• photography location
• date and time
• number and names of participants where necessary
• company, employer or contact person where relevant
• additional services
• practical information and any comments you enter about the assignment

After a photography session, we may create a personal online account or secure image gallery.

This is used for:

• viewing images
• selecting images
• ordering products
• delivering finished files

The account may contain:

• name
• contact information
• photographs
• order history
• information necessary for delivery

Through the customer gallery, you can select photographs and may order image files, prints and other image products.

If you voluntarily sign up for emails about campaigns and seasonal offers, we store your email address, the time of consent and the wording you agreed to. The information is used only for these communications. We send no more than four such emails per year. You can unsubscribe at any time using the link in the emails.

For certain corporate assignments, Sturlason may process personal data on behalf of a client that is itself the data controller.

Examples include:

• employee portraits and CV or profile photographs ordered through an employer
• corporate photography
• events
• contact persons at corporate clients
• other assignments where the client determines the purpose of the processing

In such cases, information is processed in accordance with the agreement with the client and any applicable data processing agreements.

Contract

To provide quotations, confirm and carry out photography, deliver images, administer orders and follow up customers.

Legal obligation

To comply with requirements under accounting and tax legislation, among other rules.

Legitimate interests

To respond to enquiries, administer customer relationships, maintain history and retain a professional image archive.

Consent

Where required, for example for publication of photographs and analytics.

Necessary cookies and local storage are used for secure form handling, session management and to remember privacy and accessibility choices. They are required for the features you use.

We use Google Analytics 4 to understand how the website is used and to improve our services. The analytics tool is activated only after the user has actively given consent to analytics. If you select “Necessary only”, Analytics is not loaded.

We send only event data relating to use of the website, such as pages visited, service types and completed actions. We do not send names, email addresses, telephone numbers, company information, dates, locations, participant information or any other directly identifying information to Google Analytics.

Google Signals and advertising personalisation are disabled. Personalised advertising, remarketing and marketing tracking are not enabled. Google Ads tracking is not active.

The website uses externally hosted fonts and provides maps from Google. When such content is loaded, the provider may receive technical information such as IP address, browser and time. Maps are loaded when you choose to open the map feature.

Links to the customer gallery, print centre, social media and other external websites lead to services with their own privacy notices.

Snorre is our digital assistant and uses technology provided by OpenAI to answer users’ questions. Messages sent to Snorre are processed by OpenAI to generate responses. Conversations are stored temporarily in our server logs for operations, troubleshooting and quality improvement. Conversations are deleted automatically after 90 days.

The chat is intended for general questions about our services. Do not enter sensitive personal data or information you do not wish to share in the chat.

The purpose is to answer questions and improve customer dialogue. Processing is based on our legitimate interest in providing customer service and monitoring the quality of the service.

We do not sell personal data.

To provide our services, we use suppliers in the following areas:

• web hosting and technical operations
• email, SMS and communications
• booking, calendars and customer administration
• image delivery and customer galleries
• AI services for the Snorre chat
• analytics

Suppliers are only given access to information necessary for their work and must ensure secure processing.

We implement technical and organisational measures to protect personal data against unauthorised access, loss or misuse.

Access to customer information and photographs is limited to people who need it to perform their work.

We retain personal data for as long as necessary for the purpose for which it was collected, to maintain the customer relationship or to comply with legal requirements. Accounting information is retained for the period required by law.

Messages in the Snorre chat are retained in the server log for up to 90 days and are then deleted automatically. Technical server logs should generally be retained for no more than 30 days and are administered by our web hosting provider.

Photographs are retained permanently as part of our professional image archive. Personal data associated with photographs may be considered for deletion or anonymisation where possible, as described above.

You have the right to:

• request access
• request correction
• request deletion where the applicable conditions are met
• request restriction of processing
• withdraw consent
• object to processing based on legitimate interests
• request data portability where applicable

If you believe that we process personal data in breach of applicable rules, we ask that you contact us first.

You may also lodge a complaint with the Norwegian Data Protection Authority: www.datatilsynet.no.

This privacy statement may be updated if our services or applicable rules change.

The latest version will always be available on our websites.