Privacy Policy

This statement explains how SustEvo AS processes personal data you share with us via sustevo.com. We process all data in line with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Data controller

SustEvo AS is the data controller for personal data collected through this website. Send any privacy questions to [email protected].

What information we collect

We collect only the information you provide when you contact us through the site’s contact form. This includes:

• Name
• Email address
• Organisation or company (optional)
• Content of the message

In addition, the hosting platform temporarily logs technical data such as IP address to protect against misuse and to limit the number of inquiries per user.

Purpose and legal basis

We use this information solely to respond to inquiries and follow up potential collaborations. The legal basis is legitimate interests under GDPR Article 6(1)(f): to respond to individuals who actively contact us.

Where the information is stored

Messages from the contact form are delivered to a Microsoft 365 mailbox via the Microsoft Graph API. Microsoft acts as our data processor, and the data are stored within the EU/EEA in Microsoft's European data centres. IP addresses used for rate limiting are kept only in the server's memory and are cleared on restart.

Retention period

We retain incoming email only as long as necessary to handle the inquiry and any subsequent customer relationship, normally up to three years after the last contact. We then delete the inquiry unless further retention is required for accounting or legal reasons.

Cookies and analytics

The site does not use tracking cookies. We collect anonymous traffic statistics via Cloudflare Web Analytics, a cookie-free, privacy-friendly service. See our cookie statement for details.

Your rights

You have the right to:

• request access to the information we hold about you
• have inaccurate information corrected
• request deletion of information we no longer have a basis to retain
• object to processing or request restriction
• receive your data in a machine-readable format (data portability)

Send requests concerning your rights to [email protected]. We normally respond within 30 days.

Right to lodge a complaint

If you believe we are processing personal data in violation of the rules, you may lodge a complaint with the Norwegian Data Protection Authority. Contact information is available at datatilsynet.no.

Changes

We may update this statement in response to changes in services or regulation. The version in force at any time will be published on this page.