Privacy Policy

Who is responsible

Igloo Innovation is the data controller for the personal data described in this policy.

Privacy contact: Jarle Aambø

Privacy contact email: jarle.aambo@iglooinnovation.no

Information we receive

When you use our contact form, we receive the information you choose to submit, including:

• name
• company or organisation
• email address
• selected enquiry topic
• message content

To protect the form against spam and misuse, we also process limited technical anti-abuse information required for rate limiting and automated abuse detection. This includes a pseudonymised identifier derived from technical request information.

Please do not submit sensitive personal data (such as health information, national identity numbers or other special categories of data) through the open contact form. If your enquiry requires such information, contact us by email so we can agree a more appropriate channel.

Why we use the information

We use contact and website-related information for the following purposes:

• to receive and respond to your enquiry
• to assess potential projects and partnerships related to your message
• to maintain necessary correspondence about your enquiry
• to protect the contact form and website against spam and misuse

We do not use information submitted through the contact form for newsletters, profiling or unrelated marketing.

Legal basis

For ordinary business and partnership enquiries submitted through our contact form, our intended legal basis is legitimate interests: responding to enquiries you initiate and assessing relevant opportunities, balanced against your rights and expectations.

Where processing is necessary to take steps at your request before entering into an agreement, that basis may also apply where relevant.

Submitting the contact form is not described as consent, and we do not rely on consent for ordinary enquiry handling.

Retention

Ordinary contact enquiries are retained for no longer than 12 months after the enquiry is resolved, unless the information becomes part of an active project, contractual relationship, legal obligation or documented legal claim that requires longer retention.

Anti-abuse identifiers used for rate limiting are retained only for the short period required for that protection (typically up to one hour per identifier window).

We review retention regularly. Deletion is carried out when information is no longer needed for the purposes described above, subject to any applicable legal exceptions.

Service providers

We use the following service providers to operate the website and contact form. They process personal data on our behalf as processors where applicable:

• Vercel — website hosting and server-side execution of the site and contact form
• Resend — delivery of contact-form messages by email
• Upstash — rate limiting and abuse protection for the contact form

For rate limiting, Upstash receives a salted, hash-based identifier derived from technical request information. Igloo does not deliberately store your raw IP address for this purpose. The identifier is pseudonymised, not anonymous.

We do not use analytics, advertising or cookie-based tracking tools on the website at the time of this policy.

International transfers

Some of our service providers may process information outside Norway or the European Economic Area (EEA). Where this occurs, Igloo must ensure an appropriate transfer basis and processor agreement where required by applicable law.

We do not make detailed claims about data location or specific transfer mechanisms in this policy until provider arrangements are documented internally.

Security

We apply security measures appropriate to the nature of the information we process, including:

• collecting only information needed for the stated purposes
• server-side validation and field limits on the contact form
• spam and abuse protection, including honeypot and rate limiting controls
• access-controlled environment variables for email delivery configuration
• authenticated email delivery through our email provider
• restricted access to enquiries received by authorised Igloo personnel

We do not describe specific operational security controls in detail on this page.

Your rights

Under applicable data protection law, you may have the right to:

• request access to personal data we hold about you
• request correction of inaccurate data
• request deletion in certain circumstances
• request restriction of processing in certain circumstances
• object to processing based on legitimate interests in certain circumstances
• lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet)

To exercise your rights, contact us at jarle.aambo@iglooinnovation.no. We respond to valid requests in accordance with applicable law. A deletion request may not always result in immediate deletion where a legal exception applies (for example, where retention is required for a legal claim or contractual obligation).

You can find information about Datatilsynet at datatilsynet.no.

Changes

We may update this Privacy Policy from time to time. The latest revision date is shown at the top of this page. Material changes will be reflected in an updated version published on this website.