Your privacy, your rights.

The controller is Tananger Dyreklinikk AS, organisation number 923 377 212, Skibmannsvegen 3, 4056 Tananger. Contact us about privacy at post@tanangerdyreklinikk.no or +47 477 50 666. The clinic has not appointed a data protection officer.

Tananger Dyreklinikk AS bears full responsibility for ensuring that personal data processing complies with the GDPR and the Norwegian Personal Data Act. This covers the website and the clinic’s other processing, including medical records, legal bases, retention, provider agreements, security and handling of your rights. Providers operating the website act as processors on the clinic’s behalf and are not controllers.

• Contact enquiries: name, email address, optional phone number, message, selected language and submission date.
• Erasure requests: email address, optional additional information, language, date, processing status and completion time.
• Privacy preferences: necessary storage and analytics choices, version and choice time, stored locally in your browser.
• Statistics after consent: aggregate counts of browser-session visits, public pages visited per session, referring domains and phone-link clicks by date. Visits are counted once per browser session, not as unique people; new tabs, sessions, devices or cleared storage may add visits. These statistics do not store visitor identifiers, IP addresses, full referrer URLs, query parameters, phone numbers or individual browsing logs. Referral sources show only a domain, not identity or geographic location; hidden referrals appear as direct / unknown. Phone clicks do not confirm completed calls. Admin pages are excluded.
• Administration: administrator email, user ID, access role and sign-in/session data. The erasure log contains request ID, administrator ID, time and affected record counts, not the requester’s name, email or message.
• Technical operation: hosting and external providers may process IP addresses, browser information and technical requests for delivery and security.

Enquiries and erasure requests are stored in Lovable Cloud. New enquiries and erasure requests are also sent as an email notification to the clinic's email address so they can be handled quickly. Do not send sensitive personal information, identity documents or payment details through website forms. There are no customer accounts or built-in payments.

• Enquiries about your animal and treatment: contacting the owner, answering questions and providing information about the animal’s health. Basis: GDPR Article 6(1)(b) – steps before and performance of the veterinary services agreement.
• General enquiries unrelated to treatment: answering your question. Basis: Article 6(1)(f) – the clinic’s legitimate interest in responding to enquiries.
• Client details in the animal’s medical record: tracking the animal’s health history and being able to contact the owner. Basis: Article 6(1)(b) (the treatment agreement) and 6(1)(c) (veterinarians’ statutory record-keeping duty).
• Privacy requests: fulfilling and documenting your rights. Basis: Article 6(1)(c) – legal obligation under the GDPR.
• Optional analytics and Google map: Basis: your consent, Article 6(1)(a). Nothing is loaded or measured before you choose it.
• Admin access and security: securing the website and restricting access to personal data. Basis: Article 6(1)(f) – legitimate interest in information security, see also Article 32.

Ticking the privacy and terms box in the contact form confirms you have read this information; it is not marketing consent.

Name, email, message and acknowledgement of privacy/terms are required to submit the contact form. Phone is optional. Email and confirmation are required for the website erasure form; additional information is optional. Without necessary information, the form cannot be submitted or the request may be difficult to handle. You can instead contact us by phone or email. Analytics is optional; refusing it does not affect website or contact-form access.

Your privacy choice is stored in localStorage under “tananger-consent-v3” and read for up to 180 days before you are asked to choose again. After analytics consent, sessionStorage “tananger-visit-counts-v1” stores a counting flag and a list of already counted public pages without a unique visitor ID. This prevents repeat counting on reloads and page changes within the browser session. These marks are not sent to the server, are not read without analytics consent and expire with the browser session. The website requests renewed consent when analytics purposes expand. Change or withdraw analytics consent under “Cookies” in the footer, as easily as giving it. “Necessary only” and “Reject optional” decline optional categories. New measurement stops when consent is withdrawn. Withdrawal does not affect the lawfulness of previous processing. Previous aggregate counts cannot be linked to you. No marketing tools are active. The welcome promotion is currently disabled and stores no display flag. Administrator sign-in uses necessary session storage, not analytics storage.

Enquiries and erasure requests are accessible only to authorized administrators. Lovable Cloud provides storage, sign-in and technical operation as the clinic’s processor under a data processing agreement. Disclosure may also be required by law.

• Google Maps: the map loads only after you actively click “Show Google map”. Google then receives your IP address and technical data and may use cookies under its own terms. The choice lasts until the page is closed. The typeface is served from our own server, not Google.
• Vettigo: booking takes place on an external website opened when you follow the booking link. Its own privacy information applies there.

See Google’s privacy policy.

Website enquiries and erasure requests are stored in Lovable Cloud with the database located in the EU. Lovable’s subprocessors and the website’s delivery network may still process technical data outside the EEA. Such transfers rely on relevant safeguards, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary measures. Ask us for information about safeguards and how to obtain a copy using the contact address above. We do not claim that all data remains in Norway or the EEA.

Personal data must not be retained longer than necessary for its purpose, unless legal retention obligations or legal claims require otherwise. Contact enquiries are kept for up to 12 months after submission and are then deleted. Erasure requests and the erasure log are kept for up to 3 years so that the handling of privacy requests can be documented. Admin data is assessed against access and security needs. Hosting logs and backups follow the provider’s agreed periods.

The statistics view shows the last 30 days, but this is not a 30-day deletion rule; older aggregate counts may remain stored. Browser privacy preferences have a 180-day usable lifetime.

Subject to the conditions in the GDPR, you have rights to:

• access and receive a copy of personal data about you;
• correct inaccurate or incomplete information;
• erasure, also called the right to be forgotten;
• restrict processing;
• data portability for information you provided where processing is automated and based on consent or contract;
• object to legitimate-interest processing based on your particular situation, and always to direct marketing;
• withdraw consent at any time;
• complain to a supervisory authority.

Contact us to exercise your rights. The footer form is an additional option, not the only way to request erasure. We do not use website information for profiling or automated decisions producing legal or similarly significant effects.

Choose “Delete my data” in the footer and provide the email used for your enquiry, or contact us directly. The request is recorded for review; submitting it does not automatically delete data. The clinic may request proportionate additional information where there are reasonable doubts about your identity. Do not send identity documents through the website form.

After verifying identity and reviewing retention obligations, an administrator can delete website enquiries matching the verified email and anonymize related erasure requests. A limited erasure log remains without the requester’s name, email or message; the administrator ID remains personal data about the administrator. Information submitted under other addresses requires separate review.

Erasure is not absolute. Data may be retained where necessary, for example for legal obligations or establishing, exercising or defending legal claims. A refusal must explain the reasons and complaint options. Website deletion does not delete medical records, email inboxes, external bookings or backups. The clinic must address those separately and notify recipients of erasure where GDPR requires it. Previous anonymous aggregate statistics cannot be identified using your email.

Under GDPR, information about action taken must be provided without undue delay and within one month of receipt. Where necessary because of complexity and the number of requests, this may be extended by a further two months. You must be informed within the first month of the extension and its reasons. Rights requests are normally free. For manifestly unfounded or excessive requests, GDPR may permit a reasonable fee or a reasoned refusal. The clinic follows up and sends the response; the website does not automatically email an acknowledgement or completion notice.

Website access controls restrict reading and deletion to authorized administrators; submitted messages are not public. No system can guarantee complete security. The clinic has procedures for access and for handling personal-data breaches, including notifying Datatilsynet within 72 hours where the law requires it.

You can complain to Norway’s Data Protection Authority (Datatilsynet) or the relevant supervisory authority where you habitually live or work.

We update this statement when processing changes and request fresh consent where necessary for changed optional purposes. Responsibility for GDPR-compliant processing lies with Tananger Dyreklinikk AS.