Privacy

This page explains which personal data we process when you visit morgenstudio.no, say yes to statistics and send us a message through the contact form, why we do it, who helps us with it, and what rights you have.

Who is responsible

Morgen Studio AS, org. no. 836 235 622, in Tromsø is the controller of the data described here. Our address is Storgata 67, 9008 Tromsø, Norway.

Send questions about privacy to hello@morgenstudio.no.

What we collect

When you use the contact form, we get:

• your first name and surname
• your e-mail address
• your phone number, if you give it
• your message

Using the form is voluntary, but without your name and e-mail address we can’t answer you. You can also e-mail us directly at hello@morgenstudio.no.

To stop spam, Cloudflare Turnstile checks that a person is using the form. The check starts when you begin filling in the form on the contact page: the first time you click or move into a field, and at the latest when you send. So it can start before you have sent anything. Reading or scrolling the page doesn’t start it. The check uses, among other things, your IP address and details about your browser and device. When you send, the site checks the result with Cloudflare and includes your IP address.

The site also uses your IP address to limit how many messages can be sent from one place: at most three a minute and five in ten minutes. For that it is only held in Cloudflare’s memory. The site keeps no log of the requests to the form, and it doesn’t write your IP address into any database.

When you visit the site, Cloudflare, which hosts it, processes your IP address and technical details about your browser to deliver the pages and protect the site. Cloudflare also asks your browser to report if something on the site fails to load (Network Error Logging). Such a report goes to Cloudflare and holds, among other things, the page’s address, what went wrong and which browser you use. Cloudflare uses your IP address only while the report is received, to find your approximate country and network, and doesn’t store it.

If you say yes to statistics in the cookie banner, we use Google Analytics. Google then gets a random ID for your browser (the cookie _ga), which pages you visit and the page you came from, when you visit them and how long you stay, roughly where you are (country and region), what kind of device you use, the name and main version of your browser and operating system, the language your browser uses, whether you scroll down a page, whether you follow a link to another site or download a file, and that a message has been sent through the contact form. Google never learns what the message said. Google uses your IP address only to find roughly where you are, on servers in the EU, and doesn’t store it. Google signals and personalised ads are switched off. If you say no, or don’t choose, nothing loads from Google.

The choice you make in the banner, yes or no, and every change under ‘Change consent’ is stored in a consent log, with a random ID (the same as in the cookie cc_cookie), when you chose, which version of the text you saw, and the language. The log doesn’t hold your IP address, which browser you use or which pages you visit. To limit how many choices can be sent from one place, your IP address is held for up to one minute in Cloudflare’s memory, but it isn’t written down.

Beyond this, the site collects no data about you, and it has no ad tracking.

Why, and on what basis

We use the data from the form only to answer your enquiry and follow it up.

The basis is our legitimate interest in answering enquiries (GDPR article 6(1)(f)). If the enquiry is about a possible project, the basis is also that you ask us for something before a possible agreement (article 6(1)(b)).

The Turnstile check and the limit on messages protect the form against spam and misuse, and Cloudflare’s processing during visits keeps the site safe and running. The basis for both is our legitimate interest in a website and a form that work (article 6(1)(f)).

We use the statistics from Google Analytics to see how the site is used, so we can make it better. The basis is your consent (article 6(1)(a), and the Norwegian Electronic Communications Act § 3-15 for the cookies). You can withdraw your consent at any time under ‘Change consent’ at the bottom of every page. The processing before you withdrew it was still lawful (article 7(3)).

We keep the consent log because we must be able to show that you consented to the statistics (article 7(1)). The basis is this legal obligation (article 6(1)(c)). If you say no, we log that too, to be able to show that we respected your choice. The basis for that is our legitimate interest in documenting that your choice is followed (article 6(1)(f)).

Who processes the data for us

These process data on our behalf, as processors:

• Cloudflare, which delivers the pages, tells people from robots in the form (Turnstile) and stores the consent log.
• Google Ireland Limited, which provides Google Analytics: processes the statistics for us, only if you said yes.
• Lettermint B.V. in the Netherlands, which passes the message from the form on to us as an e-mail.
• Microsoft: Microsoft 365 is our e-mail, where your message sits once we have received it.

Cloudflare also uses the signals from the Turnstile check, such as your IP address and details about your browser, to improve its own detection of robots. For that, Cloudflare is itself the controller, as Cloudflare writes in its privacy terms for Turnstile (cloudflare.com/turnstile-privacy-policy).

We never sell your data, and we share it with no one but these.

Transfers outside the EU and EEA

Lettermint states that it processes and stores data within the EU.

Cloudflare is an American company with data centres all over the world, and data can be processed in Cloudflare’s network outside the EU and EEA, also in the USA. Cloudflare’s data processing agreement bases such transfers on the EU-U.S. Data Privacy Framework, with the EU’s standard contractual clauses as a fallback.

Microsoft 365 stores our e-mail in Europe.

The consent log is stored by Cloudflare within the EU.

Google can process the statistics in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google’s data processing terms have the EU’s standard contractual clauses as a fallback.

How long we keep the data

The site itself stores nothing from the form: the message goes straight on as an e-mail. It keeps no log of the requests to the form either, and your IP address is used for the limit on messages for ten minutes only.

Lettermint keeps the e-mail itself and the details about it for 28 days, and delivery events, such as that the e-mail arrived, for up to 90 days, the company states.

Cloudflare gives no retention period for the signals from the Turnstile check that it uses to improve its own detection of robots.

Enquiries that don’t lead to a project are deleted at the latest twelve months after the last contact. If an enquiry leads to a project, we keep it as long as we work together, and after that only as long as the accounting rules require.

Google Analytics deletes the data about each browser and each visit after 14 months. Totals, such as the number of visits in a month, remain. The cookies _ga and _ga_CL92EHVQKV are deleted in your browser 182 days after your last visit, or at once when you withdraw your consent.

Your choice about statistics is remembered for 182 days. We delete the consent log after 24 months.

Cookies and browser storage

The site stores your choice about statistics in the cookie cc_cookie. If you say yes to statistics, Google Analytics sets two more cookies, _ga and _ga_CL92EHVQKV.

Your browser also keeps a few technical notes in the open tab, Cloudflare asks it to remember for seven days that loading errors should be reported (see above), and on the contact page Cloudflare Turnstile stores one entry, cf.turnstile.u. None of these need consent.

All of this, with who stores it, the purpose and the duration, is on the cookie page (morgenstudio.no/cookies). There you can also see and change your choice.

Your rights

You can ask to see the data we hold about you, and ask us to correct or delete it. You can also ask us to restrict the processing, object to it, and get the data handed over (GDPR articles 15 to 21). Send an e-mail to hello@morgenstudio.no, and we answer you within a month.

If you said yes to statistics, you can withdraw your consent at any time under ‘Change consent’ at the bottom of every page. If you also want us to delete the statistics collected about you at Google, send us your statistics ID. It is under ‘Your choice’ on the cookie page as long as the consent is valid, so note it before you withdraw.

Complaints to the Norwegian Data Protection Authority

If you believe we process your data in breach of the rules, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no). We appreciate it if you contact us first, so we can put it right.

Changes

We update this page when the site or the processing changes. The date at the top shows when it last changed.