Legal · draft
This draft explains how URWE AS handles personal data when you visit our website or contact us. It has not been approved for publication.
OUR PRIVACY NOTICE
We are committed to protecting your privacy and handling personal data in a transparent and responsible way.
URWE AS, organisation number 938 386 706, is the controller. Address: Rælingsveien 3, 2010 Strømmen, Norway. Telephone: +47 463 42 227. General enquiries: post@urwe.no. Privacy and rights requests: personvern@urwe.no. URWE AS handles requests through its privacy mailbox; this does not imply appointment of a data protection officer.
The contact form requires your name, email address, subject and message. Company name and telephone number are optional. A supplied telephone number includes the selected country code. Your selected language accompanies the enquiry. A hidden field filters spam; messages with that field filled in are not forwarded. We use these details to reply and discuss your request. Without the required information, the form cannot send your message. Please avoid sensitive personal information.
For necessary steps you request towards a contract with you personally, the relevant basis is GDPR Article 6(1)(b). Article 6(1)(f) is proposed for general enquiries and business-representative correspondence: the interest in answering and following up enquiries. Article 6(1)(f) is also proposed for secure operation, abuse prevention, IP-based limiting and the requested website check, with documented necessity and balancing before approval. Consent is required where the law requires it for optional tracking. Article 6(1)(c) is used only for an actual statutory obligation. Clicking Analyze does not itself constitute GDPR consent.
Cloudflare Workers delivers the website and processes IP addresses and technical request data for operation and security. Resend sends contact details and messages to URWE’s Gmail mailbox. Contact and privacy messages arrive at urwe.inbox@gmail.com. The contact form uses the sender’s email as the reply address. The application has no separate enquiry database.
The proposed procedure is to review retained enquiries at least quarterly and normally delete enquiries that do not become projects within 12 months of the last relevant interaction, with reminders for deadlines between reviews. Operational adoption and assignment of a responsible custodian remain pending confirmation. Continued retention requires a documented need. Project and accounting records are retained according to applicable obligations and documented needs. URWE AS is responsible for manual review and deletion; the website does not automatically delete email. Provider logs, delivery data and backups may have different periods. Actual provider retention periods remain subject to verification.
On entry through /, a valid saved language choice takes priority, otherwise a supported browser language is used, with Norwegian as the default. Direct language links are not overridden. urwe_locale stores no, en or ar for up to one year. This first-party cookie applies across the site, uses SameSite=Lax and Secure on HTTPS, and is not an advertising identifier. The informational banner appears when this browser has no valid acknowledgement. Selecting Understood stores urwe_cookie_notice_ack in first-party localStorage with a timestamp and fixed 180-day expiry. This keeps the banner dismissed after refresh and browser restart; reads do not extend the expiry. It appears again after expiry, clearing site data or using a new browser. If browser storage is unavailable, dismissal lasts only for the current page session. This acknowledgement is separate from tracking consent. Privacy Policy, Cookie Policy and privacy settings remain accessible in the footer. The legal assessment of this storage purpose and duration remains pending. urwe_consent may store category choices, version, language, time and expiry for up to 180 days in localStorage in this browser, to honour your privacy choices. It is separate from informational acknowledgement. Invalid, expired or outdated choices do not permit tracking. These records contain no name, email or advertising identifier. Clearing site data removes the choices. GA4 and Meta Pixel are disabled in the application; no tracking IDs are configured. If activated after separate review, analytics and marketing must require separate category choices. Accept all and Reject all must be equally available; customization offers separate choices. Scrolling, closing settings or using the site does not give consent. Reading this information does not consent to future tools.
Cloudflare provides hosting and security, Resend email delivery, Gmail receipt and storage of correspondence, and Google PageSpeed Insights website analysis. Processing may occur outside Norway/the EEA. Provider roles, agreements and transfer grounds must be assessed per service; an agreement for one Google service does not automatically cover others. Resend states that stored data is processed in the United States and describes Standard Contractual Clauses in its processing agreement. Agreements and safeguards for URWE’s setup are subject to final review. Contact personvern@urwe.no about rights and transfers.
Where applicable, you may request access, correction, erasure, restriction and portability, and object to processing. Consent may be withdrawn without affecting earlier lawful processing. Send requests to personvern@urwe.no or use the postal address or telephone; necessary identity verification may apply. We respond without undue delay and normally within one month. Where the law permits an extension, we notify you within the first month with reasons. You may complain to Datatilsynet at datatilsynet.no without contacting us first. The analyzer assesses webpages, not individuals, and is not used for automated decisions about people with legal or similarly significant effects.
You submit a public URL and select mobile or desktop. URWE sends the URL and device selection to Google PageSpeed Insights, which uses Lighthouse to retrieve and analyze the page. The report displays available scores, measurements, time and findings. We do not forward your browser cookies or client IP in the analysis request, but Google receives technical data from the server connection. The API key is used only server-side. Submit only pages you are entitled to have analyzed, without personal data or confidential information. The URL path and page content may contain such information even though query parameters, fragments and credentials are rejected.
The analyzer has no report database or application cache. API responses use no-store; the report is processed to answer the request and displayed in the browser. This does not delete provider logs. Cloudflare still processes IP addresses and technical data, and IPs are used for request limiting. The locally prepared logging change disables automatic Worker invocation logs while retaining diagnostic logs; it has not yet been deployed. Analyzer code does not log submitted URLs, IP addresses, request headers or API keys. Other provider and error logs must be assessed separately.