Quick assessment
The proposed policy is substantially stronger than the previous version: it identifies the controller, explains legal bases, retention periods, data processors, international transfers, user rights, cookies and AI-assisted support. I would keep the placeholder effective date open until you confirm the final approval date. This is not legal advice, but structurally it is much closer to what a GDPR-facing privacy notice should contain.
1. Who is the controller?
Innovolve AS is the controller for the personal data we collect about you when you use ur-origin.com and related services.
Innovolve AS, Husebybakken 28B, 0379 Oslo, Norway. Email: ur@innovolve.no. Phone: +47 906 38 332.
Privacy questions may be sent to the same address. We have not appointed a formal Data Protection Officer, as we are not required to do so under GDPR Article 37. Privacy requests are handled by the CEO or the responsible contact person.
2. What personal data do we process?
We process different categories of personal data depending on how you use the website: contact details such as name, email address and phone number; chatbot messages sent through Intercom Fin; order and purchase data such as name, billing address, delivery address and order history; technical data such as IP address, browser type, referrer URL and page views; and newsletter sign-up data such as email address.
We do not process sensitive personal data or special categories of personal data under GDPR Article 9.
3. Purposes and legal bases
We only process personal data where we have a valid legal basis under GDPR Article 6.
Website operation and technical analytics: to display the website correctly, monitor performance and detect technical errors. Legal basis: legitimate interest under Article 6(1)(f).
Contact forms: to respond to enquiries from potential and existing customers. Legal basis: legitimate interest under Article 6(1)(f), or performance of a contract or pre-contractual steps under Article 6(1)(b) where the enquiry concerns a purchase or complaint.
Chatbot, Intercom Fin: to provide fast customer support through our AI-powered chat widget. Legal basis: legitimate interest under Article 6(1)(f). See section 10 on automated processing.
Orders and purchases: to complete transactions, send order confirmations, handle complaints and warranties. Legal basis: performance of a contract under Article 6(1)(b). Without this data, we cannot complete the purchase.
Newsletter and marketing: to send news about products, campaigns and the UR® brand. Legal basis: consent under Article 6(1)(a). You may withdraw your consent at any time.
Legal obligations: to comply with accounting duties and other legal requirements. Legal basis: legal obligation under Article 6(1)(c), typically under the Norwegian Bookkeeping Act.
4. Who do we share data with?
We use selected processors to deliver our services. All processors are subject to a written data processing agreement with Innovolve AS.
Framer B.V. provides the website CMS and publishing platform in the EU. Shopify Inc. provides e-commerce order processing in the United States. Intercom, Inc. provides chat and AI customer support in the United States. Google LLC provides Google Fonts from Google’s CDN in the United States. Framer Analytics provides built-in traffic measurement in the EU.
We do not sell personal data to third parties and we do not share data with advertising networks. We may disclose information to public authorities, such as the police, the Norwegian Data Protection Authority or tax authorities, if we are legally required to do so.
5. Transfers outside the EEA
Some of our providers, including Shopify, Intercom and Google Fonts, are established in the United States and may transfer personal data there. Such transfers are safeguarded by the EU Standard Contractual Clauses adopted by the European Commission, implementing decision 2021/914, in accordance with GDPR Article 46(2)(c).
You may request a copy of the relevant Standard Contractual Clauses by contacting us at ur@innovolve.no.
6. How long do we store personal data?
We store personal data only for as long as necessary for the purpose for which it was collected, or for as long as we are legally required to retain it.
Contact form enquiries are stored for 2 years after the last contact. Chatbot logs are stored for 1 year. Order data is stored for 5 years after the end of the accounting year. Newsletter subscriptions are stored until consent is withdrawn. Technical logs are stored for 90 days.
After the retention period expires, the data is deleted or anonymised.
7. Your rights
You have the following rights under the GDPR. Requests should be sent to ur@innovolve.no. We respond within 30 days. Exercising your rights is free of charge unless the request is manifestly unfounded or excessive.
Right of access: you may ask whether we process personal data about you and receive information about the data, the purposes, recipients and planned retention period.
Right to rectification: you may ask us to correct or complete inaccurate or incomplete data.
Right to erasure: you may ask us to delete your personal data where there is no longer a legal basis for processing, or where you withdraw consent. Data we are legally required to keep, such as accounting data, cannot be deleted under this right.
Right to restriction: in certain cases you may ask us to restrict processing, for example while accuracy is being contested or while we assess an objection.
Right to data portability: for data you have provided to us and which is processed automatically based on consent or contract, you may request a machine-readable copy, such as JSON or CSV.
Right to object: where processing is based on legitimate interest, you may object. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. You may always object to direct marketing without giving a reason.
8. Right to lodge a complaint
If you believe we process your personal data in breach of data protection law, you have the right to lodge a complaint with the Norwegian Data Protection Authority: Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway. Website: datatilsynet.no. Email: postkasse@datatilsynet.no.
We encourage you to contact us first so we can try to resolve any issue directly.
9. Withdrawing consent
Where processing is based on your consent, such as newsletter subscriptions, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Newsletter consent can be withdrawn by clicking the unsubscribe link in any email from us. Other consents can be withdrawn by emailing ur@innovolve.no with the subject line “Withdraw consent”.
10. Automated processing and profiling
Intercom Fin is an AI-powered chatbot that processes the messages you send in order to generate responses. This involves automated text understanding and contextual response generation, but it does not produce legal effects or similarly significant effects for you. It is not profiling within the meaning of GDPR Article 22. You may always ask in the chat to be escalated to a human team member.
We do not use automated decision-making that has legal effects for you under GDPR Article 22.
11. Cookies and similar technologies
Cookies are small text files stored in your browser when you visit a website. We use them to make the website work correctly and to understand usage patterns.
We use necessary Framer session cookies for page loading and navigation, Framer Analytics for anonymised traffic analysis, Intercom cookies to store chat preferences and session ID, and Google Fonts to deliver fonts from Google’s CDN. Google Fonts may log IP addresses.
We currently do not use third-party advertising or tracking cookies such as Meta Pixel or Google Ads. We are working to implement a consent management platform in line with the ePrivacy Directive. Until that is in place, we use only cookies that are technically necessary for the website’s function, plus Framer Analytics in anonymised form.
You can delete or block cookies in your browser settings at any time. This may affect website functionality.
12. Children
We may update this policy when needed. The latest version is always available at ur-origin.com/privacy with its effective date. For material changes, we will notify you by email or by a clear notice on the website.
Version 1.0, 1 May 2025: first version. Version 2.0, 17 June 2026: full revision covering legal bases, retention periods, rights, cookies and the Norwegian Data Protection Authority reference.
13. Changes to this policy
We may update this policy when needed. The latest version is always available at ur-origin.com/privacy with its effective date. For material changes, we will notify you by email or by a clear notice on the website.
Version 1.0, 1 May 2025: first version. Version 2.0, [DATE]: full revision covering legal bases, retention periods, rights, cookies and the Norwegian Data Protection Authority reference.
14. Contact us
If you have questions about privacy, want to exercise a right, or have comments about this policy, please contact us.
Innovolve AS, Husebybakken 28B, 0379 Oslo, Norway. Email: ur@innovolve.no. Phone: +47 906 38 332.
We aim to respond to all enquiries within 5 business days, and no later than 30 days as required by the GDPR.