Privacy policy
Last updated 20 October 2026
This is a draft awaiting review.
It has been written to the structure Datatilsynet expects and adapted to this business, but it has not been checked by a lawyer and it contains bracketed values that still need confirming. It should not be relied on until both are done.
This explains what happens to personal data when you visit this site, get in touch, or become a client. It is written to be read rather than to cover anyone in legal cotton wool, so if something here is unclear, ask and it will be fixed.
Who is responsible
Grow Snowball, org.nr 934 144 619, Stord, Norway, is the data controller for the processing described below. Lars Aadland is the person who handles it, and there is nobody else to be passed on to.
Email lars@growsnowball.com or call 477 13 919.
Two different roles
This matters more here than in most privacy policies, because this business does two quite different things with personal data.
- As controller
- For data about you — a visitor, an enquiry, a prospect, or a client contact. Grow Snowball decides why and how that is handled, and this policy covers it.
- As processor, and sometimes joint controller
- For data about your customers, inside your systems (for example your website, order system and email platform) and your ad accounts. When work is carried out on your instructions, Grow Snowball is a processor and your own privacy policy governs that data. Where targeting, audiences or optimisation decisions are made, the roles can become joint. Either way it is set out in the written data processing agreement signed before any access is granted, as GDPR article 28 requires.
In short: this policy covers data about you. Data about your customers is governed by your own policy and our agreement.
What this website collects
Very little, and this has been measured rather than assumed. The site sets no cookies, runs no advertising or tracking scripts, and makes no requests to third parties. Fonts and images are served from this domain, so simply reading these pages does not tell anyone else that you were here.
One item is stored in your browser: a session key named gs-intro, set to 1. It exists only so the opening animation does not replay on every page you open, contains nothing about you, is never sent anywhere, and is discarded when you close the tab.
Your web host keeps ordinary server logs, which include IP addresses and request times. Those are a security and reliability necessity rather than analytics.
[If and when analytics are added, name the tool here, say whether it is cookieless, and if it is not, a consent banner becomes a legal requirement rather than an option.]
When you get in touch
- Email or phone
- Your address or number and the contents of the conversation. When you ask for a review the legal basis is steps taken at your request before entering a contract, GDPR article 6(1)(b). Otherwise it is legitimate interest in answering people who contact a business, article 6(1)(f).
- Becoming a client
- Contact details, billing details and the correspondence that goes with running the work. Legal basis: performance of the contract, article 6(1)(b), and legal obligation for anything the Norwegian Bookkeeping Act requires to be retained, article 6(1)(c).
No newsletter is sent, no profile is built, and nothing here is used for automated decision-making.
How long it is kept
- Enquiries that go nowhere
- [Suggested: deleted after 12 months. Confirm what you actually want.]
- Client records
- For the duration of the engagement and [suggested: 12 months] after it ends, so questions can still be answered.
- Accounting records
- Five years after the end of the financial year, as the Norwegian Bookkeeping Act requires. This one is not discretionary.
- Access to your systems
- Revoked when the engagement ends. Ad accounts, flows, pages and content stay in your name throughout.
Who else handles it
Nothing is sold, and nothing is shared for anyone else's marketing. These suppliers process data in order to provide their service, under written agreements.
| Supplier | What they see | Why | Where |
|---|---|---|---|
| [Email provider — e.g. Google Workspace, Fastmail] | Your email address and the contents of your message | So correspondence can be sent and received | [Confirm] |
| [Analytics, once installed — see note below] | [Confirm: aggregated page views, referrer, approximate region] | To see which pages are read | [Confirm] |
| [Hosting — Vercel, if you deploy there] | IP address and request metadata, in server logs | To serve the site and keep it secure | [Confirm region] |
[Confirm every row before publishing, and add any tool that touches personal data. If a supplier processes data outside the EEA, the transfer basis — usually Standard Contractual Clauses — has to be named here.]
Your rights
You can exercise any of these by sending an email. There is no form and no process. You will get an answer within 30 days, and it will not cost you anything.
- Access — a copy of the personal data held about you
- Rectification — correction of anything inaccurate
- Erasure — deletion, where there is no lasting reason to keep it
- Restriction — a pause on processing while something is disputed
- Objection — to processing based on legitimate interest
- Portability — your data in a machine-readable form
- Withdrawal of consent — at any time, where consent was the basis
If you are unhappy
Tell me first — it is one person, and most things are a misunderstanding that takes a day to fix. If that does not resolve it, you have the right to complain to Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no.
Changes
If this policy changes in a way that affects you, the date at the top changes with it. Current version: 20 October 2026.