Privacy

Data controller

AVREN is the trading name of IVANOV CATERING, org. no. 936 182 402 MVA, Asperholen 125, 4329 Sandnes, Norway, and is the data controller for personal data collected through this website. Privacy questions can be sent to info@avren.no.

What data we collect

When you order — in the configurator, directly from the menu, or in the online shop — we record your name, email address and phone number. For delivery, we also record the delivery address (street, postal code, city and municipality); for pickup, we instead record which pickup location you choose. If you create an account on "My Page", we also store which login method you use (email, Google or Facebook) and your order history, so you can see past orders and download receipts.

Payment data

Payment is processed via Vipps or Stripe. Your card number or Vipps credentials never pass through AVREN's systems and are not stored by us — we only receive confirmation that payment was completed, plus the name/email/phone the payment provider forwards to us so we can deliver the order. Vipps and Stripe handle your data under their own privacy terms, which are outside AVREN's control.

Cookies and consent

The consent choice in the cookie banner is real and stored in your browser (in local storage), not as a traditional cookie. See the "Cookies" section below for a full overview of what is actually set today.

Your account and deleting your data

From "My Page" you can delete your account at any time. On deletion, we immediately remove the email address, phone number, saved delivery addresses and name from your account — you will then no longer be able to log in with your old details. This action cannot be undone. You'll receive an email confirmation once deletion is complete.

Email log for abuse prevention

Every time we send you a sign-in or receipt link by email (a magic link for "My Page", or a link to your order confirmation), we record the email address, IP address, purpose and timestamp in a separate log. This log is used exclusively to enforce a technical limit of at most one email per 60 seconds to the same address/IP for the same purpose, so the system can't be misused to send email to an arbitrary address. If you delete your account, the log rows tied to your email address are removed at the same time (see below). Beyond that, this log currently has no automatic deletion schedule of its own — it isn't linked to your order history and contains no order details.

How long we keep your data

Norwegian accounting law requires us to keep accounting records for completed orders — receipts, order details and amounts — for at least 5 years. When you delete your account, we immediately remove the name, email address, phone number and delivery address from the associated orders, and at the same time break the technical link between those orders and your account (the account link and the receipt access link stop working, and the stored payment reference is removed). What remains in our systems is the order date, amount and line items — with no remaining technical link to you as a person left in our database. This remaining order data is deleted automatically and permanently once the five-year period under the accounting act ends. We cannot guarantee that data already shared with third parties such as Vipps or Stripe to process payment is removed the same way on their end — that is governed by their own routines, not AVREN's — and naturally, an order confirmation you have already received in your own email inbox is not affected by the deletion.

Legal basis for processing

We process your personal data on different legal bases under the GDPR Art. 6, depending on the category of data involved:

— Contact details and delivery/pickup choice when ordering (name, email, phone, address or pickup location): processed to fulfil the contract with you, under Art. 6(1)(b) — we need this information to carry out and deliver the purchase you requested. — Order history stored on "My Page": processed to deliver the account service you have chosen to create, under Art. 6(1)(b) — the account is something you actively set up, and you can close it at any time (see above). — Accounting records kept for 5 years (order date, amount, line items): processed to comply with a legal obligation, under Art. 6(1)(c), together with Norwegian accounting law. — The email log that prevents misuse of sign-in/receipt links: processed on the basis of our legitimate interest in protecting the service from abuse, under Art. 6(1)(f) — an interest we consider does not override your rights, since the log is minimal (email, IP, purpose, timestamp) and is not used for any other purpose.

Your rights

You normally have the right to access, correct and delete your personal data, as well as the right to object to or restrict certain kinds of processing. We do not yet have a technical solution for automatic export of your own data — if you want access to, or a copy of, the data we hold about you, contact info@avren.no and we'll handle it manually. You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) if you believe we are processing your data unlawfully.

Cookies

The consent choice (banner at the bottom of the screen) is real and stored in this browser (in local storage, not as a traditional cookie). The site itself only sets technical cookies (language choice, configurator draft). The site also uses Vercel Analytics for anonymous visit statistics — a first-party script loaded from our own domain which, according to the vendor's documentation and our own review of its code, does not set cookies or store anything in your browser. This page will be updated with a full list of name/purpose/duration per cookie if additional analytics or marketing tools are introduced.