Free delivery over 899,-
Jobb og Fritid

Privacy

Privacy Policy

How Jobb og Fritid AS processes your personal data when you shop with us, create an account or contact us.

This privacy policy explains how Jobb og Fritid AS processes personal data about you as a customer and user of the online shop jobbogfritid.no. We process data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Last updated: 7 October 2026.

Data Controller

Jobb og Fritid AS (org.nr 925 519 278) is the data controller for personal data processed through the online shop.

  • Address: Karlsøyvegen 10, 9015 Tromsø
  • E-mail: post@jobbogfritid.no
  • Phone: 77 68 64 85

If you have questions about privacy or wish to exercise your rights, contact us at post@jobbogfritid.no.

Data Protection Officer

We are not legally required to appoint a data protection officer and have not done so. Questions about privacy should be directed to the contact point above.

What data we process

Depending on how you use the online shop, we process:

  • Contact and customer details: name, e-mail, phone number, delivery and invoice address.
  • Order and purchase details: what you have bought, order history, amounts, payment method and delivery choices.
  • Account details: login information, preferences, favourites and saved addresses if you create an account.
  • Business details (B2B): organisation number, company name, contact person, reference and invoice marking for business customers.
  • Communications: messages you send us, and e-mails we send you (order confirmations, receipts, notifications).
  • Technical details: IP address, device and browser type, and use of the website via cookies (see the cookie declaration).
  • Chat messages: messages you write to the digital assistant on the website, and the responses you receive from it.

We do not process special categories of personal data (sensitive data).

Is it voluntary to provide your details?

Certain details are necessary in order to shop with us. To complete a purchase we must process your name, contact information, delivery address and payment details. Without these we cannot enter into or fulfil the purchase agreement, process payment or deliver the goods. Other details – such as creating an account or signing up for a newsletter – are entirely voluntary.

Where the data comes from

We receive most data directly from you. In the online shop you enter your details yourself when you shop, create an account or contact us.

In our physical shop you provide your phone number, and we retrieve the associated name and address from a publicly available directory service and store this alongside your purchase. The name and address for in-store purchases therefore come from such a lookup service, not directly from you.

Customer and order data is exchanged in both directions between the online shop and the point-of-sale and retail management system PcKasse (Com2gether AS), so that purchases and customer relationships are connected regardless of whether you shop in store or online. We also retrieve product and price data from PcKasse. Technical details are collected automatically when you use the website, as described in the cookie declaration.

Purposes and legal basis

We process personal data for the following purposes:

  • Completing purchases and delivering goods — including payment, shipping, order confirmation and customer service. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Fulfilling legal obligations — such as bookkeeping and retention of sales documentation. Legal basis: legal obligation (Art. 6(1)(c)).
  • Managing accounts and business agreements — login, order history, B2B catalogue and customer discounts. Legal basis: contract (Art. 6(1)(b)).
  • Security and fraud prevention — protecting the online shop and customers against misuse. Legal basis: legitimate interest in securing the service and preventing misuse (Art. 6(1)(f)).
  • Improving the online shop and understanding usage — statistics and analysis. Legal basis: consent to statistics cookies (Art. 6(1)(a)).
  • Marketing and newsletter — sending you offers and news if you have signed up. Legal basis: consent (Art. 6(1)(a)). You may unsubscribe at any time.
  • Measuring the effect of adverts — whether a click on a Google advert led to a purchase, including sharing of click ID, purchase value and encrypted (hashed) e-mail/phone with Google Ads. Legal basis: consent to marketing cookies (Art. 6(1)(a)). See the cookie declaration.
  • Invitation to review a product — after a purchase we may send you an e-mail inviting you to review the item. Legal basis: legitimate interest in obtaining feedback from our own customers (Art. 6(1)(f)). This e-mail is separate from the newsletter and you may opt out.
  • Responding to questions in the customer chat — operating the digital assistant and improving the responses it provides. Legal basis: legitimate interest in operating and improving customer service (Art. 6(1)(f)).

Where we rely on legitimate interest, we have assessed that our interest does not override your rights and freedoms (a so-called balancing of interests test). You may request a summary of this assessment by contacting us, and you always have the right to object to such processing (see 'Your rights').

Automated decisions and profiling

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

In connection with the newsletter (Klaviyo) we may group recipients based on what they have purchased, so that the content is more relevant. This is done only with consent, has no legal or similarly significant effect on you, and you may unsubscribe at any time.

Customer chat (digital assistant)

On certain pages we offer a digital assistant that you choose to open yourself. It answers general questions about shipping, returns, payment, products and our shops, and is based on information we have published on the website ourselves. The assistant cannot look up your account or orders.

When you write in the chat, we store your messages and the assistant's replies, along with the time and which page the chat was used from. The conversation is assigned a random conversation ID that links the messages together. This ID is stored only in your browser while the tab is open, and disappears when you close it.

We do not store your name, e-mail address or IP address alongside the conversation, and the conversation is not linked to your user account even if you are logged in. We are therefore normally unable to see who has written a message — unless you yourself provide personal details in the text. We encourage you not to write national identity numbers, card details, health information or other sensitive information in the chat. If your enquiry concerns a specific matter, please contact us at post@jobbogfritid.no or 77 68 64 85.

The purpose of storing the data is to improve responses and identify questions we do not answer well enough at present. Legal basis: legitimate interest in operating and improving customer service (Art. 6(1)(f)). Conversations are stored for up to 12 months and are then deleted automatically.

To generate responses, your message and our information base are sent to Anthropic, which provides the language model. Anthropic processes the data on our behalf under a data processing agreement and does not use it to train its models.

To prevent misuse, we limit how many messages can be sent from the same browser per hour. For this purpose we process your IP address briefly, for up to one hour, without linking it to the content of the conversation.

Staff discount through your employer

Some companies have a partnership agreement with us under which their employees receive a discount in the online shop. You sign up yourself via a link from your employer.

  • What we process: name, e-mail address and the fact that you are enrolled in the company's partnership agreement.
  • What your employer can see: that you are enrolled in the agreement (name and e-mail address). If you do not use a company e-mail address, the company's administrator will also see your registration in order to be able to approve it.
  • What your employer cannot see: what you buy, what you pay or your orders. Your purchases are private.
  • Legal basis: the agreement with you to provide you with the company discount (General Data Protection Regulation Article 6(1)(b)).
  • Withdrawal: you can leave the scheme at any time under My Page → Company. You will then lose the discount and the company will no longer be able to see you.

Data processors

To deliver our services we use selected suppliers who process personal data on our behalf. We enter into a data processing agreement with all of them, and where transfers take place outside the EU/EEA the transfer is safeguarded by the European Commission's standard contractual clauses (SCCs) and/or the EU–US Data Privacy Framework.

  • Supabase — database, login and storage of account, order and customer data. (EU/EEA.)
  • Stripe — card payment for orders placed before 12 October 2026 (settlement and refunds). (EU/EEA and USA, SCC/DPF.)
  • PcKasse (Com2gether AS) — point-of-sale and retail management system; source of product, price, customer and order data. (Norway/EEA.)
  • Resend — sending of transactional e-mail (order confirmations, receipts, notifications). (EU/EEA and USA, SCC/DPF.)
  • Klaviyo — sending and management of newsletters (only with consent). (USA, SCC/DPF.)
  • Lipscore — collection and display of product reviews. (Norway/EEA.)
  • Vercel — operation and hosting of the online shop, as well as anonymous performance statistics (cookie-free). (EU/EEA and USA, SCC/DPF.)
  • Google (Google Analytics 4) — statistics on website usage (only with consent to statistics). (USA, SCC/DPF.)
  • Cookie Information — consent solution (cookie banner) and logging of consent. (EU/EEA, Denmark.)
  • Anthropic — the language model that generates responses in the digital assistant. (USA, SCC.)
  • Upstash — technical rate limiting to prevent misuse of login and the customer chat. (EU/EEA, Ireland.)

Independent data controllers

Certain recipients determine the purpose and means of processing themselves and are therefore independent data controllers — not data processors acting on our behalf:

  • Nets (Nexi Group) — payments in the online shop are processed by Nets, which is an independent data controller for the payment transaction, including when you pay by card, Vipps, Klarna, Apple Pay or Google Pay. How Nets processes your data is described in Nexi's own privacy policy.
  • Klarna — when paying with Klarna (invoice, part payment or card), Klarna is an independent data controller for processing the payment and any credit assessment. How Klarna processes your data is described in Klarna's own privacy policy.
  • Vipps — when paying with Vipps and when logging in with Vipps Login, Vipps MobilePay is an independent data controller for processing the payment and user identification. How Vipps processes your data is described in Vipps' own privacy policy.
  • Bring/Posten — when we dispatch a parcel, we provide the carrier with your name, address and telephone number. Bring/Posten determines how delivery is carried out and is subject to its own obligations under postal legislation, and is therefore an independent data controller for the data it receives. How they process the data is described in their own privacy policy.
  • Google Ads — when measuring adverts (click ID, purchase value and encrypted e-mail/phone number at the time of purchase, only with consent to marketing), Google processes the data under Google Ads' data protection terms (independent data controller). Google Analytics 4 (statistics) remains listed under data processors above.

We never sell your personal data to third parties.

Transfers outside the EU/EEA

Some of our suppliers are established in, or use sub-processors in, the USA. Such transfers take place on the basis of the European Commission's standard contractual clauses (SCCs) and/or the EU–US Data Privacy Framework, so that your data enjoys a level of protection equivalent to that required under the GDPR.

How long we store data

  • Sales documentation subject to bookkeeping obligations is retained for up to five years after the end of the financial year, as required by the Bookkeeping Act.
  • Account details are stored for as long as you have an active account. If you delete your account, we remove the details, except for those we are legally required to retain.
  • Newsletter consent is stored until you unsubscribe.
  • Technical information and statistics are stored in accordance with the settings described in the cookie declaration.
  • Conversations with the digital assistant are stored for up to 12 months and are then deleted automatically.
  • Registrations for a business collaboration agreement that have not been approved are deleted after 30 days. Membership continues until you withdraw, or until the business or we terminate the agreement.

Children

The online shop is intended for adults and is not designed for children. We do not knowingly collect personal data from children under the age of 16 without consent from the person with parental responsibility.

Your rights

Under data protection legislation you have the right to:

  • access the information we process about you,
  • have inaccurate information corrected,
  • have information deleted (the 'right to be forgotten'),
  • request restriction of processing,
  • object to processing based on legitimate interest,
  • receive your information in a machine-readable format (data portability),
  • withdraw consent you have given, without this affecting the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, contact us at post@jobbogfritid.no. We normally respond without undue delay and at the latest within one month. In more complex cases the deadline may be extended by up to two months, and we will notify you if this is the case.

Cookies

The online shop uses cookies to function, to measure usage and — with your consent — for marketing. You manage your consent via the consent banner. Read more in the cookie declaration.

Security

We have technical and organisational measures in place to protect personal data against unauthorised access, alteration and deletion:

  • All traffic in the online shop is encrypted using HTTPS.
  • Passwords are stored as a secure hash via Supabase Auth, and login is otherwise handled via Vipps or a one-time code.
  • Administrator access is protected by role-based authentication.
  • Backups are performed automatically.
  • Access to customer data is restricted to employees who need it to carry out their work.

Complaints to Datatilsynet

If you believe we are processing personal data in breach of the regulations, you may lodge a complaint with Datatilsynet. We would nevertheless appreciate it if you contact us first, so that we can find a solution together.

Changes

We may update this privacy policy. The version currently in force is available on this page, with the date of the most recent update at the top.