Privacy

Who is responsible?

Temne is provided by Vör Labs AS, Lørenskog, Norway, organization number 938 324 743. Contact: hei@temne.no.

The organization inviting you is the controller for event participation data. Vör Labs AS processes that data on the organization’s behalf under an agreement. Also read the event’s privacy information for the organizer’s contact details and choices.

Vör Labs AS is the controller for its own processing relating to this website and enquiries to us. We process security logs to protect the service and prevent abuse, and ordinary business enquiries to respond and follow up on contact. The basis is our legitimate interests under GDPR Article 6(1)(f).

Vör Labs AS is the controller for the optional dietary profile that remembers information across events. This processing relies on your consent under GDPR Article 6(1)(a) and your explicit consent to health data under Article 9(2)(a). You can refuse or withdraw this consent without losing ordinary participation. Sharing with a particular event requires a separate choice and consent for that event.

What do we use the information for?

Temne uses names, email addresses, organization membership and sign-in information to provide the right access and send invitations. Your address may come from the organizer or from you. You provide your reply, any companions and messages to the organizer.

Food and allergy information is optional and can be sensitive. Sharing it for an event’s catering requires separate consent. You can attend without providing it. A dietary profile remembering your choices for future invitations requires separate consent; you choose what to share with each event.

Technical information and access logs support operation, security and evidence of access. The organizer must explain the basis for its processing in the event’s privacy information.

Who can receive the information?

Organizers and administrators have access according to their roles. The kitchen can receive a list of dietary information shared for that event. The organizer is responsible for downloaded or printed copies.

Temne uses Amazon Web Services (AWS) for the application, data storage and email. Application storage and email processing are configured in Frankfurt (eu-central-1). CloudFront delivers the application through a global network.

Google, through Firebase Hosting, is a processor for Vör’s own public website temne.no. The website is delivered through a global content delivery network (CDN). A hosting region does not guarantee that all connection information or email is processed only in the EEA.

Enquiries to hei@temne.no are received through AWS’s email service in Frankfurt (eu-central-1). We use Cloudflare for DNS, which connects our domain names to the services.

If your organization offers Microsoft sign-in, Microsoft and your organization process the sign-in. Temne receives identity and organization information needed for access.

Email from Temne

We send sign-in links you request, plus invitations, reminders, changes and other service notices triggered by your organization. These are not marketing campaigns or purchased address lists. Dietary information and free-text food notes are not included in these emails.

Email addresses are held in accounts, invitations and sending jobs. The email service and the recipient’s email provider process the message. Sending references are kept for 30 days. To prevent further failed sends, one-way address fingerprints and bounce or complaint reasons are kept for 365 days from the latest feedback. These fingerprints remain personal data, not anonymous data.

How long is information kept?

• Events: guest invitations and replies, participant lists and free text in event requests are normally deleted 60 days after the event ends. The event title, dates, organizer information and participant counts are retained. The organization can choose 30–180 days; the actual period should be shown at registration.
• Optional dietary profile: used for up to 365 days from consent. After that it is not filled in until consent is renewed. You can remove the profile on My page.
• Logs: audit logs and records of access to sensitive information are kept for 180 days. Technical API request logs and application operational logs are configured for 14 days.
• Sending queues: jobs may remain queued for up to four days; failed-job queues and feedback for up to 14 days. These may include email addresses.

Removing event dietary information also hides your note to the organizer. The note is deleted with the event’s data. This does not change a separate dietary profile.

• Accounts: kept while in use. Request deletion at hei@temne.no; we complete account deletion in active systems within 14 days of the request. Your sign-in sessions are removed. For events that have not yet been purged, a “deleted guest” entry is retained so the participant count is preserved. Identifying information and dietary information are removed from that entry. If you are the organization’s only administrator, we ask the organization to name another administrator. Account deletion is completed within 14 days regardless.
• Enquiries: deleted no later than 90 days after the last contact. Raw incoming email is kept for 30 days; quarantined email for 7 days.
• Consent evidence: minimal evidence is kept while the consent or related data is active, then for 180 days after deletion of the related data, withdrawal or expiry of consent.

Backups: the database has a rolling 35-day point-in-time recovery window. After a file is deleted or replaced, older file versions are deleted after 30 days. This is not a general 30-day limit for files still in use. Prior deletions and withdrawals must be reapplied before restored data is used again. Deletion from active systems therefore does not mean all recovery copies disappear at the same time.

Website and cookies

This public website sets no cookies. We have not added analytics or advertising-tracking tools to the website. Google receives technical connection information when delivering the website.

The application itself uses necessary cookies for sign-in and request protection. This is separate from the public website. Sign-in session limits are not account-deletion periods.

Google states that Firebase Hosting uses IP addresses from incoming requests to detect abuse and analyse service usage, and keeps IP data for “a few months”. See Google’s privacy information for Firebase Hosting.

Your choices and rights

You can change your reply and withdraw event dietary consent on your reply page. You can remove a separate dietary profile on My page. Withdrawing dietary consent does not cancel ordinary participation.

Contact the organizer about event data. Contact hei@temne.no about this website, enquiries to us or your separate profile. You can request access, correction, deletion and other privacy rights where applicable. You can also complain to the Norwegian Data Protection Authority.

We date this text when it changes. Information specific to an event is provided at registration.