Privacy policy for Bestått.no

Bestått.no takes privacy seriously. This privacy policy explains how we collect, use and protect personal data when you use our app and website for online theory tests.

1. Who we are

Bestått.no offers digital theory tests and practice exercises for people who need to pass the theory test. The service is available to users of all ages.

Data controller: Timx AS, org. no. 916 942 095

Email: [email protected]

Website: https://www.bestått.no

2. What personal data we collect

We only collect personal data that is necessary to deliver and improve the service.

This may include:

• Name or username
• Email address
• Phone number, if applicable (if used for login or notifications)
• User settings and progress in theory tests
• Technical information such as IP address, browser type and device type
• If you accept marketing cookies: information about your visit that is shared with Meta (see section 6)

We do not collect sensitive personal data.

3. How we use the data

The personal data is used for the following purposes:

• To provide access to the app and the features in Bestått.no
• To store progress, results and practice history
• To administer user accounts
• To improve content, functionality and user experience
• To comply with legal obligations
• To create statistics on how the site is used (only with consent)
• To measure how well our ads work and show you relevant ads on Meta (only with consent)

We do not use personal data for unwanted marketing.

4. Legal basis (GDPR)

The processing of personal data takes place on the following grounds:

Contract – in order to deliver the service you have registered for

Legitimate interest – to improve and secure the service

Consent – for statistics and marketing cookies, and for sharing data with Meta. You can withdraw your consent at any time using "Cookie settings" at the bottom of the page.

5. Cookies

We use necessary cookies to make the service work. We use statistics and marketing cookies only if you accept them. You can change your choice at any time using "Cookie settings" at the bottom of the page. Our cookie page lists the cookies we use and how long they are stored.

You can manage and delete cookies yourself via the settings in your browser.

6. Sharing of data

We never sell personal data. We share it only in these cases:

• With providers who run the service for us: hosting, security (Cloudflare) and payment (Nets). They follow our instructions, under a data processing agreement in line with GDPR.
• With Google, if you have accepted statistics cookies. Google Analytics processes usage data on our behalf.
• With Meta, if you have accepted marketing cookies. See below.
• When the law requires it.

Ad measurement with Meta

If you accept marketing cookies, we share data with Meta Platforms Ireland Ltd. (Facebook and Instagram). This happens in two ways:

• The Meta pixel in your browser tells Meta which pages you visit, and when you sign up or make a purchase. It uses cookies. See our cookie page.
• Our server tells Meta when you sign up or make a purchase.

Our server then sends:

• that you signed up or made a purchase, and when
• the amount and currency for purchases
• the address of the page you were on
• your IP address and which browser you use
• the ID from Meta's cookies (_fbp and _fbc), if they exist
• an encoded version of your user ID, if you are logged in

We do not send your name, email address or phone number to Meta.

Meta can link this data to a Facebook or Instagram account. We and Meta share responsibility for collecting and sending the data (joint controllers). What Meta does with the data after that is Meta's responsibility alone. It is described in Meta's privacy policy: https://www.facebook.com/privacy/policy

If you decline or withdraw your consent, neither your browser nor our server sends anything to Meta.

Transfers outside the EEA

Google and Meta may transfer data to the USA. The transfer is based on the EU Commission's approval of the EU–US Data Privacy Framework, and otherwise on the EU's standard contractual clauses for transferring personal data.

7. Storage and deletion

Personal data is only stored for as long as is necessary for the purposes for which it was collected, or as long as the law requires.

You can at any time request to have your account and associated data deleted.

8. Your rights

You have the right to:

• Get access to what data we have about you
• Request correction of incorrect data
• Request deletion of data
• Request restriction of processing
• Withdraw consent

Inquiries can be sent to [email protected].

9. Children and youth

Bestått.no can be used by people of all ages. We do not knowingly collect personal data from children beyond what is necessary to deliver the service. If you are a guardian and believe we have stored data in violation of the regulations, please contact us.

10. Security

We use technical and organizational measures to protect personal data against unauthorized access, loss or misuse.

11. Changes to the privacy policy

This privacy policy may be updated as needed. Significant changes will be announced on the website.