Privacy policy

Data controller

The data controller is Bjørn Mathisen Antikviteter ANS, org. no. 952 717 103.

Kirkeveien 73, 0364 Oslo
Email: post@bmantikviteter.no
Phone: +47 99 79 71 31

This website

The website is hosted at Vercel. Content, the catalogue, enquiries and account information are stored in a database at Neon. Photos and attachments are stored at Vercel Blob.

If you only browse without signing in, we do not collect your name or email. Providers may still process technical information, such as an IP address, to run and secure the site.

Contact form and enquiries

In the contact form you can send your name, email, phone (optional) and a message. On the contact page we ask what the message is about. For sale, commission or valuation we also ask whether the piece is older than 1850, and whether it is like the shop's selection. You can attach up to three photos. The photos are stored privately with the message and are only shown to the shop. If you write from the selection, the title and link to the piece are included. Name, email and a message are needed if you want a reply. Phone and photos are optional.

We use this to reply and follow up. We do not sell it. Email is sent and received via Resend. To limit spam, your network address may be stored for about an hour.

Email to post@bmantikviteter.no (subject, content and attachments) is also received via Resend and handled by the shop on the website.

If you send a message while signed out, and later create an account with the same email, the enquiry about a piece may appear under My account so you can follow the replies there.

My account

You can create an account and sign in with Google, or with email and a one-time code. We do not use passwords for My account.

In My account we may store your first and last name, phone number and whether you prefer to be contacted by phone, favourites, enquiries and reply history, private prices we give you, and consent to the newsletter and to notifications when new pieces are listed.

The purpose is so you can follow enquiries, save favourites and receive what you agreed to. The newsletter and alerts about new pieces are optional. You can turn them off under My account, or unsubscribe from the newsletter via the link in the email. You can delete the account under My account. That removes the account, favourites and enquiries there, and stops the newsletter. The email address may remain marked as unsubscribed, so we do not send it again. Ask us if you want that address deleted as well.

Analytics

We use Vercel Web Analytics and Vercel Speed Insights for statistics on traffic and performance. They do not set cookies and do not follow you across websites. The figures are not tied to your name or email. Because nothing is stored on your device for this, the Norwegian Electronic Communications Act does not require a consent banner.

The statistics may also count a few actions, for example that an enquiry was sent, that something was added to favourites, that the map was shown, or that the newsletter was turned on or off. This is stored without names, emails or the text of messages.

Map

On the contact page you can choose to show a map of the shop via Google Maps. The map does not load until you click "Show map". You choose whether to load it. Google may then receive technical information such as IP address and browser information, and set cookies or use local storage. The purpose is to show where the shop is. You can leave the map unloaded and open the address in Google Maps in a new tab instead. See Google's privacy information at policies.google.com/privacy.

Cookies and local storage

Some cookies are needed for the site to work. Under the Electronic Communications Act section 3-15 they can be set without consent. Google's map can set cookies, but only after you click "Show map". We do not use marketing cookies, so there is no general consent banner.

Legal basis

Each purpose has a basis in Article 6 of the General Data Protection Regulation.

• Running and securing the site. Technical logs, such as an IP address, are used to run and secure the website. The basis is legitimate interest (Article 6(1)(f)).
• Contact form and email. When you write to us, we use the information to reply and follow up. The basis is steps before a possible contract (Article 6(1)(b)) and legitimate interest in answering enquiries (Article 6(1)(f)).
• Spam protection. A network address may be stored for about an hour to limit how often a form can be sent. The basis is legitimate interest in preventing misuse (Article 6(1)(f)).
• My account. The account, favourites, enquiries and prices we give you are part of the service you ask for. The basis is contract (Article 6(1)(b)).
• Newsletter and alerts. The newsletter and alerts when new pieces are listed are sent only if you say yes. The basis is consent (Article 6(1)(a)). Email newsletters also require consent under the Norwegian Marketing Act. You can withdraw consent at any time.
• Statistics. Aggregated statistics on traffic and performance, without cookies and without your name. The basis is legitimate interest (Article 6(1)(f)).
• Map. Google Maps loads only when you click "Show map". The basis is consent (Article 6(1)(a)).

Data processors

These providers are used for the website. Those who process information on our behalf are data processors, and a data processing agreement is in place where required. When you use Google sign-in or the map, Google is its own controller for that.

Several providers are companies in the United States. Transfers outside the EEA are covered by a data processing agreement. The basis is the EU Standard Contractual Clauses, and the EU-US Data Privacy Framework where the provider is certified.

• Kodeform Mathisen (org. no. 835 232 212) operates and develops the website, and is a data processor for that work. See kodeform.no.
• Vercel: hosting, file storage and statistics on traffic and performance. See vercel.com.
• Neon: database for content, accounts and enquiries. See neon.tech.
• Clerk: sign-in for My account. See clerk.com.
• Google: sign-in with a Google account, and the map on the contact page when you choose to show it. Google is then its own controller. See policies.google.com/privacy.
• Resend: sending and receiving email, including replies, enquiries, alerts and the newsletter. See resend.com.
• Upstash: limits how often a form can be sent from the same network address, to reduce spam. See upstash.com.

Retention

The account, favourites and enquiries under My account are deleted when you delete the account there. The newsletter and alerts about new pieces stop when you unsubscribe or delete the account. The email address may remain marked as unsubscribed, so we do not send it again. Ask us if you want that address deleted as well.

Contact forms, photos you have sent, and email to the shop are kept while we need them to follow up. There is no fixed deletion period in the system. Photos you upload but do not send are not used. A network address used for spam protection is stored for about an hour. The language choice is stored in the browser for one year. Logs held by providers are deleted on their usual schedule.

Your rights

You can ask for access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interest. You can withdraw consent, without affecting processing that happened before you withdrew it. We do not make automated decisions that have legal effect for you.

The newsletter can also be unsubscribed via the link in the email or under My account. Contact us at post@bmantikviteter.no. We reply without undue delay, and within one month at the latest.

You can complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing information in breach of the rules: datatilsynet.no.

Changes

We may update this statement when the website or the way we process information changes. The updated date is shown at the top of the page.