Privacy notice

Who is responsible for your data

Klarseal is a brand of Archi Systems AS, a company registered in Norway: organisation number 916 683 332, Gustav Vigelands vei 36, 0274 Oslo, Norway. Archi Systems AS is the controller of the personal data described on this page.

Write to hello@klarseal.com about anything on this page, including a request to use your rights. Questions about an order go to support@klarseal.com, and security reports to security@klarseal.com. We have not appointed a data protection officer.

Norway is in the EEA, so the GDPR applies to us directly.

When you visit this website

This website sets no cookies, loads no third-party scripts when a page opens, and runs no analytics.

The site is delivered by Bunny CDN. Like any web server, it receives your IP address and the details of each request (the page, the time, your browser’s user agent). We use them to deliver the site and to keep it secure, which is our legitimate interest. These logs are kept for 90 days and then deleted.

Where a guide embeds a video, nothing is loaded from YouTube until you click it. When you do, YouTube receives your IP address under its own privacy policy.

When you write to us

If you email us, we receive your name, your email address, what you write and any order number you include. We use it to answer you and to sort out your order. The legal basis is the contract with you, or our legitimate interest in answering a question before you are a customer. We keep the thread for 2 years after it closes.

Asking to hear when ordering opens. If you asked us, by writing to hello@klarseal.com, to tell you when Klarseal opens for orders, we keep your email address, your company name and what you told us you need, because you asked us to (your consent). We write to you once when ordering opens, and we delete the record 12 months after that or as soon as you ask, whichever comes first. You can withdraw your consent at any time with one email.

When you order a certificate

To sell to a business and have the certificate issued, checkout asks for:

• Your company: company name, country, organisation number and/or VAT number, address, billing email address and, if you give it, a phone number.
• The certificate holder: first and last name as on their identity document, email address, phone number if you give it, and the email address that becomes their SimplySign login.
• Your acceptance: which versions of our terms, Certum’s terms of use, Certum’s revocation rules and this notice you accepted, when, and the IP address and browser user agent the order came from.

We also record the result of the company check we run before payment: what the public register for your country (or the EU’s VIES VAT register) returned for the number you entered. For a Norwegian company this includes the names and roles of the people the Brønnøysund register lists as able to sign for it.

We use this to check that your company can order, to place the order with Certum, to invoice you, to tell you by email how the order is progressing, and to keep proof of what was agreed.

Why	Legal basis
Checking the company, placing the order with Certum, emails about your order	The contract with you, and the steps you ask for before it (Art. 6(1)(b))
Invoices, credit memos and payment records	Our legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(c))
The record of your acceptance, and security logs	Our legitimate interest in being able to show what was agreed and in protecting the service (Art. 6(1)(f))

Payment is handled by Mollie. You enter your card details on Mollie’s pages; we receive the payment’s status and reference, and never see or store your card details.

On your device. Checkout saves your progress in your own browser so that a reload does not lose it. It is removed when the order is paid, or when you choose “Start over”.

What we are built never to hold

Klarseal is designed not to receive or store identity-document images. Certum collects validation evidence directly from you, through its own identity check or documents you send to Certum.

For cloud products the private key is generated inside Certum’s hardware security module and stays there. Our process is built so that Klarseal never holds it.

Who else receives your data

Service providers who process data for us under our instructions:

Provider	What it does	Where
Mollie	Takes payment	EEA (Netherlands)
OVHcloud	Hosts the servers that run the order system and its database	EEA (Germany)
Our own mail server	Sends and receives our email	Norway
Bunny CDN	Delivers this website	See below

Certum (Asseco Data Systems S.A., Poland) is the certificate authority, and it is a separate controller, not a processor of ours. To have your certificate issued we send Certum the company details and the holder’s name, email address, phone number and SimplySign login email. Certum performs all identity validation and issues the certificate, and it decides under its own policies and legal obligations what it keeps and for how long. Its own privacy information is at certum.eu.

Public registers. The company check sends the number you entered to the register for your country (Brønnøysundregistrene in Norway, the EU’s VIES, or the business or VAT register of the UK, Australia or New Zealand).

We do not sell your data, and we do not use it for profiling or for marketing.

Where your data is

Our order system, our mail and our payment provider are in the EEA. Bunny CDN serves each visitor from a nearby location; if you visit from outside Europe, the location that handles your request may be outside the EEA.

How long we keep it

Data	How long
Invoices, credit memos and payment records	5 years after the end of the financial year (Bookkeeping Act)
Order records, including the company and holder details, your acceptance and the company check	The life of the certificate, plus 5 years
Email with us	2 years after the thread closes
A request to hear when ordering opens	12 months after ordering opens, or until you ask us to remove you
Server and CDN logs	90 days
Checkout progress in your browser	Until the order is paid or you start over

Then we delete it.

Your rights

You can ask us for a copy of your personal data, have it corrected, have it erased, restrict how we use it, receive it in a portable form, and object to processing based on our legitimate interest. Where we rely on your consent, you can withdraw it at any time. Write to hello@klarseal.com; we answer within one month.

Two limits, stated plainly. We cannot erase invoices and payment records before the Bookkeeping Act lets us. And a request to us covers our records only: we cannot erase what Certum holds, because Certum keeps certificate and validation records under its own legal obligations. Ask Certum directly about those.

If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the authority in the EEA country where you live or work.

If something goes wrong

If a personal data breach puts your data at risk, we report it to Datatilsynet within 72 hours of becoming aware of it, and where the risk to you is high we tell you without undue delay: what happened, what it means for you, and what we are doing about it.

Changes to this notice

When this notice changes, the date at the top changes with it. Checkout records which version you accepted when you ordered.