Last updated: 11 October 2026
In short
Melby Security collects as little information about you as possible. The website melbysecurity.no does not set any cookies, and we do not use services that track you across websites. If you send us a message or buy a domain, we only use the information to reply to you and complete the purchase. We do not sell your information or use it for marketing.
Who is responsible?
Melby Security (organisation number 993 804 827 MVA) is the data controller for the personal data we collect on melbysecurity.no and when we sell domains. This means that we are responsible for making sure your information is handled securely and in line with data protection law.
If you have questions about privacy, write to jam@melbysecurity.no. We are a small business without a data protection officer, so you will get a reply directly from us.
Does the website use cookies?
No. The website does not set any cookies and does not store anything in your browser. The fonts are stored on our own server, so your browser does not fetch them from Google. The only thing loaded from others is the spam check from Cloudflare on pages with a form (see “How do we protect the forms against spam?”).
Do we measure how many people visit the website?
Yes, but without being able to see who you are. We count visits with Burst Statistics, which runs on our own server. Burst does not use cookies and does not store IP addresses. We can see which pages are read, which website or search engine visitors come from, and whether they use a mobile phone or a computer. Nothing is sent to anyone else.
We use the statistics to improve the website and delete them after 24 months. The legal basis is legitimate interest: a reasonable need that outweighs the small impact on you (GDPR Article 6(1)(f)).
What is stored in the server logs?
The server at PRO ISP stores technical logs with IP address, time and which page was requested, as most websites do. PRO ISP uses the logs for operations and to detect attacks, and deletes them when they are no longer needed.
If someone tries to log in to the administration area with the wrong password, we store the IP address to block attacks. It is deleted automatically within 48 hours of the last attempt. This only applies to the administrator login page, not to ordinary visitors. The legal basis is our legitimate interest in a secure website (GDPR Article 6(1)(f)).
What happens when you click a link to another website?
We do not send any information about you to other websites. When you click a link, your browser connects to the other website, which can then see your IP address and that you came from melbysecurity.no. From then on, the privacy policy of that website applies.
How do we protect the forms against spam?
The forms are protected by Cloudflare Turnstile, which checks whether a human or a robot is filling them in. Turnstile uses, among other things, your IP address (the number that identifies your internet connection) and information about your browser, but it does not set any cookies. We do not store this information ourselves, and we have a data processing agreement with Cloudflare.
We do this to stop spam and misuse. The check usually happens without you noticing, so the impact on you is small. The legal basis is legitimate interest (GDPR Article 6(1)(f)).
Cloudflare also uses the information to improve its bot detection, and is itself responsible for that. Read more in Cloudflare’s privacy policy for Turnstile.
What happens when you send us a message?
What we collect: your name, your email address and what you write. Each form belongs to one domain, so the message shows which domain you are asking about.
Why: to reply to you and, if relevant, enter into an agreement for a purchase.
Legal basis: you have asked us to contact you before a possible agreement (GDPR Article 6(1)(b)). Sending a form is voluntary, but we cannot reply to you without your name and email address.
How long: If the enquiry does not lead to a sale, we delete it 12 months after our last contact. If there is a sale, the rules below apply.
What happens when you buy a domain?
What we collect: When you want to buy a domain, we ask you by email for the information needed for the change of ownership and the invoice:
- Organisations: the name, organisation number, address, phone number and email address of the organisation, and the name, phone number and email address of the contact person. We also ask whether the invoice should be sent by email or as EHF (e-invoice), and whether you already have an account with Domeneshop.
- Private individuals: your name, address, phone number and email address, and your person ID from Norid (PID). You create the PID yourself at Norid, and it is used instead of your national identity number. We never ask for your national identity number. As a private individual, you have a 14-day right of withdrawal. If you ask us to start the change of ownership before the period ends, you lose the right of withdrawal once the domain has been transferred. We keep your answer about this as documentation.
Why: to transfer the domain to you and issue the invoice.
Legal basis: we need the information to fulfil our agreement with you (GDPR Article 6(1)(b)), and the Norwegian Bookkeeping Act requires us to keep the invoice (Article 6(1)(c)). Without the information, we cannot transfer the domain.
How long: We delete emails about the purchase 3 years and 6 months after the end of the financial year. We keep the invoice for at least 5 years. It is stored in the accounting system Fiken, which does not allow us to delete individual invoices, so it remains there for as long as we use Fiken.
How the change of ownership works: We order the change of ownership from Domeneshop, which sends a self-declaration to the email address you have given. Once you have confirmed it, Domeneshop and Norid complete the change of ownership. If you do not have an account with Domeneshop, Domeneshop creates one. After the change of ownership, Domeneshop and Norid are themselves responsible for the information they hold about you.
Who receives the information?
- PRO ISP (Group.One Norway AS) runs our website and email on servers in Oslo and stores the information in Norway or the EU. We have a data processing agreement with PRO ISP, so they may only use the information to provide their service.
- Cloudflare checks that forms are not filled in by robots. We have a data processing agreement with Cloudflare.
- Fiken creates and stores our invoices. We have a data processing agreement with Fiken.
- Domeneshop and Norid receive the information needed for the change of ownership. Domeneshop is our registrar, and Norid manages .no domains.
- SpareBank 1 Sør-Norge, our bank, sees your name when you pay.
- Public authorities, such as the police or the Norwegian Tax Administration, only receive information when the law requires it.
Is your information sent outside the EU/EEA?
Your information is stored in Norway or the EU, with two exceptions. These suppliers may send information to the USA, and both do so lawfully:
- Cloudflare (spam check): Cloudflare participates in the EU–US Data Privacy Framework and has the EU Standard Contractual Clauses as a fallback.
- Fiken (accounting and invoices): Fiken has its servers in Norway, but stores encrypted backups with Amazon, Microsoft and Google and uses American services for troubleshooting and AI features. According to Fiken, these transfers only happen to countries approved by the European Commission, or with safeguards under GDPR Article 46.
Do we make automated decisions about you?
No. We do not make any decisions about you automatically and do not create profiles. Every enquiry is read and answered by a person.
What are your rights?
We only have the emails between you and us and, if you have bought a domain, the invoice in Fiken. You can at any time ask us to:
- give you a copy of the information (access)
- correct anything that is wrong
- delete the information (we must still keep invoices and emails about a purchase for as long as the Bookkeeping Act requires)
- stop using it while we look into a complaint from you (restriction)
- give you the information you have provided to us in a common file format (data portability)
You can say no. You have the right to object to what we do on the basis of legitimate interest:
- Spam check: If you do not want Cloudflare to check you, you can email jam@melbysecurity.no directly instead of using a form.
- Statistics: They cannot be linked to you, so there is no information about you to stop.
- Server logs: The logs are kept by PRO ISP, which runs the server, and we cannot turn them off. They are needed to keep the website secure, and PRO ISP deletes them when they are no longer needed. We delete IP addresses from failed logins automatically within 48 hours.
Write to jam@melbysecurity.no. We reply as quickly as we can, and within one month at the latest. It costs you nothing. If you have bought a domain, Domeneshop, Norid and our bank hold their own information about you. You can ask them directly for access.
Where can you complain?
If you believe we are processing your information incorrectly, we would appreciate it if you let us know, so that we can put it right. You also always have the right to complain to the Norwegian Data Protection Authority, Datatilsynet.
When do we change this privacy policy?
We update this policy when we change how we process personal data. The date at the top shows when it was last changed.
This is a translation of our Norwegian personvernerklæring. If the two versions differ, the Norwegian version applies.