Privacy Policy

This Privacy Policy explains how Rokter AS processes personal data in connection with AWEBO.

It applies when you:

• visit awebo.no;
• place an order;
• contact us;
• receive an AWEBO as a gift;
• use a private AWEBO owner page;
• upload photographs or stories;
• submit content for public display; or
• otherwise interact with AWEBO.

The data controller is:

Rokter AS
Organisation number: 934 839 005
Narvik, Norway
Email: awebo@awebo.no

Rokter AS operates the AWEBO brand.

In this policy, “AWEBO”, “we”, “us” and “our” refer to Rokter AS.

We aim to:

• collect only information we need;
• explain why we use it;
• protect private owner content;
• keep public publication optional;
• limit access to authorised people and providers;
• retain information only as long as necessary; and
• respect your privacy rights.

We do not sell personal data to advertisers.

The information we collect depends on how you interact with AWEBO.

3.1 Customer and order information

We may collect:

• full name;
• billing address;
• delivery address;
• email address;
• telephone number;
• country;
• order number;
• purchased product;
• selected AWEBO number;
• personalisation details;
• gift-recipient information;
• price and currency;
• payment status;
• shipping and tracking information;
• customs-related information;
• order correspondence; and
• complaint, return, replacement or refund information.

3.2 Payment information

Payments are handled by external payment providers.

We normally receive limited transaction information such as:

• payment status;
• transaction reference;
• amount;
• currency;
• payment method;
• refund status; and
• fraud or dispute status.

We do not normally receive or store complete payment-card details.

3.3 Private AWEBO owner-page information

We may process:

• the AWEBO number;
• owner or recipient name;
• email address;
• private page identifier;
• access-link information;
• production status;
• personalisation choices;
• product photographs;
• uploaded photographs;
• uploaded stories;
• country or general location;
• gallery-submission choices;
• publication permissions;
• publication and moderation status;
• communications connected to the page; and
• security and access logs.

When you register an AWEBO Card or transfer one to another collector, we process the card's public identifier and edition number, the relevant collector account IDs, and transfer status and timestamps. We use this information to maintain collections, complete authorised transfers and support authenticity checks. The public verification page shows edition details, whether the card is registered and the number of completed transfers, but not account identities. A private transfer link can be used by anyone who has it until it is cancelled, accepted or expires.

3.4 Communications

When you contact us, we may process:

• your name;
• email address;
• social-media profile;
• message content;
• attachments;
• order details;
• date and time; and
• information needed to respond.

3.5 Website and technical data

We may collect:

• IP address;
• browser and device type;
• operating system;
• language;
• approximate location derived from IP;
• pages viewed;
• referring page;
• date and time of access;
• cookie or similar identifiers;
• checkout activity;
• error logs;
• security events; and
• interaction data.

Non-essential analytics or advertising technologies will only be used where permitted and, where required, after consent.

We may obtain personal data:

• directly from you;
• from someone purchasing an AWEBO for you;
• from your use of the website or owner page;
• from payment providers;
• from delivery and postal providers;
• from customs authorities;
• from email and communication services;
• from social-media platforms when you contact us there; and
• from fraud-prevention or security providers.

We process personal data only where we have a lawful basis.

5.1 To process and fulfil an order

We use order, contact, personalisation, payment and delivery information to:

• accept and confirm orders;
• process payment;
• reserve an AWEBO number;
• make and personalise the product;
• provide production updates;
• provide a private owner page;
• arrange shipment and delivery;
• send tracking information;
• provide customer service;
• handle complaints;
• process replacements or refunds; and
• establish or defend contractual rights.

Legal basis: Processing is necessary to enter into or perform a contract with you.

5.2 Gift recipients

When a customer purchases an AWEBO for another person, we may process the recipient’s information to:

• personalise the product;
• deliver the parcel;
• provide the private owner page; and
• communicate where necessary for delivery or access.

Legal basis: Our legitimate interest in fulfilling the customer’s gift order and providing the recipient with the associated product and owner service.

The purchaser should only provide information reasonably necessary for the gift.

5.3 To comply with law

We may process and retain information to meet obligations concerning:

• accounting and bookkeeping;
• taxation;
• consumer protection;
• payment records;
• product safety;
• customs;
• fraud prevention;
• legal claims; and
• lawful requests from public authorities.

Legal basis: Compliance with legal obligations.

5.4 To provide and secure the website and owner pages

We use technical and access information to:

• deliver website functions;
• maintain checkout;
• reserve numbers;
• protect private pages;
• detect unauthorised access;
• prevent fraud and abuse;
• diagnose technical errors;
• maintain backups; and
• secure our systems and users.

Legal basis: Our legitimate interests in operating a safe, reliable service and protecting customers, Rokter AS and third parties.

5.5 To communicate with you

We process contact and message information to:

• answer questions;
• provide order information;
• resolve delivery problems;
• support owner-page access; and
• respond to complaints or privacy requests.

Legal basis: Performance of a contract, steps taken at your request before entering a contract, legal obligations or our legitimate interest in responding appropriately.

5.6 To improve AWEBO

We may use limited, aggregated or pseudonymised information to:

• understand website performance;
• improve checkout;
• forecast production;
• improve customer service;
• develop the owner-page service; and
• understand which content is useful.

Legal basis: Our legitimate interest in improving AWEBO.

Where consent is legally required for analytics technologies, we rely on consent instead.

5.7 To publish owner photographs and stories

We publish identifiable owner-submitted images, stories or personal details only where the owner has separately chosen to submit or approve them for publication.

Legal basis: Consent.

A private upload alone is not consent to public publication.

5.8 Marketing

We may send marketing where:

• you have subscribed or consented;
• applicable law otherwise permits it; or
• the communication is a service message rather than marketing.

Order confirmations, production updates, owner-page access, shipping notices, safety notices and customer-service messages are service communications.

You may unsubscribe from marketing at any time.

Each AWEBO may have a private owner page.

The page may contain:

• the AWEBO number;
• product and production information;
• personalisation details;
• photographs of the AWEBO;
• an owner name or display name;
• uploaded photographs;
• an uploaded story;
• country or general location; and
• gallery-publication choices.

Private owner pages are intended only for the owner, recipient and authorised AWEBO personnel or service providers.

A private owner page may be accessed using a unique link instead of a traditional password.

Anyone who obtains the link may potentially be able to open the page.

You should therefore:

• keep the link private;
• avoid posting it publicly;
• avoid forwarding it unnecessarily; and
• tell us immediately if it may have been exposed.

We may disable and replace a link where necessary for security.

We use reasonable measures intended to prevent private owner pages from being publicly indexed or openly discoverable. No internet-based service can guarantee absolute security.

Photographs and stories uploaded privately remain private unless the owner separately chooses to submit or approve them for publication.

Private content may be accessed by authorised AWEBO personnel and service providers where necessary to:

• operate the page;
• provide customer support;
• moderate requested publication;
• investigate misuse;
• maintain security; or
• comply with law.

Do not upload information that is unnecessary for the service, including:

• complete payment details;
• passwords;
• identification documents;
• exact private addresses;
• confidential documents;
• sensitive personal information; or
• information about other people without permission.

The public gallery may display approved information such as:

• an AWEBO number;
• an owner photograph;
• a photograph of the AWEBO;
• an owner story;
• first name or chosen display name;
• country; and
• a general location approved by the owner.

We do not require public participation as a condition of purchasing an AWEBO or using the owner page.

The publication choice must be separate, optional and based on an affirmative action.

We may review submissions before publication.

We may decline or remove material that is:

• unlawful;
• inappropriate;
• misleading;
• infringing;
• unsafe;
• privacy-invasive; or
• inconsistent with the purpose of the gallery.

When you actively submit or approve content for publication, you allow Rokter AS to:

• publish the approved content in the Where they live gallery;
• display it on AWEBO-controlled websites;
• share it through AWEBO-controlled social-media accounts;
• resize, crop or format it for presentation; and
• display the AWEBO number and other details you have approved.

You retain ownership of your original content.

You may withdraw publication consent at any time by contacting:

awebo@awebo.no

After withdrawal, we will stop new use and remove the content from channels under our control within a reasonable period.

Withdrawal does not affect publication that lawfully occurred before withdrawal.

Copies may continue to exist temporarily or permanently in:

• system backups;
• search-engine caches;
• screenshots;
• third-party reposts; or
• social-media shares outside our control.

Before uploading or submitting a photograph containing identifiable people, you must ensure that you have appropriate permission.

Take particular care with images of children.

Do not submit a recognisable image of a child for public publication unless you are legally authorised to provide the necessary permission and publication is appropriate.

We may ask for confirmation or refuse publication where permission is unclear.

You retain ownership of original photographs, stories and other content you upload.

For private content, you give us only the limited permission necessary to:

• host it;
• store it;
• display it on the private page;
• make technical copies;
• secure it; and
• provide the service.

This private-service permission ends when the content is permanently deleted, subject to reasonable backup periods and legal retention requirements.

A separate publication permission applies only when you actively approve public use.

We share personal data only where reasonably necessary.

13.1 Payment providers

Payment providers process payments, refunds, disputes and fraud checks.

13.2 Postal, shipping and logistics providers

They receive the information necessary to:

• create shipping labels;
• transport the parcel;
• provide tracking;
• complete delivery;
• process returns; and
• handle customs requirements.

International shipments may involve several carriers or postal operators.

13.3 Customs and public authorities

Delivery details may be provided to customs, tax, border, postal or law-enforcement authorities where required.

13.4 Website, hosting and database providers

These providers help us operate:

• awebo.no;
• checkout;
• order systems;
• private owner pages;
• databases;
• backups; and
• security infrastructure.

13.5 Email and communications providers

They help us send:

• order confirmations;
• owner-page links;
• production updates;
• shipping messages;
• customer-service communications; and
• permitted marketing.

13.6 Analytics and technical providers

Where enabled, these providers may help us measure performance, diagnose errors, prevent fraud and understand aggregated use.

Non-essential tracking is subject to consent where required.

13.7 Professional advisers

We may disclose information to accountants, auditors, insurers, lawyers and other advisers where necessary.

13.8 Legal recipients

We may disclose information where required by law or reasonably necessary to:

• respond to a lawful request;
• protect a person’s safety;
• investigate fraud;
• enforce an agreement; or
• establish, exercise or defend legal claims.

13.9 Business transfers

If Rokter AS or the AWEBO business is reorganised, financed, merged, sold or transferred, relevant personal data may be disclosed to advisers and potential or actual recipients, subject to appropriate confidentiality and legal safeguards.

AWEBO sells and ships internationally.

Delivery information may therefore be sent to carriers, postal operators, customs authorities and delivery partners outside Norway and the European Economic Area where necessary to fulfil an international order.

Some technology providers or their sub-processors may also process information outside the EEA.

Where data-protection law requires a transfer mechanism, we will use an appropriate safeguard, such as:

• an adequacy decision;
• approved Standard Contractual Clauses;
• supplementary safeguards; or
• another lawful transfer mechanism.

We retain personal data only for as long as necessary for the relevant purpose, including legal, accounting, security and dispute requirements.

15.1 Order and accounting records

Order, payment and accounting information is retained for the period required by Norwegian bookkeeping, tax and related laws.

15.2 Customer-service and complaint records

We retain these for as long as necessary to resolve the matter and for an appropriate period afterwards to document the outcome and protect legal rights.

15.3 AWEBO number and provenance

We may retain limited information connecting an individually numbered AWEBO with its production and ownership history where necessary to provide:

• provenance;
• support;
• number integrity;
• replacement assistance; or
• continuity of the owner service.

Where possible, unnecessary personal information will be removed or minimised.

15.4 Private owner-page content

Private page content is retained while the owner service remains active or until deletion is requested, unless continued retention is necessary for legal, security or dispute reasons.

15.5 Public gallery content

Public content is retained until:

• publication permission is withdrawn;
• the content is removed;
• the gallery ends; or
• continued storage is no longer necessary.

15.6 Consent records

We may retain records of publication consent and withdrawal for as long as reasonably necessary to demonstrate compliance and manage past use.

15.7 Technical and security logs

Logs are retained for a limited period appropriate to security, fraud prevention, troubleshooting and investigation.

15.8 Backups

Deleted information may remain in protected backups for a limited period until the backup is overwritten or securely deleted.

Backup information is not used for ordinary business purposes.

The website may use cookies, local storage and similar technologies.

Necessary technologies

Necessary technologies may be used to:

• maintain checkout;
• hold a selected number;
• prevent fraud;
• remember privacy choices;
• secure the website;
• enable private owner-page access; and
• provide core functions requested by the user.

Optional technologies

Analytics, advertising, behavioural tracking or similar non-essential technologies will only be used where permitted and, where required, after you have made an active choice.

You should be able to withdraw or change your cookie choice through the website.

A separate cookie notice may identify the current tools and providers in use.

We use reasonable technical and organisational measures designed to protect personal data.

Depending on the system, these may include:

• encrypted connections;
• access restrictions;
• unique private links;
• secure hosting;
• logging and monitoring;
• backups;
• supplier controls;
• data minimisation; and
• procedures for handling security incidents.

No system can guarantee complete security.

Please contact us immediately if you believe your private link, order information or communication with AWEBO has been compromised.

Rokter AS is the legal company operating AWEBO.

Official AWEBO emails are sent only from addresses ending in:

• @awebo.no
• @rokter.no

Be cautious of emails from similar-looking domains or other addresses claiming to represent AWEBO.

AWEBO will never ask you by email to provide:

• complete payment-card information;
• an online banking password;
• a one-time banking security code; or
• the password for another service.

Do not provide your private AWEBO access link to someone claiming to represent us unless you have independently verified the request.

Please report suspicious messages to:

awebo@awebo.no

Legitimate transactional messages may also be sent directly by payment providers, postal operators or delivery carriers under their own names and domains.

If a personal-data breach occurs, we will investigate it and take reasonable steps to limit harm.

Where required by law, we will notify the relevant supervisory authority and affected individuals.

Rokter AS does not intend to make decisions producing legal or similarly significant effects solely through automated processing.

Payment and fraud-prevention providers may use automated systems to assess transactions under their own policies.

Depending on the circumstances, you may have the right to:

• receive information about our processing;
• request access to your personal data;
• correct inaccurate information;
• complete incomplete information;
• request deletion;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent;
• object to direct marketing;
• receive certain information in a portable format; and
• complain to a supervisory authority.

These rights are not absolute. We may be required or permitted to retain information for legal, accounting, security, fraud-prevention or dispute purposes.

You may withdraw consent to:

• marketing;
• optional cookies; or
• publication of photographs and stories

at any time.

Withdrawing consent does not affect processing that lawfully occurred before the withdrawal.

It must be possible to use the private owner page without agreeing to public gallery publication.

Send privacy requests to:

awebo@awebo.no

Please explain what you are requesting.

We may ask for information necessary to confirm your identity. This protects private information from being disclosed or deleted at the request of an unauthorised person.

We will respond within the period required by applicable law.

Please contact us first if you believe we have handled your personal data incorrectly.

You also have the right to complain to:

Datatilsynet
The Norwegian Data Protection Authority

You may also contact the relevant supervisory authority in the EEA country where you live or work, or where you believe an infringement occurred.

AWEBO products and owner pages are not directed at children.

Children should not independently:

• submit personal data;
• upload owner content;
• provide public publication consent; or
• manage a private owner page.

A parent or legal guardian should manage interactions involving a child.

We may remove content or request confirmation from a responsible adult where necessary.

Our website may link to payment providers, delivery carriers, social-media platforms or other external services.

Independent third parties process personal data under their own privacy notices.

We are not responsible for the privacy practices of independent services that we do not control.

We may update this Privacy Policy when our services, suppliers, technology or legal obligations change.

The current version will be published on awebo.no with the date of the latest update.

Where required, we will provide additional notice before materially changing how existing personal data is used.

For questions, privacy requests or concerns:

awebo@awebo.no

Rokter AS
Organisation number: 934 839 005
Narvik, Norway