Privacy Policy
This page explains what personal data we collect through tomhaga.no, why we collect it and what choices you have. Last updated 6 November 2026.
Who is responsible
Fotograf Tom Haga AS is the data controller. Org. no. 979 753 403, Hamneveien 15, 4016 Stavanger, Norway. Contact us at tom@tomhaga.no or +47 916 26 030.
What we collect and why
Enquiries
When you use the contact form or email us, we receive your name, your email address and what you write. We use this to answer you and to follow up the enquiry. The legal basis is our legitimate interest in answering you, or steps you ask us to take before a contract. We keep it for as long as we need it to follow up the enquiry and any assignment that comes from it.
Workshop registration and purchases
When you sign up for a workshop or buy from the store, we receive your name, email address, phone number, company name if you give one, and details of the order. Card payments are handled by Stripe, and we do not see your full card number. The legal basis is the contract with you. Accounting records are kept for five years, as Norwegian accounting law requires.
News and updates
If you tick "Sign up for news and updates" in a form, we use your email address to send you news. The legal basis is your consent, and you can withdraw it at any time by contacting us.
Statistics and marketing
If you accept these cookies, we use Google Analytics and Squarespace Analytics to see how the site is used, and Google Ads and Meta Pixel to measure and target marketing, for example on Facebook and Instagram. These tools can process your IP address, online identifiers, the pages you visit and information about your device. The legal basis is your consent.
If you decline or make no choice, these cookies are not set and Meta Pixel sends nothing. Google can still receive a signal without cookies that a page was viewed. This is part of how Google Consent Mode works.
Technical data
To deliver the site, our providers process your IP address and basic information about your browser. Forms are protected against spam by Google reCAPTCHA. The legal basis is our legitimate interest in running a secure website.
Cookies
Your choice is remembered for 30 days, and then we ask again. You can change your choice at any time with the "Cookie Preferences" link at the bottom of the page.
Always on
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| crumb | Squarespace | Security for forms and checkout | Until you close the browser |
| ss_performanceCookiesAllowed, ss_marketingCookiesAllowed | Squarespace | Remembers your cookie choice | 30 days |
| __cf_bm, __cf_ob, cf_clearance | Vimeo (Cloudflare) | Security for the video player | Up to 1 year |
| _GRECAPTCHA | Spam protection on forms | 6 months |
Only if you accept
| Cookie | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga, _ga_99ZV6QQ7W9 | Google Analytics | Statistics about visits | Up to 2 years |
| ss_cvr, ss_cvt | Squarespace Analytics | Statistics about visits | Up to 2 years, and 30 minutes |
| _gcl_au | Google Ads | Measures the effect of ads | 90 days |
| _fbp | Meta | Used to measure and target ads | 90 days |
Who receives data
We use these providers to run the site: Squarespace (website, store, forms and statistics), Stripe (card payments), Google (Analytics, Ads, reCAPTCHA and code libraries), Meta (Pixel), Vimeo (video), Adobe (fonts), Weglot (the Norwegian version of the site), and Cloudflare, Amazon Web Services and Square Refresh (code used by the site).
Some of these companies are based in the USA or transfer data outside the EEA. These transfers rely on safeguards such as the EU-US Data Privacy Framework or the EU's standard contractual clauses. We do not sell your personal data.
Your rights
You can ask for access to your personal data, and ask us to correct or delete it. You can also ask us to limit how we use it, object to our use of it, and ask for a copy to move elsewhere. Where we rely on consent, you can withdraw it at any time. Contact us at tom@tomhaga.no.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority at datatilsynet.no.
Changes
We update this page when we change how we handle personal data. The date at the top shows the latest version.