Privacy notice

1. Data controller

Systemax is the data controller for the personal data processed through this service. Questions can be sent to post@systemax.no.

2. What we collect

• Account: email address, name and an encrypted password.
• Order: order history, payment status and the receipt. The delivery address, phone number and any pickup point are entered with the payment provider, copied onto the order only so it can be shipped, and erased from it once delivered — see section 5. Your account holds no delivery address.
• Photos and designs: the photos you upload of your tools, the outlines derived from them, any logos, and the layouts you save.
• Enquiries and our notes: if you contact us through the enquiry form, we keep what you wrote along with the name, email address, phone number and any address you gave us. We also keep short internal notes and reminders from dealing with you — what was discussed, what was agreed, what we owe you next — and, for a job we are quoting for, what it covers, roughly what it is worth, and, if you accept a quote, the name you gave when you did. These are working notes about the job, not judgements about you, and you can ask to see them: see section 6.
• Technical: a sign-in cookie, and basic operational logs.

We never store card numbers. Payment is handled entirely by the payment provider.

3. Why, and on what basis

• To produce and deliver your order, and to run your account — the basis is performance of the contract with you.
• To keep accounting records — the basis is a legal obligation under the Norwegian Bookkeeping Act (bokføringsloven).
• To answer your enquiry and keep track of what we agreed — the basis is steps taken at your request before a contract, and thereafter performance of the contract.
• To protect the service against abuse — the basis is legitimate interest.

Your photos are used to make your product. They are not used for marketing, and they are not shared with other customers.

4. Who we share with

• The payment provider (Stripe or Vipps), which processes the payment and collects your name, delivery address and phone number on our behalf.
• The carrier, which receives name, address and phone number in order to deliver the parcel.
• Fiken AS, our accounting system, which receives each sales document (the receipt naming you as the buyer) because the Bookkeeping Act requires it to be kept in the accounts.
• The email provider Resend (Plus Five Five, Inc.), which delivers order confirmations, receipts and account messages. Resend stores information about each email, such as the recipient address, in the United States; the transfer relies on the EU–US Data Privacy Framework and the EU standard contractual clauses in Resend's data processing agreement.
• Hosting and storage providers, which run the website, the database, file storage and photo processing on our behalf: Vercel Inc. (the website), Databricks, Inc. through its Neon service (the database), Cloudflare, Inc. (storage of photos and designs), Railway Corporation (processing of tool photos) and Upstash, Inc. (protection against abuse, which sees your IP address). The website runs on servers in Frankfurt, but all of these companies are American and may process the data in the United States; the transfer relies on the EU–US Data Privacy Framework, which they are certified under.
• Anthropic Ireland, Limited, which runs the Claude AI model on our behalf. When you or our staff ask for it, a photo of your tool layout is sent to Claude together with drawings of your tools' outlines, so it can read where each tool lies and set up the design. When our staff import tool photos, each photo is also sent to Claude so it can point out problems that call for a retake, such as a cut-off sheet or a tool still in its packaging. Nothing else is sent with them: no name, account or location data, and the photo's embedded metadata (such as GPS position) is removed first. Anthropic may process the pictures outside the EU/EEA, including in the United States; the transfer relies on the EU standard contractual clauses in Anthropic's data processing agreement. Anthropic may not use them to train its models, and deletes them within 30 days, unless it must keep them longer by law or to enforce its usage policy.

We do not sell personal data.

5. How long we keep it

Your account, with its photos and layouts, is kept for as long as the account is active — you can delete individual photos and layouts yourself at any time. The delivery address, phone number, pickup point and addressee name on an order are erased once the order is completed, or 30 days after it shipped. The sales document (receipt) for each order, which names you as the buyer, is kept for five years, as the Bookkeeping Act requires, even if you delete your account; so is the credit note for any refund. Nothing else about an order identifies you after that erasure. An enquiry that never led to an order is deleted 12 months after we received it, together with any notes and reminders attached to it, unless it is linked to your account or we are still working on it.

6. Your rights

You have the right to access your own data, to have errors corrected, to erasure, to restriction, to data portability, and to object to processing based on legitimate interest. Contact us at post@systemax.no — we normally reply within 30 days.

If you believe we are processing your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

7. Cookies

We use only the cookies necessary for sign-in and the cart to work. We do not use cookies for tracking or marketing, which is why we do not ask you to consent to any.