This policy explains how JB Automations handles personal data when you visit jbautomations.no, buy a digital product from us on any platform, or contact us. It is designed to meet the GDPR (EU/EEA, including Norway), UK GDPR, US federal and state privacy laws, and the privacy laws of Canada, Australia, New Zealand, Brazil, Japan, South Korea, Singapore, India, China and South Africa. If anything here conflicts with mandatory law where you live, that law prevails.
1. Who we are
The data controller (also called “business”, “personal information handler” or “responsible party” under various laws) is Joakim Berg, trading as JB Automations, Norway. Email: joakimberg1990@gmail.com. We are a small business and are not required to appoint a data protection officer under the GDPR; the email above is the contact point for all privacy matters in all regions.
2. Data we collect
- Purchase data – name, email address, country, product bought, price, currency, tax/VAT data and order ID, received from the sales platform you buy through (Payhip, Gumroad, Ko-fi or Etsy).
- Payment data – handled entirely by the payment provider (e.g. Stripe or PayPal). We never see or store full card numbers.
- Communications – the content of emails you send us and our replies.
- Email list (optional) – if you sign up for a free download or newsletter: your email address and the date and source of consent.
- Technical data – when you visit this site, our hosting/CDN provider automatically processes your IP address, browser user agent, requested URL and time in short-lived server logs for security and delivery.
We do not collect sensitive (special-category) data and we do not buy data from data brokers.
3. How we use data
- to deliver products you buy and provide download access and updates;
- to answer support requests, process refunds and handle complaints;
- to meet accounting, tax and other legal obligations;
- to keep the site and our accounts secure and prevent fraud;
- with your consent, to send you emails about free resources and new products (you can unsubscribe at any time with one click).
We do not sell personal data, do not use it for targeted/cross-context behavioural advertising, and do not make automated decisions with legal or similarly significant effects.
4. Legal bases (GDPR / UK GDPR and similar laws)
| Purpose | Legal basis |
|---|---|
| Delivering purchases, support, refunds | Performance of a contract (Art. 6(1)(b)) |
| Bookkeeping and tax (Norwegian Bookkeeping Act requires 5 years) | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, server logs, answering general enquiries | Legitimate interests (Art. 6(1)(f)) |
| Email list / marketing | Consent (Art. 6(1)(a)), withdrawable at any time |
5. Service providers and sharing
We share personal data only with providers that help us run the business, each under its own privacy terms and, where required, a data processing agreement. Some platforms act as independent controllers or as merchant of record for your purchase; their own privacy policies then also apply.
| Provider | Role | Main location |
|---|---|---|
| Payhip Ltd | Online store, checkout, file delivery, EU/UK VAT | UK |
| Gumroad, Inc. | Online store, checkout, file delivery (merchant of record) | USA |
| Ko-fi Labs Ltd | Online store, checkout, file delivery | UK |
| Etsy, Inc. / Etsy Ireland UC | Marketplace, checkout, file delivery | USA / Ireland |
| Stripe, Inc. / Stripe Payments Europe Ltd | Card payment processing | USA / Ireland |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing | Luxembourg / USA |
| Google LLC / Google Ireland Ltd | Email (Gmail); Google Search Console (aggregated search statistics only – no cookies on this site) | USA / Ireland |
| Pinterest, Inc. / Pinterest Europe Ltd | We publish product pins; Pinterest processes data of its own users under its own policy. This site does not use the Pinterest tag. | USA / Ireland |
| Cloudflare, Inc. | Website hosting, CDN and security (server logs) | USA / global |
We may also disclose data where required by law, to protect our legal rights, or to a successor if the business is transferred (you will be informed). We do not sell or rent personal data.
6. International transfers
Some providers process data outside your country, including in the United States. For transfers from the EEA/Norway we rely on adequacy decisions (including the EU–US Data Privacy Framework for certified companies and the UK adequacy decision) or the European Commission’s Standard Contractual Clauses (SCCs) with supplementary measures where needed; for transfers from the UK, the UK International Data Transfer Addendum; and for other regions, the transfer mechanisms required by local law (see section 11). You may request a copy of the relevant safeguards by email.
7. Retention
- Purchase and accounting records: 5 years after the end of the financial year (Norwegian Bookkeeping Act), or longer if your local law requires.
- Support emails: up to 3 years after the last contact, then deleted.
- Email list: until you unsubscribe; then only a suppression record so we do not email you again.
- Server logs at our hosting provider: typically a few days, at most 30 days.
8. Security
We use reputable providers with encryption in transit (HTTPS/TLS), two-factor authentication on our accounts, least-privilege access and regular review. No system is 100% secure; if a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as required by law (for example within 72 hours to Datatilsynet under the GDPR).
9. Cookies and tracking
This website sets no cookies, uses no analytics or advertising trackers, and loads no third-party scripts or fonts. Therefore no cookie banner is shown. If you click through to a sales platform (Payhip, Gumroad, Ko-fi, Etsy) or Pinterest, that site may use cookies under its own cookie policy and consent banner. If we ever add analytics or cookies to this site, we will update this policy and ask for your consent first where the law requires it. We respect Global Privacy Control and Do Not Track signals.
10. Your rights and how to exercise them
Depending on where you live, you may have the right to: know what data we hold and receive a copy (access/portability); correct inaccurate data; delete your data; restrict or object to processing; withdraw consent at any time; opt out of marketing, sale, sharing, targeted advertising and profiling; not be discriminated against for exercising rights; appoint an authorised agent; appeal a refusal; and complain to a supervisory authority.
How: email joakimberg1990@gmail.com with “Privacy request” in the subject line, from the email address used for your purchase if possible. We may need to verify your identity. We respond within one month (GDPR/UK GDPR), 45 days (US states, extendable once by 45 days), 30 days (Canada, Brazil 15 days for confirmation/access), 15 working days (China) or any shorter period required by your local law. Requests are free unless manifestly unfounded or excessive.
11. Region-specific information
EU/EEA and Norway (GDPR)
The General Data Protection Regulation (EU) 2016/679 applies, in Norway through the Personal Data Act (personopplysningsloven). Our legal bases are set out in section 4. You have the right to access, rectification, erasure, restriction, data portability, to object (including an absolute right to object to direct marketing), to withdraw consent at any time, and not to be subject to solely automated decisions with legal or similarly significant effects (we make none). You may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or to the supervisory authority where you live or work.
United Kingdom (UK GDPR)
The UK GDPR and Data Protection Act 2018 give you the same rights as listed for the EU/EEA. Transfers from the UK rely on the UK adequacy regulations for the EEA or on the UK International Data Transfer Addendum. You may complain to the Information Commissioner’s Office (ico.org.uk).
United States (California and other states)
California (CCPA as amended by CPRA). In the last 12 months we have collected these categories: identifiers (name, email), commercial information (purchase records), internet/electronic activity (server logs) and inferences limited to purchase history. Sources: you directly, and our sales platforms. Purpose: the business purposes in section 3. We do not sell personal information and do not “share” it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. We have no actual knowledge of selling or sharing data of consumers under 16. You have the right to know/access, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and not to be discriminated against for exercising your rights. You may use an authorised agent; we may ask for proof of authorisation and verify your identity via the email used for your purchase. We honour Global Privacy Control (GPC) signals as a valid opt-out request.
Other states. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Nebraska and any other state with a comprehensive privacy law have, as applicable, the rights to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and profiling. We do not engage in targeted advertising, sale of data, or profiling with significant effects. If we deny a request you may appeal by replying to our decision with “Appeal” in the subject line; we will respond within the period required by law (generally 45–60 days) and, if denied, tell you how to contact your state Attorney General.
Children (COPPA). See section 12.
Nevada. We do not sell covered information as defined by NRS 603A.
Canada (PIPEDA and Québec Law 25)
We process personal information with your knowledge and consent, as described here, in line with PIPEDA and applicable provincial laws. You may access and correct your information and withdraw consent (subject to legal or contractual limits). For Québec residents (Law 25), the person in charge of the protection of personal information is Joakim Berg (joakimberg1990@gmail.com); you also have the right to data portability and to be informed of transfers outside Québec, which are assessed for adequate protection. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d’accès à l’information du Québec.
Australia (Privacy Act 1988 and Australian Consumer Law)
We handle personal information in line with the Australian Privacy Principles (APPs). You may request access to and correction of your information. Overseas recipients are the providers listed in section 5, located mainly in the EEA, the UK and the United States. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au). Your rights under the Australian Consumer Law are described in our Terms of Sale.
New Zealand (Privacy Act 2020)
You have the right to access and request correction of your personal information (Information Privacy Principles 6 and 7). When we disclose information overseas we do so in line with IPP 12. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).
Brazil (LGPD)
Under Lei Geral de Proteção de Dados (Law 13.709/2018) you have the rights in Article 18: confirmation of processing, access, correction, anonymisation/blocking/deletion of unnecessary data, portability, deletion of data processed on consent, information about sharing, information about the possibility of refusing consent and its consequences, and revocation of consent. Our legal bases are contract performance, legal obligation, legitimate interest and consent. International transfers rely on Article 33 mechanisms (including standard contractual clauses). Our contact for data subjects (encarregado function) is joakimberg1990@gmail.com. You may complain to the ANPD.
Japan (APPI)
We handle personal information under the Act on the Protection of Personal Information. We use it only for the purposes in section 3 and do not provide it to third parties without consent except as permitted by law (including entrustment to the service providers in section 5). Foreign providers are located mainly in the EEA (which Japan recognises as having an equivalent system), the UK and the US; details of their data-protection systems are available on request. You may request disclosure, correction, suspension of use or deletion, and records of third-party provision. Contact: joakimberg1990@gmail.com.
South Korea (PIPA)
Under the Personal Information Protection Act: items collected and purposes are in sections 2–3; retention is in section 7; data is destroyed by secure deletion when no longer needed. Personal information is entrusted to and transferred abroad to the providers in section 5 (countries: mainly the US, EEA and UK; timing: at purchase or contact; method: encrypted network transmission; retention: per section 7). You may refuse consent to overseas transfer, but we then may be unable to complete a purchase. You may request access, correction, deletion and suspension of processing. Privacy officer: Joakim Berg, joakimberg1990@gmail.com. You may contact the Personal Information Protection Commission (PIPC) or the Personal Information Dispute Mediation Committee.
Singapore (PDPA)
We collect, use and disclose personal data with your consent or as otherwise permitted under the Personal Data Protection Act 2012, for the purposes in section 3. You may request access and correction and withdraw consent with reasonable notice. Overseas transfers are protected by contractual safeguards comparable to the PDPA. Data protection officer contact: joakimberg1990@gmail.com. You may contact the Personal Data Protection Commission (pdpc.gov.sg).
India (Digital Personal Data Protection Act 2023)
We process digital personal data for the lawful purposes stated in this notice on the basis of your consent or for legitimate uses permitted by the DPDP Act (such as a purchase you voluntarily initiate). You have the rights to access a summary of your data and its processing, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights in case of death or incapacity. You may withdraw consent as easily as you gave it. Grievance contact: joakimberg1990@gmail.com. If your grievance is not resolved you may approach the Data Protection Board of India.
China (Personal Information Protection Law – PIPL)
This section applies when we process personal information of natural persons located in the People’s Republic of China (mainland) for the purpose of providing products to them or analysing their behaviour (PIPL Article 3).
Personal information handler
The handler is Joakim Berg, trading as JB Automations, Norway. Contact for all PIPL requests: joakimberg1990@gmail.com (subject line “PIPL request”). Where required by PIPL Article 53, we will designate a representative or dedicated body within China and publish its name and contact details here.
Legal basis and consent
We process your personal information (a) where necessary to conclude or perform a contract to which you are a party, i.e. delivering a product you buy (PIPL Art. 13(2)); (b) where necessary to fulfil legal obligations such as tax and accounting (Art. 13(3)); and (c) on the basis of your consent for anything else, such as joining our email list (Art. 13(1)). Consent is given voluntarily, explicitly and with full knowledge, and you may withdraw it at any time by emailing us; withdrawal does not affect processing already carried out. We will ask for new consent if the purpose, method or categories of processing change.
Separate consent for cross-border transfer
Our business and our service providers (section 5) are located outside mainland China, mainly in Norway/the EEA, the UK and the United States. Your personal information will therefore be transferred outside China. Before such transfer we inform you of each overseas recipient’s name and contact method (section 5), the purposes and methods of processing, the categories of personal information (section 2), and how you can exercise your rights against the overseas recipient (this section), and we obtain your separate consent (PIPL Art. 39). We transfer data only through a mechanism permitted by PIPL Article 38 (such as the standard contract for outbound transfer filed with the Cyberspace Administration of China, or an applicable exemption, e.g. where the transfer is necessary to perform a contract with you) and conduct a personal information protection impact assessment where required (Art. 55). If you do not give separate consent, we may be unable to complete a sale to you.
Sensitive personal information
We do not intentionally collect sensitive personal information (such as biometrics, religious beliefs, specific identity, medical health, financial accounts, location tracking, or information of minors under 14). Payment card data is processed by the payment providers, not by us. If processing of sensitive personal information ever becomes necessary, we will explain the necessity and impact and obtain your separate consent (Art. 28–29); for minors under 14, the separate consent of a parent or guardian (Art. 31).
Your rights under PIPL
You have the right to know and decide on the processing of your personal information, to restrict or refuse processing (Art. 44), to access and copy it (Art. 45), to request transfer to another handler where conditions set by the CAC are met (Art. 45), to correct and supplement it (Art. 46), to deletion (Art. 47), to request an explanation of our processing rules (Art. 48), and, for a deceased person’s close relatives, to exercise certain rights (Art. 49). We do not use automated decision-making that significantly affects your rights. We respond within 15 working days, or explain why we cannot. If we refuse a request, you may file a lawsuit with a People’s Court (Art. 50).
Retention and security
Retention and security are described in sections 7–8. Where a personal information security incident occurs, we will take remedial measures and notify the relevant authorities and affected individuals as required by PIPL Article 57.
E-commerce and consumer protection in China
When we sell to consumers in mainland China we will also comply with the E-Commerce Law of the PRC (including clear disclosure of our identity and contact information, accurate product information and the protection of users’ personal information) and the Law on the Protection of Consumer Rights and Interests. Under that law the seven-day no-reason return right does not apply to digital products downloaded online (Art. 25), which you confirm at checkout; your other statutory rights, including remedies for defective or misdescribed products, are not affected.
South Africa (POPIA)
Under the Protection of Personal Information Act 2013 you may request confirmation of and access to your personal information, request correction or deletion, object to processing, and object to direct marketing. The responsible party and information officer is Joakim Berg (joakimberg1990@gmail.com). Cross-border transfers comply with section 72 (contractual safeguards or adequate law). You may complain to the Information Regulator (inforegulator.org.za).
Other countries
If you live in a country not listed above (for example Switzerland – revFADP, Türkiye – KVKK, the UAE, Saudi Arabia, Thailand, the Philippines, Indonesia, Vietnam, Malaysia, Mexico, Argentina, Chile, Colombia, Israel, Kenya or Nigeria), you have at least the rights described in section 10, plus any additional rights under your local law. We will honour them.
12. Children
Our site and products are intended for adults. We do not knowingly collect personal data from children under 13 (COPPA, USA), under 16 (GDPR – Norway sets 13 for information society services; other EEA countries 13–16), under 14 (China), under 18 (India, without verifiable parental consent) or below the age of digital consent in your country. If you believe a child has given us data, contact us and we will delete it.
13. Changes
We may update this policy. The date below shows the latest version; material changes will be highlighted on this page and, where required, notified to you by email or require new consent.
14. Contact
Joakim Berg, JB Automations, Norway – joakimberg1990@gmail.com.
Last updated: 2026-10-29