Data deletion

Controller and contact details

Bad.no AS is the controller for personal data processed by Bad.no.

How to request deletion

Email personvern@bad.no with the subject: Data deletion request.

1. Send the request from the email address you used with Bad.no where possible, and identify that email address in your message.
2. Tell us which service you used: customer account, Facebook Login, newsletter, guest purchase, or another interaction with Bad.no.
3. You may include an order number when relevant, but an order number is not required to submit a request.

Do not send identity documents, card details, passwords, or other sensitive information unless Bad.no specifically requests necessary information through a secure method.

Identity verification

If there is reasonable doubt about your identity, Bad.no may request only the additional information necessary to confirm your identity before processing the request.

What happens after we receive your request

1. We acknowledge and assess the request and locate personal data in relevant systems and with relevant processors.
2. We delete or anonymise data where the conditions for deletion apply and inform recipients or processors where required.
3. We respond without undue delay and normally no later than one month. If the complexity or volume of requests requires it, the deadline may be extended by up to two additional months. We will notify you within the first month, explain why, and describe the extension.

Data deleted when the conditions apply

Depending on which services you used, this may include:

• customer account, profile, and contact details that are no longer needed;
• marketing subscriptions, consents, and the associated marketing profile;
• customer-support data and technical identifiers that are no longer needed; and
• the Facebook Login association and data controlled by Bad.no or our service providers, where applicable.

Data that may be retained

Bad.no retains data only where there is an independent lawful basis or a legal obligation to do so.

• Required accounting documentation is normally retained for five years after the end of the relevant financial year under Norwegian bookkeeping rules.
• Other limited data may be retained when necessary for an unresolved purchase, return, complaint, fraud or security matter, or legal claim.

If we refuse all or part of the request, or retain certain data, our response will explain the legal reason and the expected retention period.

Privacy and complaints

You can read more about how Bad.no processes personal data in our privacy policy.

You have the right to complain to the Norwegian Data Protection Authority if you believe your personal data is processed in breach of data-protection rules. Visit the Norwegian Data Protection Authority.