Privacy Policy

Data controller

The data controller for personal information on gaari.no is Kjersti V. Therkildsen, who runs Gåri as a personal project from Bergen, Norway. Contact: post@gaari.no

About Gåri

Gåri is a free event aggregator for Bergen. We automatically collect information about public events from local organizers and display them in one place. We collect minimal personal data during normal use — no account or login is required.

Analytics — no cookies, no personal data

We use Umami Analytics to understand traffic patterns. Umami places no cookies, does not collect IP addresses, and stores no personally identifiable information. No consent is required. Data is processed within the EU. Learn more at umami.is/privacy.

Click log for organisers

When you click an event card we log an anonymous click signal: the event slug, venue name, which page the click happened on, and whether the card was shown as Featured or in its natural sort position. This is used only to give organisers aggregated reports on how many people discovered their events. No personally identifiable data is stored — no IP, no cookies, no user ID.

Form data and newsletter

Gåri offers four voluntary forms and a newsletter. The table below shows what data is stored, why, the legal basis under GDPR Art. 6, and for how long.

• Submit an event
  Data: Title, date, venue, description and email (optional).
  Purpose: Process the submission and notify about publication/rejection.
  Legal basis: Contract / request from the data subject (Art. 6(1)(b)).
  Retention: The email is deleted when the submission is published or rejected.
• Opt-out request
  Data: Organization name, domain, email, reason.
  Purpose: Document that we have stopped collecting from a source.
  Legal basis: Legitimate interest (Art. 6(1)(f)) — to keep a record of opt-outs.
  Retention: Kept as long as the opt-out is active. Deleted within 6 months after the opt-out is withdrawn in writing.
• Correction suggestion
  Data: Event ID and your correction. Email optional.
  Purpose: Correct errors in event data.
  Legal basis: Legitimate interest (Art. 6(1)(f)) — data quality.
  Retention: Deleted once the correction has been processed.
• Organizer enquiry (B2B)
  Data: Name, organization, email, message.
  Purpose: Respond to enquiries about marketing and partnerships.
  Legal basis: Pre-contractual steps (Art. 6(1)(b)) / legitimate interest (Art. 6(1)(f)).
  Retention: 2 years after last contact. Longer if it leads to a customer relationship (see "Paid promotion" below).
• Newsletter
  Data: Email address + optional preferences (audience, categories, neighbourhood, price, language).
  Purpose: Send a weekly overview of events in Bergen.
  Legal basis: Consent (Art. 6(1)(a)) — given by active sign-up on the site. Can be withdrawn at any time via the unsubscribe link in each email.
  Retention: For as long as you are subscribed. Deleted from our systems and from MailerLite within 30 days of unsubscribing.

Paid promotion: If an organizer pays for placed visibility ("Featured"), we store the contact email and a reference to the payment in Stripe. Invoice data is retained for 5 years as required by the Norwegian Bookkeeping Act § 13. Legal basis: contract (Art. 6(1)(b)) + legal obligation (Art. 6(1)(c)).

Cookies

Gåri uses no tracking, analytics or marketing cookies for regular visitors. The only cookie placed is an admin session cookie — only on /admin pages for logged-in administrators, never for regular visitors. The Umami analytics service also places no cookies. For the same reason, we do not need a consent banner.

Data processors

These services may process personal data on behalf of Gåri:

• Supabase — database host (EU region). Storage of form data. supabase.com/privacy
• Vercel — hosting and CDN. Standard server logs (path, status, user-agent, IP) are kept for debugging according to Vercel's retention policy. vercel.com/legal/privacy-policy
• Umami Analytics — privacy-friendly analytics, no cookies, no IP. umami.is/privacy
• MailerLite — newsletter delivery. Stores email + preferences. mailerlite.com/legal/privacy-policy
• Resend — transactional email (welcome, confirmation, notifications). resend.com/legal/privacy-policy
• Stripe — payment processing for promoted placements. Stripe handles card data; Gåri stores only a reference and the invoice contact. stripe.com/privacy

Your rights (GDPR)

Under GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure — the "right to be forgotten" (Art. 17)
• Restriction of processing (Art. 18)
• Data portability — receive your data in a structured format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time — applies to the newsletter (Art. 7)

To exercise your rights, contact post@gaari.no. We normally respond within 30 days. You also have the right to file a complaint with the Norwegian Data Protection Authority (datatilsynet.no).