Privacy Policy
How Coppervm collects, uses and protects your personal data — and the rights you have over it.
Last updated: 12 July 2026
Data controller
MYST AS, the Norwegian company operating the Coppervm shop, is the data controller for the personal data processed through this shop. If you have a privacy question, or wish to exercise your rights, contact us at:
post@coppervm.no · Hamar, Norway
What we process — and why
We collect only what we need to deliver your order, meet our legal obligations and run the shop securely.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Order and customer data (name, email, delivery address, phone) | Completing your purchase, shipping, customer service and warranty claims | Contract — GDPR Art. 6 (1)(b) | Accounting records are kept for 5 years after the end of the financial year (Norwegian Bookkeeping Act) |
| Payment data (handled in Stripe — we never receive your card number) | Taking payment and preventing fraud | Contract — Art. 6 (1)(b), and legal obligation — Art. 6 (1)(c) | Transaction data per our bookkeeping obligation; card data is held by Stripe, not by us |
| Newsletter (email address) | Sending the news and offers you asked for | Consent — Art. 6 (1)(a) | Until you unsubscribe; opting out is always one click away |
| Enquiries (contact form and email) | Answering your question and following up | Legitimate interest — Art. 6 (1)(f) | As long as needed to handle the enquiry, normally up to 2 years |
| Technical and usage data (IP address, device, browser, page usage) | Secure operation, troubleshooting and improving the shop | Legitimate interest — Art. 6 (1)(f). Analytics and marketing cookies are only set with your consent — Art. 6 (1)(a) | Per the retention settings in our analytics tool |
| Serial number used for authenticity checks | Verifying that a bar is genuine and issued by us | Legitimate interest — Art. 6 (1)(f) | For as long as the bar is listed in the certificate registry |
Who we share data with
We never sell personal data. We use selected processors who handle data on our behalf under a data processing agreement: Stripe (payments and checkout), Resend (order confirmations and newsletter), Google Analytics (usage statistics) and Vercel (hosting). Your delivery address is also shared with the carrier that ships your order. We may disclose data where we are legally required to do so.
Transfers outside the EEA
Some of our providers are established outside the EEA, or may process data there. Such transfers rely on a valid transfer mechanism under Chapter V of the GDPR — typically the European Commission’s Standard Contractual Clauses (SCCs), or an adequacy decision — together with any supplementary measures required.
Security
All traffic to the shop is encrypted (HTTPS/TLS). Payment takes place in Stripe’s own payment window, so card details never pass through our servers. Access to customer data is limited to those who need it to do their job, and we review our safeguards on an ongoing basis.
Cookies
The shop uses cookies to make the cart, checkout, language and currency work, and — where you have consented — for analytics and marketing. You can change or withdraw your consent at any time.
Children
The shop is not directed at children, and we do not knowingly collect personal data from children. If you are under 18, please shop together with a parent or guardian.
Changes to this policy
We may update this policy when the service or the law changes. The current version always lives on this page, with the date of the last update at the top.
Your rights
Under the GDPR you have a number of rights. Get in touch and we will normally respond within 30 days — free of charge.
- Access to the data we hold about you
- Rectification of data that is wrong or incomplete
- Erasure of data we no longer have grounds to keep
- Restriction of processing
- Data portability — receiving your data in a machine-readable format
- Objection to processing based on legitimate interest
- Withdrawing consent at any time, without affecting the lawfulness of processing before withdrawal
Complaints to the supervisory authority
If you believe we process your personal data unlawfully, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We would appreciate the chance to put things right first.
Privacy questions
Write to us and we will help you.