Privacy Policy

Last updated: November 5th, 2026

1.        About this Policy

Krik Krak respects your privacy and is committed to protecting your personal information and handling it responsibly. This Privacy Policy explains what information we collect, where it comes from, why we use it, who may receive it, how long it is kept, and the rights you have under the General Data Protection Regulation (GDPR) and Norwegian data protection law.

It applies when you visit our website, purchase or attend a Krik Krak event, contact us, take part in a feedback survey, or appear in photographs or recordings made at our events.

2.        Who is responsible for your personal information?

The data controller is Rhonda Vespestad Krik Krak (Organisation number 938 178 054), also operating as Krik Krak. This means we are responsible for determining why and how personal information is processed in connection with our activities.

For questions about this Privacy Policy, or to exercise your privacy rights, please contact us at info@krikkrak.no.

3.        What information do we collect, and how?

The information we collect depends on how you interact with Krik Krak. We seek to limit our collection to information that is necessary for the purposes described in this policy.

3.1   Ticket purchases and attendance

When you purchase a ticket or attend an event, we may receive your name, email address, details of the event and ticket purchased, and information needed to confirm your booking or admission. We may receive this information directly from you or through the booking or payment service used for the purchase.  

3.2   Payments and invoicing

Payments may be made through external payment service providers or, where available, by invoice. For payments processed through external payment service providers, we may receive payment confirmations, transaction references and other information needed to administer the purchase. We do not receive or store full payment card details ourselves.

Where payment is made by invoice, we may collect and process the customer's name or business name, invoicing address, relevant contact details, organisation number (where applicable), and information about the purchase, invoice and payment status.

3.3   Enquiries and feedback

If you contact us, we process the contact information and the contents of your enquiry. If you choose to answer a feedback survey, we process the answers you submit, which may include personal information if you identify yourself or provide identifying details.

3.4   Photographs and recordings

Photographs or recordings made at our events may include images or voices of identifiable attendees. The information processed depends on the content of the photograph or recording and how it is used.

3.5   Website visits and cookies

When you visit our website, we and our website hosting provider collect technical information, including your IP address, browser, network and device information, pages visited and timestamps. With your consent, analytics and performance cookies and similar technologies may also collect information about your activity on the website, including clicks, searches and pages visited. Further details about the cookies and similar technologies used, including their providers, purposes, and durations, are available in https://support.squarespace.com/hc/en-us/articles/360001264507-The-cookies-Squarespace-uses.  

4.        Why do we use your information?

4.1   Ticket purchases and event administration

We use the information needed to complete ticket purchases, confirm bookings, manage admission and deliver our events. The processing is necessary to perform the contract with you and is based on GDPR Article 6(1)(b).

4.2   Event notices and reminders

We may use your email address to notify you of cancellations, changes to an event or other information necessary for your attendance. Such notices are part of administering your booking and are based on GDPR Article 6(1)(b).

We may also send a reminder on the day of the event. Our legal basis for this is our legitimate interest in providing timely, useful event information under GDPR Article 6(1)(f).

4.3   Post-event feedback

We may send one short, voluntary survey after an event to understand participants’ experiences and improve future events. This is based on our legitimate interest in improving our services under GDPR Article 6(1)(f). You may object to receiving these optional surveys by contacting us.

We do not use event email addresses to send newsletters or promotional emails about future events.

4.4   Customer enquiries

We use the information you give us to respond to questions and manage correspondence. If the enquiry concerns a contract or steps you ask us to take before entering into a contract, the legal basis is GDPR Article 6(1)(b). For other enquiries, our legal basis is our legitimate interest in handling communications under Article 6(1)(f).

4.5   Photography and recordings at events

We may photograph or record events to document our activities and, where appropriate, to promote Krik Krak. Where individuals are identifiable, this involves processing personal information.

We will generally obtain consent before publishing photographs or recordings in which an identifiable attendee is a main subject, especially for promotional purposes. For proportionate images documenting the overall event or atmosphere, we may rely on our legitimate interests under GDPR Article 6(1)(f), provided the use is permitted under applicable law, including the rules on the right to one’s own image.

We will provide appropriate information where photography or recording is planned. If we rely on your consent, you can withdraw it at any time by contacting us. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

4.6   Website operation and analytics

We use technical information to display and operate the website and maintain its security. Our legal basis is our legitimate interest in operating a functional and secure website under GDPR Article 6(1)(f). Cookies and similar technologies strictly necessary to provide a service you request may be used without consent.

With your consent, we also use analytics and performance technologies to understand website traffic and activity and improve the website. Our legal basis for processing personal information for these purposes is consent under GDPR Article 6(1)(a). These technologies are activated only after you consent. You can accept, decline or manage non-essential cookies through the cookie banner and withdraw consent at any time through “Cookie preferences” on the website.

4.7   Legal and accounting obligations

Where payment is made by invoice, we process the information necessary to issue and administer invoices and payments. Where this processing is necessary to perform a contract with an individual, the legal basis is GDPR Article 6(1)(b). Where we process contact information relating to business customers, the legal basis is our legitimate interest in administering our business relationships and payments, under Article 6(1)(f).

We also process and retain relevant payment and transaction information to comply with Norwegian bookkeeping requirements, including bokføringsloven and bokføringsforskriften, and other applicable legal obligations. The legal basis for this is GDPR Article 6(1)(c).

5.        Sharing information with others

We do not sell customer information or share event mailing lists with third parties for their marketing purposes.

To operate our business, we use external providers for payment processing, email communications, website hosting, data storage, accounting, invoicing, and, where applicable, customer surveys. These providers may receive or process the personal information needed to provide their respective services. Some act as processors on our behalf, others, including certain payment service providers, may process information as independent controllers.

If we publish event photographs or recordings on our website or social-media channels, those materials may also become available to the relevant hosting or social-media services and to members of the public. We only disclose personal information where there is a lawful basis to do so.

5.1   Transfers outside the EEA

Some of our service providers, including Squarespace (website hosting provider) and Stripe (payment provider), may process personal information outside the European Economic Area (EEA). Where this occurs, we ensure that the transfer complies with applicable data protection law, relying on a European Commission adequacy decision or appropriate safeguards, such as the European Commision’s Standard Contractual Clauses, supplemented by additional measures where necessary.

You can contact us at info@krikkrak.no for further information about these transfers and to obtain a copy of the applicable transfer safeguards.

6.        How long do we keep your information?

We keep personal information for no longer than necessary for the purpose for which it was collected, unless a longer period is required or permitted by law. In particular:

·      Event mailing lists: Email addresses used for event communications are removed from our event mailing lists when no longer needed, and no later than 30 days after the event.

·      Booking and admission records: Personal information used to manage bookings and confirm attendance is deleted or anonymised once the event has taken place and any outstanding booking, payment or refund matters have been resolved, unless retention is required for accounting purposes or otherwise justified as described below.

·      Feedback surveys: Identifiable survey responses are deleted or anonymised when the feedback has been evaluated, and no later than three months after collection.

·      Customer enquiries: Enquiries and related correspondence are deleted when no longer needed, normally within six months after the enquiry has been resolved.

·      Photographs and recordings: Unpublished photographs and recordings are deleted when no longer needed, normally within two years after the relevant event. Photographs and recordings published on our website or social media channels may be retained for as long as they remain relevant to documenting our activities or promoting our events. We periodically review published material and remove it when it no longer serves these purposes, or earlier where required by applicable law.

·      Accounting information: Payment and transaction documentation subject to Norwegian bookkeeping requirements is generally retained for five years after the end of the relevant financial year. Payment providers may retain transaction information separately under their own legal obligations and retention policies. Removing an address from our event mailing list does not necessarily delete the associated payment records.

Specific information may be kept for longer if necessary to comply with a legal obligation or to establish, exercise or defend a legal claim. This does not mean that event mailing lists are routinely kept for such purposes.

7.        How do we protect your information?

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, alteration and disclosure. Access is limited to people who need it for the relevant business purpose. Where external providers process information on our behalf, appropriate contractual and security requirements apply.

8.        Your rights

Subject to the conditions and exceptions in the GDPR, you have the following rights:

·      Access: You may ask whether we process personal information about you and request access to that information.

·      Correction: You may ask us to correct inaccurate information or complete information that is incomplete.

·      Deletion: You may ask us to delete your information when the legal conditions are met. We may need to retain certain records to comply with the law.

·      Restriction: You may ask us to restrict processing in circumstances specified by the GDPR.

·      Data portability: In applicable circumstances, you may receive information you provided to us in a structured, commonly used, machine-readable format and transmit it to another controller. This applies to relevant automated processing based on consent or contract.

·      Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of earlier processing.

8.1   Your right to object

You may object, on grounds relating to your particular situation, to processing based on our legitimate interests, including optional event reminders, feedback surveys and certain event photography, we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

9.        Contact, complaints and providing information

You can exercise your rights or ask questions by emailing info@krikkrak.no. We will respond in accordance with the GDPR, normally within one month. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no.

Some personal information is needed to complete a ticket purchase or administer attendance. Without it, we may be unable to complete your booking or communicate important event information. Participation in feedback surveys is voluntary.

10.  Changes to this Privacy Policy

We may update this policy if our services, use of personal information or applicable legal requirements change. The current version will be available on our website, with its latest update date. If we intend to process information for a new purpose requiring additional notice, we will provide that information as required by law before doing so.