Privacy policy
How this website handles personal data, what is measured, and how to exercise your rights under the GDPR.
Who is responsible
The controller for the processing described here is Fusionki AS. Questions, access requests and erasure requests go to privacy@fusionki.no.
What is collected, and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Contact form: name, organisation, work email, optional phone, message | To answer your enquiry | Art. 6(1)(b) — steps prior to a contract, or 6(1)(f) legitimate interest in replying | 730 days |
| A salted, irreversible hash of your IP address | Rate limiting and abuse prevention on the form | Art. 6(1)(f) — legitimate interest in keeping the service available | 24 hours (rate limit), stored with the message otherwise |
| Aggregate counters: page and section views, dwell time, device family, browser family, country, language, referring host | To see which parts of the site are useful and improve them | Art. 6(1)(f) — legitimate interest in understanding use of our own site | 90 days |
How the measurement works
Counting begins on your first request, because it does not identify you and does not store anything on your device. Specifically:
- No cookie, no
localStorage, no fingerprint, and no persistent identifier is created. - Rows are keyed by an HMAC of your IP address, device family and a secret that rotates every 24 hours. Yesterday's rows cannot be joined to today's, so no history of one person can be reconstructed.
- Your raw IP address and your full user-agent string are never written to the database. Only the family — for example "Chrome", "Android", "mobile" — is stored.
- Only the referring host is stored, never the full referring URL.
- There is no per-event log. The tables hold counters that are updated in place, and reporting reads aggregate views rather than the underlying rows.
DNTandSec-GPCsignals are honoured: if your browser sends either, nothing at all is recorded.
Anything beyond this counting — for example an embedded third-party analytics or advertising service — would require your consent, and is requested through the banner. At present no such service is in use.
Cookies
Two cookies may be set, both strictly necessary and neither used for tracking:
| Name | Purpose | Lifetime |
|---|---|---|
fk_lang | Remembers the language you chose | 180 days |
fk_csrf | Protects the contact form against cross-site request forgery | Until the browser is closed |
Full detail is on the Cookie settings page.
How contact data is stored
Name, organisation, email, phone and message are encrypted at rest with AES-256-GCM before they reach the database, with the key held outside the database. The email address additionally carries a keyed hash so we can tell whether an address has written before without the column being readable. Everything travels over TLS.
Who else sees it
The data is processed on our own infrastructure. It is not sold, and it is not shared for advertising. Where a hosting or email provider processes data on our behalf, they do so under a data processing agreement and only on our instructions.
Your rights
- Access — a copy of what is held about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion of your enquiry and any data attached to it.
- Restriction and objection — including objection to processing based on legitimate interest.
- Portability — your data in a machine-readable form.
- Complaint — to your national supervisory authority.
Write to privacy@fusionki.no. We answer within 30 days.
Changes
This page is versioned with the site. Material changes will be noted here with a date. Last updated 12 November 2026.