Privacy

The short version: this site sets no cookies, runs no tracking or advertising scripts, and loads nothing from other companies' servers. Like most websites, it keeps a log of the pages that are requested, without your IP address, and deletes it after 90 days. If you sign up for the newsletter, your email address is stored by the newsletter service, Kit.

Who is responsible

Geir Kramviken Strøm runs The Norway Guide and is responsible for the personal data described here (the "controller" under the GDPR). For questions or requests, write to geir [at] kramviken [dot] no.

What is logged when you visit

Each time your browser requests a page, image or file, the server records:

• the date and time, and the address of the page or file, including any campaign tags in the link;
• whether the request worked (for example "page not found");
• the referring website, if your browser sends it (usually only its domain, such as google.com);
• your browser's User-Agent, which names the browser and operating system;
• the country and the internet provider's network number, which our hosting provider works out from your IP address when the request arrives;
• technical details such as the protocol, the response size and how long it took.

Your IP address is not stored, and neither are cookies or anything you type into the site search. The site has no accounts or comments. The only form that collects personal data is the newsletter signup: it sends your email address straight to Kit (see below), not to this site's server, so it isn't in these logs.

To protect the site against overload and attacks, a firewall at AWS counts how many requests each IP address makes over five minutes. An address that sends far more than any reader would is refused for a while, and an address on AWS's list of known attack sources is refused outright. The firewall keeps the count only for those few minutes and doesn't log the addresses.

Why

To see which pages are useful and in which languages, to find and fix broken links, and to keep the site secure and working. Traffic is counted in totals, such as page views per page, per day and per country. Nobody is followed across visits or across other websites. The legal basis is legitimate interest (GDPR Article 6(1)(f)): running a useful and secure website, which this does with as little data as possible.

How long it is kept

• The logs are deleted automatically after 90 days.
• Temporary copies made while analysing them are deleted within a week.
• The totals worked out from them, which can't identify anyone, may be kept longer.

The newsletter

The newsletter is sent with Kit (Kit, Inc., USA), which stores the subscriber list and sends the emails on my behalf as a data processor, under itsdata processing agreement. When you sign up, Kit stores:

• your email address;
• when you signed up, from which page, and when you confirmed, with technical details of those requests such as your IP address and browser, which show that you asked for the newsletter yourself;
• for each newsletter, whether you opened it and which links in it you clicked. Opens are recorded by a tiny image in the email, which your email program loads when you open it; links go through Kit, which records the click and sends you on. If you turn off images in your email program, opens aren't recorded;
• if you unsubscribe, when you did so.

Why, and the legal basis. To send you the newsletter you asked for, which is based on your consent (GDPR Article 6(1)(a)). You give it by subscribing and then clicking the link in the confirmation email; until you confirm, you get no newsletters. Opens and clicks show which topics are useful to readers, and are part of what you agree to by subscribing. The record of your signup and confirmation is kept to show that you agreed, which is a legitimate interest (Article 6(1)(f)).

Withdrawing consent. Every email has an unsubscribe link, and you can also write togeir [at] kramviken [dot] no. Withdrawing doesn't affect emails sent before. After you unsubscribe, Kit keeps your address marked as unsubscribed, so that you aren't sent newsletters again; if you want it deleted completely, write to me. The same applies to a signup you never confirmed.

How long. As long as you are subscribed, or until you ask me to delete your data.

Where. Kit stores the data in the United States. Kit is certified under the EU-U.S. Data Privacy Framework (Kit's privacy policy), and its data processing agreement includes the European Commission's standard contractual clauses. Your address is never sold or given to advertisers. If a newsletter contains an affiliate offer and you follow it, that company's own privacy policy applies, as for any other link.

Hosting and where the data goes

The site is hosted by Amazon Web Services (AWS), which handles the requests and stores the logs on my behalf. The logs are stored in AWS's Stockholm region in the EU. To make the site fast, each page is sent from the AWS location nearest you, which may be outside the EU/EEA. For any transfer outside the EEA, AWS's service terms include the European Commission's standard contractual clauses, and AWS participates in the EU-U.S. Data Privacy Framework. Nobody else receives the logs.

What is stored on your device

No cookies. If you choose a theme with the buttons next to the site name ("Polar night" or "Midnight sun"), your browser remembers that choice in its local storage, so the next page uses it too. It is stored only when you pick one, is never sent to the server, and you can delete it by clearing the site's data in your browser.

Your rights

You have the right to ask for access to, correction of or deletion of personal data about you, to restrict its use, and to object to it being processed. For the newsletter, you can also get your data in a portable format, and withdraw your consent at any time (see above). Because the logs contain no IP address or name, I usually can't tell which log entries are yours; if you can help identify them, I will act on your request. You can also complain to the Norwegian Data Protection Authority,Datatilsynet.

Links to other websites

When you follow a link to another website, that site's own privacy policy applies. Your browser normally tells it that you came from this site's domain.

Last updated: 5 October 2026.