Get a quote

Privacy Policy

Last updated

This Privacy Policy explains how Multi Coating AS collects, uses, stores and protects personal data when you visit our website, purchase our products, contact us or otherwise interact with our business.

Multi Coating AS processes personal data in accordance with the EU General Data Protection Regulation (“GDPR”), the Norwegian Personal Data Act and other applicable privacy legislation.

1. Data controller

The data controller responsible for the processing of your personal data is:

Multi Coating AS
Company registration number: 934 936 140
Address: Hagatjernveien 5, 3050 Mjøndalen, Norway
Telephone: +47 913 09 374
Email: contact@multicoating.no
Website: multicoating.no

Questions about this Privacy Policy or our processing of personal data may be sent to contact@multicoating.no.

2. Personal data we collect

The personal data we collect depends on how you interact with us.

We may collect the following categories of information:

Contact information

  • name
  • billing and delivery address
  • email address
  • telephone number
  • company name and company registration number
  • job title or role, where relevant

Order and customer information

  • products ordered
  • order number
  • purchase date
  • delivery method
  • payment status
  • order history
  • invoices, credit notes and accounting information
  • communications relating to an order

Payment information

Payments may be processed by an external payment provider. Multi Coating will normally not receive or store complete payment card details.

We may receive information such as:

  • payment method
  • payment status
  • transaction reference
  • the amount paid
  • the date and time of payment

The payment provider processes payment information in accordance with its own privacy policy.

Customer service and complaint information

When you contact us or submit a complaint, we may collect:

  • your name and contact details
  • the content of your enquiry
  • order and product information
  • photographs and videos
  • product batch or production numbers
  • information about the substrate and application process
  • dates, temperatures, weather and storage conditions
  • documentation relating to the use or application of the product
  • correspondence and other relevant attachments

Photographs submitted as part of a complaint may contain personal data or information about a property or location. Please avoid including people or unrelated private information unless necessary for the handling of the complaint.

Technical and website information

When you visit our website, we may collect technical information such as:

  • IP address
  • browser type and version
  • device type
  • operating system
  • language settings
  • pages visited
  • time and duration of visits
  • referral source
  • interaction with the website
  • cookie identifiers and similar technical identifiers

Some of this information is collected using cookies or similar technologies.

Marketing information

If you subscribe to a newsletter or agree to receive marketing, we may collect:

  • your name
  • email address
  • telephone number, where relevant
  • marketing preferences
  • consent history
  • information about whether you open or interact with our communications

3. How we collect personal data

We may collect personal data:

  • directly from you
  • when you place an order
  • when you contact us by email, telephone or through a contact form
  • when you submit a complaint
  • when you subscribe to marketing communications
  • when you visit or use our website
  • from payment, delivery and logistics providers
  • from publicly available company registers
  • from business partners or distributors where necessary to fulfil an order or respond to an enquiry

4. Why we process personal data

Processing orders and delivering products

We process personal data to:

  • register and confirm orders
  • receive and verify payment
  • package and deliver products
  • communicate about the order
  • provide invoices and receipts
  • manage returns, cancellations and refunds

The legal basis is that the processing is necessary to enter into or perform a contract with you.

Customer service and enquiries

We process personal data to answer questions, provide product information and assist customers.

The legal basis may be the performance of a contract or our legitimate interest in providing effective customer service and operating our business.

Complaints and product documentation

We process personal data, photographs, application documentation and other information to:

  • assess complaints
  • investigate possible product defects
  • determine whether the product was applied correctly
  • identify product batches
  • provide technical support
  • defend or establish legal claims
  • improve product quality and instructions

The legal basis may be the performance of a contract, compliance with a legal obligation or our legitimate interest in handling complaints, maintaining product quality and protecting our legal rights.

We process and retain invoices, transaction information and other documentation where required by accounting, tax, product safety or other legislation.

The legal basis is compliance with a legal obligation.

Website operation and security

We process technical information to:

  • operate and maintain the website
  • prevent misuse, fraud and security incidents
  • detect and correct technical problems
  • improve website performance
  • protect our systems, customers and business

The legal basis is our legitimate interest in operating a secure and functional website.

The website’s operational logs are stored by Cloudflare, Inc., which operates the website on our behalf. The logs contain your IP address, the country the request came from, and technical information about your browser and the request. They are used solely to detect and correct faults, and not to follow individual visitors.

To prevent automated submissions through the forms on our website, we use Cloudflare Turnstile. The service assesses whether a submission comes from a human being, and processes your IP address and technical information about your browser for that purpose. Turnstile sets no cookies, and the information is not used for marketing or cross-site tracking. The provider is Cloudflare, Inc.

To detect misuse of our domain name in email, we use Postmark, which receives technical delivery reports from receiving email services. The reports contain the IP addresses of sending servers, message counts and the outcome of technical checks — not the content of emails, and not information about recipients or customers. The reports are retained for seven days.

Website analytics

Where required by law, analytics cookies and similar technologies are used only with your consent.

Analytics information may be used to understand how visitors use the website and to improve its content, structure and performance.

You may withdraw or change your consent through the website’s cookie settings.

Marketing

We may send marketing communications where:

  • you have given your consent;
  • marketing is permitted based on an existing customer relationship; or
  • another valid legal basis applies.

You may unsubscribe at any time by using the unsubscribe link in the communication or by contacting us at contact@multicoating.no.

Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

Depending on the circumstances, Multi Coating processes personal data based on one or more of the following legal grounds:

  • your consent
  • the need to enter into or perform a contract
  • compliance with a legal obligation
  • our legitimate interests, provided that these interests are not overridden by your fundamental rights and freedoms
  • the establishment, exercise or defence of legal claims

Where processing is based on consent, you may withdraw your consent at any time.

Where processing is based on legitimate interests, you may contact us for further information about the balancing assessment.

6. Cookies and similar technologies

Our website does not currently use any cookies, and no analytics data is collected. The sections below describe the types of cookies we may introduce later, and how consent would be obtained if we do.

The spam protection on our forms, Cloudflare Turnstile, likewise sets no cookies. See section 4 for the information the service processes.

Cookies are small text files stored on your device when you visit a website. They may be used to ensure that the website works correctly, remember preferences, analyse traffic or provide relevant marketing.

We may use the following types of cookies:

Strictly necessary cookies

These cookies are necessary for essential website functions, such as shopping basket functionality, checkout, security and remembering privacy settings.

Strictly necessary cookies may be used without consent where permitted by law.

Preference cookies

These cookies remember choices such as language, region or other website preferences.

Analytics cookies

These cookies help us understand how visitors use the website, which pages are visited and how the website performs.

Analytics cookies are used only when a valid legal basis exists and consent has been obtained where required.

Marketing cookies

Marketing cookies may be used to measure campaigns, personalise advertising or track activity across websites.

These cookies are used only with your consent where required by law.

You may accept, reject or change your cookie preferences through the cookie banner or cookie settings on our website.

Further information about the specific cookies used, their providers, purposes and duration should be provided in our cookie settings or Cookie Policy.

7. Who we share personal data with

We may share personal data with service providers that assist us in operating our business, including:

  • website and online shop providers
  • hosting and IT service providers
  • payment providers
  • banks and financial institutions
  • accounting and invoicing providers
  • shipping, delivery and logistics companies
  • customer service providers
  • email and newsletter providers
  • analytics and marketing providers
  • product manufacturers, laboratories or technical advisers where necessary
  • professional advisers, including accountants, auditors, insurers and lawyers
  • public authorities where disclosure is required by law

Service providers may process personal data only for agreed purposes and in accordance with applicable data protection requirements.

Multi Coating does not sell personal data.

8. Payment providers

Multi Coating does not currently offer payment on the website. Orders are placed following contact with customer service, and the invoice is sent separately. If we introduce payment on the website at a later stage, this Privacy Policy will be updated with the name of the payment provider and a link to its privacy policy.

When you make a payment, personal data may be processed directly by the payment provider selected during checkout.

The payment provider may act as an independent data controller for parts of its processing, including fraud prevention, identity verification and compliance with financial regulations.

Please review the relevant payment provider’s privacy policy for further information.

9. Delivery providers

To deliver your order, we may share necessary information with the selected delivery provider, including your name, address, telephone number, email address and order or delivery reference.

The delivery provider is agreed for each order. We will tell you which provider is used in connection with the delivery, and its own privacy policy is available on the provider’s website.

The delivery provider may contact you with delivery updates.

10. International transfers

Some of our service providers may process personal data outside Norway or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will ensure that an appropriate transfer mechanism is in place. This may include:

  • an adequacy decision from the European Commission
  • the European Commission’s Standard Contractual Clauses
  • additional technical and organisational safeguards
  • another lawful transfer mechanism under the GDPR

The website currently uses three providers that may process personal data outside the EEA:

  • Cloudflare, Inc. operates the website and the spam protection on our forms.
  • Plus Five Five, Inc. (Resend) sends the emails from our forms. Processing takes place primarily in the United States.
  • Postmark (AC PM LLC) receives technical delivery reports about email sent from our domain. Processing takes place in the United States. The reports concern mail servers rather than customers, and are described in section 4 under “Website operation and security”.

We have entered into a data processing agreement with Cloudflare and Resend. For both, the transfer mechanism is the European Commission’s Standard Contractual Clauses (SCCs). The DMARC reports are processed by AC PM LLC, which acts as an independent data controller for that service rather than as a processor on our behalf. The reports concern mail servers and contain no information about customers or recipients.

You may contact us for further information about international transfers and the safeguards used.

11. How long we retain personal data

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by law.

Retention periods may include:

  • order and customer information: for as long as necessary to fulfil the purchase, provide customer service and manage complaints
  • accounting documentation: for the period required by Norwegian accounting legislation
  • complaint documentation: for as long as necessary to investigate and resolve the matter and protect relevant legal rights
  • technical and security logs: for a limited period necessary to maintain security and investigate incidents. The website’s operational logs are deleted automatically after three days
  • marketing information: until you withdraw your consent or object to further marketing
  • consent records: for as long as necessary to demonstrate that valid consent was obtained
  • unanswered or general enquiries: for as long as reasonably necessary to respond and follow up

Personal data may be retained for a longer period where necessary to establish, exercise or defend legal claims or where required by a public authority.

When personal data is no longer required, it will be deleted or anonymised.

12. How we protect personal data

Multi Coating takes appropriate technical and organisational measures to protect personal data against:

  • unauthorised access
  • accidental loss
  • misuse
  • alteration
  • disclosure
  • destruction

Measures may include access controls, secure systems, password protection, encryption where appropriate, backups and restrictions on which employees or service providers may access personal data.

No system can guarantee complete security. If a personal data breach occurs, we will assess the incident and notify the Norwegian Data Protection Authority and affected individuals where required by law.

13. Your privacy rights

Subject to the conditions and limitations of applicable law, you may have the right to:

Access

You may request confirmation of whether we process your personal data and receive a copy of the data we hold about you.

Rectification

You may request that incorrect or incomplete personal data is corrected.

Erasure

You may request that your personal data is deleted where we no longer have a lawful basis or legal obligation to retain it.

Restriction

You may request that the processing of your personal data is restricted in certain circumstances.

Data portability

Where processing is based on consent or a contract and is carried out by automated means, you may request to receive relevant personal data in a structured, commonly used and machine-readable format.

Objection

You may object to processing based on our legitimate interests.

You have the right to object at any time to the use of your personal data for direct marketing.

Where processing is based on your consent, you may withdraw that consent at any time.

Complaint to a supervisory authority

You have the right to lodge a complaint with the Norwegian Data Protection Authority:

Datatilsynet
Website: www.datatilsynet.no

You may also contact the data protection authority in the country where you live or work.

14. How to exercise your rights

To exercise your privacy rights, please contact:

Please explain which right you wish to exercise and provide sufficient information for us to identify the relevant data.

We may request additional information to verify your identity before responding. This is necessary to prevent personal data from being disclosed to an unauthorised person.

We will respond without undue delay and normally within one month. This period may be extended where permitted by law if the request is particularly complex or if several requests have been submitted.

Exercising your rights is normally free of charge. A reasonable fee may be charged, or a request may be refused, where a request is manifestly unfounded or excessive and applicable law permits this.

15. Automated decision-making

Multi Coating does not normally make decisions that produce legal or similarly significant effects based solely on automated processing.

If this changes, we will provide the information required by applicable law.

16. Children’s personal data

Our products and website are not directed at children.

We do not knowingly collect personal data from children unless this is necessary and lawful. If you believe that a child has provided us with personal data without appropriate authorisation, please contact us so that we can investigate and, where appropriate, delete the information.

Our website may contain links to websites operated by third parties.

Multi Coating is not responsible for the content, security or privacy practices of external websites. We recommend reviewing the privacy policy of each website you visit.

18. Social media

If you contact or interact with Multi Coating through social media, the social media provider may also process your personal data.

The provider’s processing is governed by its own privacy policy and settings. Multi Coating may process information necessary to respond to enquiries, administer our pages and communicate with customers.

19. Changes to this Privacy Policy

We may update this Privacy Policy if our services, website or processing activities change or if legal requirements are updated.

The current version will be published on our website with the date of the latest update.

Significant changes may be communicated through the website or by another appropriate method.

20. Contact us

If you have questions about this Privacy Policy, how we process personal data or how to exercise your rights, please contact:

Multi Coating AS
Address: Hagatjernveien 5, 3050 Mjøndalen, Norway
Telephone: +47 913 09 374
Email: contact@multicoating.no