Privacy notice

Who is responsible

Sedes is owned and operated by Lightbulb Solutions AS, org. no. 929 838 025, which is the controller of the data described here. Send questions about privacy to hei@sedes.no.

What we collect, and why

• Ordering domains: the name, email address, phone number and postal address of the person or organisation who will hold the domain, the organisation number or Norid PID, and the declaration you sign. The purpose is to register the domain with Norid and deliver the service. The basis is our contract with you.
• Account and sign-in: your email address, name and what you need to sign in. The purpose is to give you access to your orders and domains. The basis is our contract with you.
• Payment and invoicing: what you bought, amounts, payment method and invoice details. Your card number never reaches us; if you save your card, it is stored with Stripe and we keep only a reference to it. The purpose is to take payment and keep accounts. The basis is our contract with you and our bookkeeping obligation.
• Email: emails about your order, and what you write to us. The purpose is to keep you informed and to answer you. The basis is our contract with you, or our legitimate interest in answering enquiries.
• Usage statistics: which pages are visited and what is clicked, without cookies and without profiles of individuals. Domain names and link tokens are removed before anything is sent. The purpose is to understand and improve the site. The basis is our legitimate interest.

Cookies

We use necessary cookies for your language, your order while you shop, signing in and your cookie choice. These need no consent.

Only if you accept do we also store a random visitor id. We use it to show you the same version of the site while we try out changes, and link it to your account if you sign in. The basis is your consent, and you can withdraw it at any time under “Manage cookies” at the bottom of the page.

Who receives the data

We never sell your data. These receive it, and only for its purpose:

• Norid AS in Trondheim, which runs the registry for .no domains, receives the holder’s details and processes them as an independent controller, under its own rules.
• Stripe (Stripe Payments Europe in Ireland, together with Stripe, LLC in the US), which processes card payments and stores cards you choose to save. The data is transferred to Stripe in the US.
• Fiken AS, which we use for invoicing and accounting. Fiken keeps the data on servers in Norway, and some of Fiken’s sub-processors are US companies.
• Amazon Web Services, which sends our emails and forwards the web addresses you set up for your domains, from the AWS region in Stockholm.
• Railway, which runs our site, services and database and the sign-in, in Railway’s region in the Netherlands. Our Railway account is processed in the US.
• PostHog, which processes the usage statistics in PostHog Cloud EU, in Germany.
• Google Workspace (Google Cloud EMEA in Ireland, together with Google LLC in the US), which runs our email, hei@sedes.no. Google may process the email anywhere in its infrastructure, outside the EU/EEA too.
• ClouDNS (Cloud DNS Ltd. in Bulgaria), which runs DNS for your domains. The DNS records are published from name servers around the world.

Transfers outside the EU/EEA

These vendors may process data outside the EU/EEA. The transfers rely on what the vendors’ own terms state:

• Stripe: the EU–US Data Privacy Framework, under which Stripe, LLC is certified, and the EU standard contractual clauses.
• Fiken AS: for sub-processors outside the EEA, an adequacy decision or the EU standard contractual clauses. Which of them, Fiken states on request.
• Amazon Web Services: the EU standard contractual clauses in its data processing addendum, and the EU–US Data Privacy Framework, which covers Amazon Web Services, Inc.
• Railway: the EU–US Data Privacy Framework, and otherwise the EU standard contractual clauses.
• PostHog: the EU–US Data Privacy Framework and the EU standard contractual clauses.
• Google Workspace: the EU–US Data Privacy Framework, under which Google LLC is certified, with the EU standard contractual clauses as a fallback.
• ClouDNS: the EU standard contractual clauses or an adequacy decision, as ClouDNS’s privacy policy describes.

How long we keep the data

As long as needed for the purpose, and as the law requires.

Your rights

You have the right to access the data we hold about you, and to have it corrected or erased. You can also ask us to restrict the processing, object to it, and receive your data in a machine-readable format. Write to hei@sedes.no.

If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).