Privacy policy
How Sigurd Stave Maskin AS processes personal data on stavemaskin.com and when you are a customer of ours, and what rights you have.
Last updated 3 November 2026
In brief
- We process the information you give us in forms, by email and by phone, and the information we need to deliver machines, parts and service.
- The website uses no cookies for statistics, marketing or tracking. The exception is YouTube videos that you start yourself.
- We count visits and page views as aggregate figures per day. The counter stores nothing in your browser and uses no ID.
- We never sell personal data, and we make no automated decisions about you.
- You can object to processing that we carry out on the basis of legitimate interest. If it concerns marketing, we will always stop.
- You can request access, rectification and erasure, and you can lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority).
Who is responsible
Sigurd Stave Maskin AS (org. no. 943 056 307), Jeksleveien 22, 2016 Frogner, is the controller for the personal data we process through stavemaskin.com and in the customer relationship. This means that we decide why and how the data is processed, and that we are responsible under personopplysningsloven (the Norwegian Personal Data Act) and the General Data Protection Regulation (GDPR).
Send any questions about privacy to mail@stavemaskin.com, or call us on 23 26 78 00. We are not required to have a data protection officer, so enquiries come directly to us.
What we process, and why
Below, we set out each situation in which we process personal data: what data is involved, what we use it for, the legal basis under Article 6(1) of the GDPR, and how long we keep it.
You contact us
- Data
- The contact form sends your name, email address and message, and all three are required. If you call or send an email, we also receive what you tell us, usually your phone number and company.
- Purpose
- To reply to your enquiry and follow it up.
- Legal basis
- Legitimate interest (point (f)): to reply to those who contact us. If the enquiry concerns a purchase you are making for yourself: contract, or steps prior to entering into a contract (point (b)).
- Retention
- Deleted in the annual review once two years have passed since the last contact. If the enquiry leads to a contract, it becomes part of the customer relationship.
You request a demo
- Data
- The booking pages for sweeper demos send your name, organisation, email address and phone number, which are required, and anything else you fill in about the location, time, what the machine is to sweep and any message. The request is stored in a database at Cloudflare and sent by email to us and to the product manager for the machine.
- Purpose
- To arrange the demo and follow up the request.
- Legal basis
- Legitimate interest (point (f)): to follow up with those who request a demo. If you request a demo with a view to buying for yourself: steps prior to entering into a contract (point (b)).
- Retention
- Deleted in the annual review once two years have passed since the last contact. If the request leads to a contract, it becomes part of the customer relationship.
You request a quote
- Data
- On the product pages, “Request a quote” opens a small form. When you press “Send request”, your own email program opens with a pre-filled email to the person responsible for the product. What you write is not sent from the website and is not stored there. We only receive what you send yourself, usually your name, email address, phone number and what you need. For used machines, “Request a quote” leads to the used machine form, see below.
- Purpose
- To give you a quote and follow it up.
- Legal basis
- If you request a quote for yourself: steps prior to entering into a contract (point (b)). If you request a quote on behalf of a business: legitimate interest (point (f)), to be able to give a quote to the business you work for.
- Retention
- Deleted in the annual review once two years have passed since the last contact, or kept as part of the customer relationship if it leads to a contract.
You order service or an annual inspection
- Data
- Required: name, email, phone number and what needs to be done. In addition, company, what it concerns, the machine and serial number, where the machine is located and your preferred time, if you fill these in.
- Purpose
- To plan and carry out the job. The order is sent by email and stored in our system, so that the workshop can follow it up.
- Legal basis
- If you order for yourself: contract, or steps prior to entering into a contract (point (b)). If you order on behalf of a business: legitimate interest (point (f)), to be able to deliver to the business you work for.
- Retention
- As part of the customer relationship, see below. If no job results: deleted in the annual review once two years have passed since the last contact.
You order parts
- Data
- Required: name, email, phone number and the parts you need. In addition, company, business area, the machine and serial number, and the delivery address, if you fill these in.
- Purpose
- To give you a price and delivery time, and to send the parts. The order is sent by email and stored in our system, so that our parts sales team can call you.
- Legal basis
- If you order for yourself: contract, or steps prior to entering into a contract (point (b)). If you order on behalf of a business: legitimate interest (point (f)), to be able to deliver to the business you work for.
- Retention
- As part of the customer relationship. If the order does not go ahead: deleted in the annual review once two years have passed since the last contact.
You enquire about a used machine
- Data
- Required: name and email, and for a trade-in, the machine you want to trade in. In addition, company, phone number and your message, if you fill these in. The machine you are enquiring about and the listing it appears in are included automatically. If you ask for a viewing, we receive the time that suits you, and for a trade-in also the operating hours and condition.
- Purpose
- To reply, arrange a viewing, give a trade-in price and, where relevant, sell the machine.
- Legal basis
- If you enquire for yourself: steps prior to entering into a contract (point (b)). If you enquire on behalf of a business: legitimate interest (point (f)), to be able to reply to and sell to the business you work for.
- Retention
- Deleted in the annual review once two years have passed since the last contact, or kept as part of the customer relationship if you buy.
You sign up for the newsletter
- Data
- Your email address, the business areas you have chosen, when you signed up and which page you signed up from.
- Purpose
- To send you news about machines, promotions and events within the business areas you have chosen, and to be able to show when and from which page you signed up.
- Legal basis
- Consent (point (a)), which section 15 of markedsføringsloven (the Norwegian Marketing Control Act) requires for marketing by email.
- Retention
- Until you unsubscribe. Send an email to mail@stavemaskin.com and we will delete your sign-up for the business areas you specify.
You are a customer of ours
- Data
- Contact and invoicing details, quotes, orders, deliveries, the service history of the machines and our correspondence with you.
- Purpose
- To deliver what has been agreed, follow up warranty claims and complaints, keep track of the machines we have delivered and serviced, keep accounts, and send you offers of goods and services similar to those you have bought.
- Legal basis
- Contract (point (b)) when the contract is with you. If the customer is a business, we process the information about you as a contact person on the basis of legitimate interest (point (f)). Legal obligation (point (c)) under bokføringsloven (the Norwegian Bookkeeping Act). Legitimate interest (point (f)) to follow up the customer relationship and for marketing to customers.
- Retention
- For as long as the customer relationship lasts, and thereafter for up to five years after the last delivery, because consumers can complain about defects for up to five years. If a complaint or dispute is ongoing, we keep the information until the matter is closed. Accounting records are kept as required by section 13 of the Bookkeeping Act, see how long we store data.
You are a contact person at a customer or supplier
- Data
- Name, job title, employer, and work phone number and email address.
- Purpose
- To be in contact with the business you work for.
- Legal basis
- Legitimate interest (point (f)): to be able to work with the business.
- Retention
- As long as you are the contact person, or until you or the business asks us to delete the information.
You visit the website
- Data
- IP address, browser, time and which page you request. This ends up in the technical logs of the hosting providers, as it does on all websites.
- Purpose
- To provide the website, protect it against attacks and find errors.
- Legal basis
- Legitimate interest (point (f)): a secure website that works.
- Retention
- We do not use the logs to find out who you are. Supabase deletes its logs after seven days at most. Cloudflare deletes its logs according to its own rules, and we do not have access to them.
Counting visits
- Data
- For each page that is opened, the counter sends the address of the page. On the first page of a visit, it also sends the domain name of the website your browser says you came from (for example google.com), or the fact that you came directly. To keep bots out, it checks the name of the browser, but this is not sent. The counter uses no ID, and the database only adds one to the count for the day.
- Purpose
- To see how many people use the website, which pages are read, and where the visits come from.
- Legal basis
- Legitimate interest (point (f)): to see how the website is used. The database provider sees the IP address in its logs, as it does with all requests.
- Retention
- The aggregate figures are stored without a time limit, because they say nothing about individuals. The IP address in the logs is deleted as described above.
You log in
- Data
- Your email address and when you log in. Applies to staff, and to customers we have given access.
- Purpose
- To give access only to those who should have it, and to keep the login secure.
- Legal basis
- For customers: contract (point (b)). For staff: legitimate interest (point (f)), to ensure that only those who should have access get in.
- Retention
- As long as the access lasts. The login is deleted when it should no longer apply.
Where the legal basis is legitimate interest, we have assessed that our interest in replying to enquiries, delivering to customers, running a secure website and understanding how it is used outweighs the disadvantage to you. We do not process more than the purpose requires, and you can object, see the right to object.
We only send marketing by email if you have agreed to it, for example by signing up for the newsletter, or if you are a customer of ours and it concerns goods and services similar to those you have bought. You can opt out, easily and free of charge, when we receive your email address and in every email we send. This follows from section 15 of the Marketing Control Act.
Do you have to give us information?
No, it is your choice. But without contact details we cannot reply to you, and without a phone number we do not accept service and parts orders, because we call to agree on price and delivery. If you are a customer, we need the information that the Bookkeeping Act requires on the invoice.
Where the information comes from
The information usually comes from you. Sometimes it comes from the business you work for, for example when a municipality or contractor names you as the contact person.
Who receives the information
We do not sell personal data, and we do not share it with others for their own marketing. The information is used by the employees who need it in their work.
Suppliers that process data for us
These suppliers process data on our behalf (processors). The column on the right shows what a transfer out of the EU/EEA is based on.
| Supplier | What they do for us | Where | Transfer |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting, security, caching and storage of demo requests | Global network. US company | EU–U.S. Data Privacy Framework |
| Supabase, Inc. | Database and login: the website content, the service and parts orders, the newsletter sign-ups, the visit counter, the My account customer portal and the administration | The database is located in Frankfurt (EU). US company | Standard data protection clauses in the data processing agreement |
| Microsoft (Microsoft 365) | Email, where enquiries come in and are answered | Microsoft's data centres. US company | EU–U.S. Data Privacy Framework |
| FormSubmit (Devro LABS) | Forwards what you send in the contact, service, parts, used machine and demo forms to our email. According to their terms, the information is only used to provide the service | Does not state where the data is processed | No transfer agreement, see below |
Others who may receive information
- Our financial system: The supplier of the system we use for orders, invoicing and accounting processes customer data for us.
- Carriers receive your name, address and phone number when we send parts or equipment to you.
- The manufacturers of the machines may receive information about the machine and the contact person when this is needed to obtain parts or handle warranty claims and complaints.
- Finance companies, for example Brage Finans, when you ask for financing or leasing.
- Our auditor has access to the accounting records when the accounts are audited.
- YouTube (Google): If you click on a video, the player is loaded from Google. Google then receives your IP address, and YouTube may store information in your browser, including for its own purposes. We and Google are jointly responsible for collecting the information and sending it to Google. What Google does after that is Google's responsibility.
- Public authorities, when we are legally obliged to do so, for example in the investigation of criminal offences.
Transfers outside the EU/EEA
Several of the suppliers are US companies, and information may be processed in the USA or other countries outside the EU/EEA. The table above shows what each transfer is based on: the EU–U.S. Data Privacy Framework, under which Cloudflare, Microsoft and Google are certified, or the European Commission's standard data protection clauses. You can get a copy of the standard clauses by sending us an email.
FormSubmit does not state where it processes the information, and we have no agreement with it on the transfer. If you do not want what you write to go through FormSubmit, you can call us or send an email directly to mail@stavemaskin.com.
Most of the manufacturers we work with are based in Europe. If a manufacturer outside the EU/EEA receives information, it is only what is needed to obtain parts or handle the warranty, and with a valid basis for the transfer.
How long we store data
We do not keep personal data for longer than the purpose requires, or longer than the law obliges us to. The retention period for each processing activity is set out above. In summary:
- Enquiries and requests that do not lead to anything: we review them once a year and delete anything older than two years. They may therefore be kept for up to three years.
- Customer relationships: as long as they last, and for up to five years after the last delivery. If a complaint or dispute is ongoing, until the matter is closed.
- Accounting records: invoices, vouchers and other accounting records for five years after the end of the financial year. Contracts and correspondence relating to the accounts, for three years and six months (section 13 of the Bookkeeping Act).
- The newsletter: until you unsubscribe.
Your rights
You have the right to
- access the information we hold about you, what we use it for and who has received it, and obtain a copy (Article 15)
- have incorrect or incomplete information rectified (Article 16)
- have information erased that we no longer need, or that we only hold because you consented, unless the law requires us to keep it or we need it in a dispute (Article 17)
- have the processing restricted, for example while we check whether the information is correct (Article 18)
- receive the information you have given us, in a commonly used machine-readable format, when we use it because you have consented or have a contract with us (data portability, Article 20)
- withdraw your consent by letting us know, for example to unsubscribe from the newsletter. What we did before you withdrew your consent nevertheless remains lawful (Article 7)
Send an email to mail@stavemaskin.com, or call 23 26 78 00. We will reply without undue delay and within one month at the latest. If the matter is complex, the deadline may be extended by up to two months, in which case you will be notified, with the reasons, within the first month. There is no charge, unless the request is manifestly unfounded or excessive. We may ask you to confirm your identity, so that the information does not end up with the wrong person.
If you believe that we are processing personal data in breach of the rules, you can lodge a complaint with Datatilsynet (datatilsynet.no). Feel free to contact us first, so that we can put it right.
The right to object
If we process information about you on the basis of legitimate interest, you can object at any time (Article 21). We will then stop, unless we have compelling grounds for continuing that override your interests, or we need the information in a legal dispute. If it concerns marketing, we will always stop. Send an email to mail@stavemaskin.com.
Cookies
The website uses no cookies for statistics, marketing or tracking, and therefore does not ask for consent. It only stores what is needed for features you choose to use yourself, such as comparing machines. YouTube videos that you start yourself may store cookies from Google. Everything is set out on the cookies page.
Social media and FINN
We have pages on Facebook, Instagram, LinkedIn and YouTube, and we advertise used machines on FINN. The links to them from the website are ordinary links: nothing is loaded from these services until you click.
When you visit our pages there, the service's own privacy rules apply. For the statistics on our Facebook page, we are joint controllers with Meta Platforms Ireland Ltd., and for the LinkedIn page with LinkedIn Ireland Unlimited Company. The legal basis is legitimate interest (point (f)): to see how the pages are used. We only see aggregate figures, not who you are. Meta and LinkedIn respond to requests for access and erasure relating to these statistics. Read the agreements at Meta and LinkedIn.
If you send us a message there, or contact us through FINN, we treat it like any other enquiry.
Safety
We have technical and organisational measures in place to protect the information:
- All traffic to and from the website is encrypted (HTTPS).
- The website has a Content Security Policy that determines where scripts can be loaded from, and which services scripts and forms can send information to.
- The fonts are hosted on our own server, so the website does not fetch them from Google.
- The database has access rules that prevent anyone who is not logged in from reading what is submitted in the forms and sign-ups. Only the content shown on the website, such as the staff list, can be read by anyone. The forms cannot be used to read what others have submitted.
- The administration requires a personal login, and each user only has access to the parts they need for their work. Logins are not shared, and access is removed when it is no longer needed.
Should a personal data breach occur, we will handle it in accordance with the GDPR: we will notify Datatilsynet within 72 hours where required, and notify you if the breach may result in a high risk to you.
Automated decisions
We make no decisions about you based solely on automated processing, and we do not create profiles of you.
Children
The website is designed for businesses and adults, and is not aimed at children. If we receive information about children that we should not have, we delete it.
Changes
We update this policy when the website or the processing changes. The date at the top shows when it was last changed, and the list below shows what has changed. In the event of significant changes, we will give clear notice on the website.
- 3 November 2026Requests for sweeper demos.
- 27 October 2026New version: retention period and legal basis for each processing activity, the right to object, what each transfer out of the EU/EEA is based on, recipients when you are a customer, social media and FINN, and what happens if you do not give us information. The fonts are no longer loaded from Google.
- 5 October 2026The visit counter on the website.
- 17 September 2026Service and parts orders are stored in our system.
- 16 September 2026The newsletter.
- 15 September 2026First version for the new website.
Phone 23 26 78 00 · mail@stavemaskin.com
See also: Cookies · Terms of use
Need help choosing the right machine?
Get in touch for advice, prices and availability — we respond quickly.