Last updated: August 2026
About GDPR
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It gives individuals in the European Economic Area greater control over their personal data and requires organizations to be transparent about how they collect and process personal information.
Data Controller
Blomsterglede acts as the data controller for personal information collected through our website and services. This means we determine the purposes and means of processing your personal data.
Contact information:
Blomsterglede
Blomstergaten 24
0472 Oslo, Norway
Email: [email protected]
Your Rights Under GDPR
The GDPR provides you with several important rights regarding your personal data:
Right to Access
You have the right to request a copy of the personal data we hold about you. We will provide this information free of charge within one month of receiving your request.
Right to Rectification
If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will address your request promptly.
Right to Erasure
Also known as the "right to be forgotten," you can request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for its original purpose or when you withdraw consent.
Right to Restrict Processing
You can request that we limit how we use your personal data in certain situations, such as while we verify the accuracy of data you have disputed.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to have it transferred to another data controller where technically feasible.
Right to Object
You can object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.
Rights Related to Automated Decision-Making
You have the right not to be subject to decisions based solely on automated processing that significantly affect you. We do not currently use automated decision-making that falls under this provision.
How to Exercise Your Rights
To exercise any of these rights, please contact us using the information provided above. We may need to verify your identity before processing your request. We will respond to your request within one month, though this period may be extended in complex cases.
Legal Basis for Processing
We process personal data under the following legal bases as defined by GDPR:
- Contract: Processing necessary to fulfill orders and provide services you have requested
- Consent: Processing based on your explicit consent, such as marketing communications
- Legitimate Interests: Processing necessary for our legitimate business interests, balanced against your rights
- Legal Obligation: Processing required to comply with legal requirements
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods vary by data type and purpose.
International Transfers
When personal data is transferred outside the European Economic Area, we ensure adequate protection through appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay where required.
Supervisory Authority
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet):
Datatilsynet
Postboks 458 Sentrum
0105 Oslo, Norway
Website: www.datatilsynet.no
Updates
We may update this GDPR information page periodically. Significant changes will be communicated through appropriate channels.