Free delivery over 899,-
Jobb og Fritid

Privacy

Privacy Policy

How Jobb og Fritid AS processes your personal data when you shop with us, create an account or contact us.

This privacy policy explains how Jobb og Fritid AS processes personal data about you as a customer and user of the online shop jobbogfritid.no. We process data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

Last updated: 19 August 2026.

Data Controller

Jobb og Fritid AS (org.nr 925 519 278) is the data controller for personal data processed through the online shop.

  • Address: Karlsøyvegen 10, 9015 Tromsø
  • E-mail: post@jobbogfritid.no
  • Phone: 77 68 64 85

If you have questions about privacy or wish to exercise your rights, please contact us at post@jobbogfritid.no.

Data Protection Officer

We are not legally required to appoint a data protection officer, and have not done so. Privacy enquiries should be directed to the contact point above.

What data we process

Depending on how you use the online shop, we process:

  • Contact and customer details: name, e-mail, telephone number, delivery and invoice address.
  • Order and purchase information: what you have bought, order history, amounts, payment method and delivery choices.
  • Account information: login details, preferences, favourites and saved addresses if you create an account.
  • Business information (B2B): organisation number, company name, contact person, reference and invoice marking for business customers.
  • Communications: messages you send us, and e-mails we send you (order confirmations, receipts, notifications).
  • Technical information: IP address, device and browser type, and use of the website via cookies (see the cookie declaration).
  • Chat messages: messages you write to the digital assistant on the website, and the responses you receive from it.

We do not process special categories of personal data (sensitive data).

Is it voluntary to provide the information?

Certain information is necessary in order for you to shop with us. To complete a purchase we must process your name, contact information, delivery address and payment details. Without these we cannot enter into or fulfil the purchase agreement, process payment or deliver the goods. Other information – such as creating an account or signing up for a newsletter – is entirely voluntary.

Where the information comes from

Most information comes directly from you. In the online shop you enter your own details when you shop, create an account or contact us.

In our physical shop you provide your telephone number, and we retrieve the associated name and address from a publicly available directory service and store this together with your purchase. The name and address for in-store purchases therefore come from such a lookup service, not directly from you.

Customer and order data are exchanged in both directions between the online shop and the point-of-sale and retail management system PcKasse (Com2gether AS), so that purchases and customer relationships are linked regardless of whether you shop in store or online. We also retrieve product and price data from PcKasse. Technical information is collected automatically when you use the website, as described in the cookie declaration.

Purposes and legal basis

We process personal data for the following purposes:

  • Processing purchases and delivering goods — including payment, shipping, order confirmation and customer service. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
  • Complying with legal obligations — such as bookkeeping and retention of sales documentation. Legal basis: legal obligation (Art. 6(1)(c)).
  • Managing accounts and business agreements — login, order history, B2B catalogue and customer discounts. Legal basis: contract (Art. 6(1)(b)).
  • Security and fraud prevention — protecting the online shop and customers against misuse. Legal basis: legitimate interest in securing the service and preventing misuse (Art. 6(1)(f)).
  • Improving the online shop and understanding usage — statistics and analysis. Legal basis: consent to statistics cookies (Art. 6(1)(a)).
  • Marketing and newsletter — sending you offers and news if you have signed up. Legal basis: consent (Art. 6(1)(a)). You may unsubscribe at any time.
  • Measuring the effect of adverts — whether a click on a Google advert led to a purchase, including sharing of click ID, purchase value and encrypted (hashed) e-mail/phone with Google Ads. Legal basis: consent to marketing cookies (Art. 6(1)(a)). See the cookie declaration.
  • Invitation to review a product — after a purchase we may send you an e-mail inviting you to review the item. Legal basis: legitimate interest in obtaining feedback from our own customers (Art. 6(1)(f)). This e-mail is separate from the newsletter, and you may opt out.
  • Responding to questions in the customer chat — operating the digital assistant and improving the responses it provides. Legal basis: legitimate interest in operating and improving customer service (Art. 6(1)(f)).

Where we rely on legitimate interest, we have assessed that our interest does not override your rights and freedoms (a so-called balancing of interests test). You may request a summary of this assessment by contacting us, and you always have the right to object to such processing (see 'Your rights').

Automated decisions and profiling

We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you.

In connection with the newsletter (Klaviyo) we may group recipients according to what they have purchased, so that the content is more relevant. This is done only with consent, has no legal or similarly significant effect on you, and you may unsubscribe at any time.

Customer chat (digital assistant)

On certain pages we offer a digital assistant that you choose to open yourself. It answers general questions about shipping, returns, payment, products and our shops, and is based on information we have published on the website. The assistant cannot look up your account or orders.

When you write in the chat, we store your messages and the assistant's responses, along with the time and the page the chat was used from. The conversation is assigned a random conversation ID that links the messages together. This ID is stored only in your browser while the tab is open, and disappears when you close it.

We do not store your name, e-mail address or IP address alongside the conversation, and the conversation is not linked to your user account even if you are logged in. We are therefore normally unable to see who has written a message — unless you yourself include personal details in the text. We encourage you not to write national identity numbers, card details, health information or other sensitive information in the chat. If your enquiry concerns a specific matter, please contact us at post@jobbogfritid.no or 77 68 64 85.

The purpose of storing the data is to improve responses and identify questions we do not currently answer well enough. Legal basis: legitimate interest in operating and improving customer service (Art. 6(1)(f)). Conversations are stored for up to 12 months and are then deleted automatically.

To generate responses, your message and our information base are sent to Anthropic, which provides the language model. Anthropic processes the data on our behalf under a data processing agreement and does not use it to train its models.

To prevent misuse, we limit how many messages can be sent from the same browser per hour. For this purpose, we process your IP address briefly, for up to one hour, without linking it to the content of the conversation.

Data processors

To deliver our services, we use selected suppliers who process personal data on our behalf. We enter into a data processing agreement with all of them, and where transfers occur outside the EU/EEA, the transfer is safeguarded by the European Commission's standard contractual clauses (SCC) and/or the EU–US Data Privacy Framework.

  • Supabase — database, login and storage of account, order and customer data. (EU/EEA.)
  • Stripe — card payment and payment processing. (EU/EEA and USA, SCC/DPF.)
  • PcKasse (Com2gether AS) — point-of-sale and retail management system; source of product, price, customer and order data. (Norway/EEA.)
  • Resend — sending of transactional e-mail (order confirmations, receipts, notifications). (EU/EEA and USA, SCC/DPF.)
  • Klaviyo — sending and management of newsletters (only with consent). (USA, SCC/DPF.)
  • Lipscore — collection and display of product reviews. (Norway/EEA.)
  • Vercel — operation and hosting of the online shop, as well as anonymous performance statistics (cookie-free). (EU/EEA and USA, SCC/DPF.)
  • Google (Google Analytics 4) — statistics on website usage (only with consent to statistics). (USA, SCC/DPF.)
  • Cookie Information — consent solution (cookie banner) and logging of consent. (EU/EEA, Denmark.)
  • Anthropic — the language model that generates responses in the digital assistant. (USA, SCC.)
  • Upstash — technical rate limiting of requests to prevent misuse of login and customer chat. (EU/EEA, Ireland.)

Independent data controllers

Certain recipients determine the purpose and means of processing themselves, and are therefore independent data controllers — not data processors acting on our behalf:

  • Klarna — when paying with Klarna (invoice, part payment or card), Klarna is an independent data controller for the execution of the payment and any credit assessment. How Klarna processes your data is described in Klarna's own privacy policy.
  • Vipps — when paying with Vipps and when logging in with Vipps Login, Vipps MobilePay is an independent data controller for the execution of the payment and user identification. How Vipps processes your data is described in Vipps' own privacy policy.
  • Bring/Posten — when we send a parcel, we provide the carrier with your name, address and phone number. Bring/Posten determines independently how delivery is carried out and is subject to its own obligations under postal legislation, and is therefore an independent data controller for the data it receives. How they process the data is described in their own privacy policy.
  • Google Ads — when measuring advertisements (click ID, purchase value and encrypted e-mail/phone number at the time of purchase, only with consent to marketing), Google processes the data under Google Ads' data protection terms (independent data controller). Google Analytics 4 (statistics) remains listed under data processors above.

We never sell your personal data to third parties.

Transfers outside the EU/EEA

Some of our suppliers are established in, or use sub-processors in, the USA. Such transfers take place on the basis of the European Commission's standard data protection clauses (SCC) and/or the EU–US Data Privacy Framework, ensuring that your data is afforded a level of protection equivalent to that required under the GDPR.

How long we store your data

  • Sales documentation subject to accounting obligations is retained for up to five years after the end of the financial year, as required by the Bookkeeping Act.
  • Account details are stored for as long as you have an active account. If you delete your account, we remove your data, with the exception of data we are legally required to retain.
  • Newsletter consent is stored until you unsubscribe.
  • Technical data and statistics are stored in accordance with the settings described in the cookie declaration.
  • Conversations with the digital assistant are stored for up to 12 months and are then deleted automatically.

Children

The online shop is aimed at adults and is not designed for children. We do not knowingly collect personal data from children under the age of 16 without the consent of a person with parental responsibility.

Your rights

Under data protection legislation, you have the right to:

  • access the data we process about you,
  • have inaccurate data corrected,
  • have data deleted (the 'right to be forgotten'),
  • request restriction of processing,
  • object to processing based on legitimate interest,
  • receive your data in a machine-readable format (data portability),
  • withdraw consent you have given, without this affecting the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, please contact us at post@jobbogfritid.no. We normally respond without undue delay and at the latest within one month. In more complex cases, the deadline may be extended by up to two months, and we will notify you accordingly.

Cookies

The online shop uses cookies to function, measure usage and — with your consent — for marketing. You manage your consent via the consent banner. Read more in the cookie declaration.

Security

We have technical and organisational measures in place to protect personal data against unauthorised access, alteration and deletion:

  • All traffic in the online shop is encrypted with HTTPS.
  • Passwords are stored as a secure hash via Supabase Auth, and login is otherwise handled via Vipps or a one-time code.
  • Administrator access is protected with role-based authentication.
  • Backups are performed automatically.
  • Access to customer data is restricted to employees who need it to carry out their work.

Complaints to the Norwegian Data Protection Authority

If you believe we are processing personal data in breach of the regulations, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We would nonetheless appreciate it if you contact us first, so that we can find a solution together.

Changes

We may update this privacy policy. The current version is always available on this page, with the date of the most recent update shown at the top.