Privacy Policy

Last updated: 12 March 2025

1. Introduction

Ghunexarshran ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website ghunexarshran.world and use our services.

We comply with the General Data Protection Regulation (GDPR) as applicable in the European Economic Area (EEA), and with the Norwegian Personal Data Act (Lov om behandling av personopplysninger — personopplysningsloven), which implements and supplements the GDPR in Norway. By using our website, you consent to the practices described in this policy where consent is the legal basis; other processing is carried out on the basis of contract, legal obligation, or legitimate interest as set out below.

2. Data Controller Information

The data controller responsible for your personal data (as defined in the GDPR and the Norwegian Personal Data Act) is:

• Company Name: Ghunexarshran
• Address: Kasjettvegen 25, 2647 Sør-fron, Norway
• Email: reply@ghunexarshran.world
• Country: Norway

As we are established in Norway and offer services to users in the EEA, the GDPR (as applied in Norway through the EEA Agreement) and the Norwegian Personal Data Act (personopplysningsloven) govern our processing of your personal data.

3. Information We Collect

We may collect the following types of personal data:

• Contact Information: Name, email address, phone number (optional), and postal address when you place an order or contact us.
• Order Information: Products purchased, order history, payment details (processed securely by third-party payment providers).
• Communication Data: Messages, inquiries, and feedback you send to us.
• Technical Data: IP address, browser type, device information, operating system, and browsing behavior on our website.
• Cookie Data: Information collected through cookies and similar technologies (see our Cookie Policy for details).

4. How We Use Your Information

We process your personal data for the following purposes:

• Order Processing: To process and fulfill your orders, including shipping and delivery.
• Customer Service: To respond to your inquiries, provide support, and communicate about your orders.
• Legal Compliance: To comply with legal obligations, including tax and accounting requirements.
• Website Improvement: To analyze website usage and improve our services and user experience.
• Marketing: With your consent, to send promotional communications about our products and offers.
• Security: To protect our website, prevent fraud, and ensure the security of our systems.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our contractual obligations when you place an order.
• Consent: Where you have given explicit consent for specific processing activities (e.g., marketing communications).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services and preventing fraud.
• Legal Obligation: Processing required to comply with applicable laws and regulations.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Order Data: Retained for 7 years for tax and accounting purposes as required by Norwegian law.
• Customer Account Data: Retained until you request account deletion or for 3 years after your last interaction with us.
• Marketing Preferences: Retained until you withdraw consent or unsubscribe.
• Technical Data: Typically retained for 12 months for analytics purposes.

7. Your Rights Under GDPR and Norwegian Law

As a data subject under the GDPR and the Norwegian Personal Data Act (personopplysningsloven), you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data under certain circumstances ("right to be forgotten").
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format where the processing is based on consent or contract.
• Right to Object: Object to processing based on legitimate interests or to processing for direct marketing purposes (including profiling related to direct marketing).
• Right to Withdraw Consent: Withdraw consent at any time for processing based on consent; withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint: File a complaint with the Norwegian Data Protection Authority (Datatilsynet), www.datatilsynet.no, or with a supervisory authority in your country of residence in the EEA.

We will respond to your request without undue delay and in any event within one month as required by law. To exercise any of these rights, please contact us using the information provided below.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted through our website
• Secure storage of personal data on protected servers
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Employee training on data protection and security practices

9. Third-Party Sharing

We may share your personal data with:

• Payment Processors: To securely process your payments.
• Shipping Partners: To deliver your orders.
• Service Providers: Third parties who assist us in operating our website and services.
• Legal Authorities: When required by law or to protect our legal rights.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

10. International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or adequacy decisions.

11. Children's Privacy

Our website is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our website with an updated "Last updated" date. We encourage you to review this policy periodically.