Torgplass is operated by Margareto Software AS (org. no. 931 338 811), Naustanvegen 10, 7560 Vikhammer, Norway. We are the data controller for the personal data described here. Contact: hei@torgplass.no.

You can read every market page without giving us anything. Our server keeps ordinary technical logs (IP address, time, page requested) to keep the service running and secure; IP addresses are anonymized after 90 days.

We would like to know which market pages get read, so we use Google Analytics — but only if you allow it. Until you do, no analytics script is loaded and no request is sent to Google. Decline, and the directory works exactly as before.

If you allow it, Google Analytics sets a cookie that recognizes your browser across visits, and registers which pages you open, roughly where in the country you are, and what kind of device you use. We never send your name, email or anything else that identifies you. We do not use the data for advertising, and advertising features are switched off. The legal basis is your consent, GDPR article 6(1)(a) together with the Norwegian Electronic Communications Act § 3-15. Google Ireland Limited is our processor for this, and the data is deleted after 14 months.

The claim form collects your name, role, email, phone number, the organization number, and anything you write in the message field. We use it for one purpose: to check that the request really comes from the organizer and to reply to you. The legal basis is GDPR article 6(1)(b), steps taken at your request before entering a contract.

We look the organization number up in Enhetsregisteret, the public Norwegian company registry. That lookup sends only the number, never your personal details.

Rejected or abandoned requests are deleted after 12 months. If the claim is granted, the information becomes part of your organizer account.

The correction form on the market pages collects what you are correcting, anything you write in the message field, whether you are a visitor, an exhibitor or the organizer of that market, your e-mail address, and any photographs you attach (see the next section). No IP address, no browser details, no name. The legal basis is legitimate interest in keeping a public listing accurate — GDPR article 6(1)(f).

We send one e-mail to the address, with a link. Click it and we know the address is yours, and record that; ignore it and we still read the correction. Nothing else is ever sent there.

The address is deleted when the case is closed. What we keep is the correction itself — never who wrote, and never anything we worked out about them.

The correction form takes up to ten photographs. They go into a private area nobody can read — not the sender, not another organizer, nobody with an account. One of us looks at each one before it is published, and most of what arrives is never published at all.

A photograph of a market usually has people in it, and that is personal data. We go by the distinction Norwegian law already makes: a picture of the crowd at a public market, where the event and not the individual is the subject, may be published; a picture where one identifiable person is the subject needs that person's consent, which we do not have. So we ask senders for photographs where no individual is the subject, and the reviewer checks it again before publishing. The legal basis is legitimate interest in showing what a public market looks like — GDPR article 6(1)(f) — and the balancing is what that rule is: we publish the event, not the person.

If you appear in a photograph on these pages and would rather not, write to us and we take it down. You do not have to explain why.

Every published photograph is re-encoded first, which removes the EXIF data the camera wrote into the file — GPS coordinates, camera serial number, timestamps. Those are not ours to publish.

Photographs we do not publish are deleted when the case is closed, and in any event after 90 days. That includes the working copies held by whoever reviews them: they are deleted in the same operation, and they are stripped of EXIF the moment they are made. The correction itself we keep longer — it is reviewed after twelve months. A photograph carries more about more people than a line of text does.

Information about the markets themselves is collected from public sources and may contain errors. A named contact person is only shown when the organizer has asked us to show it.

A market page says one of two things about where its facts come from: we checked them against the organizer's own page on a given day, or somebody sent us a correction that we checked against that page before publishing it. No page presents the details as the organizer's own word. We have no way to establish who a sender is, so we do not say that we have.

On a market that its organizer has claimed, the page can show the market's exhibitors: display name, a description of what they sell, product categories and up to four product photos, plus a website or Instagram link if they added one. Never email, phone, address or organization number.

This happens only with the exhibitor's explicit consent (GDPR article 6(1)(a)), given on their own page in the booking app. The photos were collected so the organizer could assess the application; showing them publicly is a new purpose, which is why we ask separately. Recipients are the organizer, everyone who reads this site, and everyone who sees the organizer's own website or information screens where the same list is embedded.

The entry stays for as long as the consent stands and the exhibitor holds an approved application at that market. Withdrawing is the same switch, in the same place, and takes effect on every surface within minutes.

We write to organisers of markets listed in the directory, offering them the chance to take over their listing. This section covers that contact.

• Purpose: To let the organiser know that the market is listed on torgplass.no, and to offer the organiser the chance to take over the listing and keep it up to date.
• Legal basis: Legitimate interest, GDPR article 6(1)(f). The balancing assessment is documented and available on request.
• Source: The e-mail address is taken from openly available sources online. For most organisers that is the organisation's own website, where it has published the address as its contact address. For others it is another public listing — a market calendar, a regional tourism site or a local newspaper. Every e-mail we send states the source for that particular address, or says that we did not record which page it was on.
• What we keep: The organisation's email address, organisation name, which markets it concerns, the date and subject of each email we have sent, and whether the organisation replied or asked not to hear more. No open or click tracking.
• We write to a mailbox the organisation itself uses as the contact address for the market — post@ or kontakt@ on the organisation's own domain, or an address in the market's or the organisation's name at a free e-mail provider. We never write to a named individual, and we send at most two e-mails about the same matter within twelve months.
• Retention: The contact log is deleted 12 months after the last email. The list of addresses that have said no is kept without time limit, as the safeguard against contacting the address again.
• How to object: Click the link at the bottom of the email, or reply with “no thanks”. You will not hear from us again. You can also write to post@torgplass.no.

We have two newsletters: one for visitors, with the markets in a county the coming month, and one for exhibitors, with markets that open for stand applications. This section covers both.

• Legal basis: Consent, GDPR article 6(1)(a). We use double opt-in: the address gets an e-mail with a link, and nothing is sent until the link is clicked.
• What we keep: The e-mail address, the lists you chose, the county (for visitors), language, when you subscribed and clicked the link, where the form was, and which version of the consent text you saw. No IP address, no browser details, no name. No open or click tracking.
• Frequency: One e-mail a month per list, from post@torgplass.no.
• Delivery: SparkPost (Bird), our processor, through its EU endpoint. See the list of providers below.
• Retention: For as long as you are subscribed. When you unsubscribe we keep only the address hash and the time for 30 days as the record that you did, then delete the entry.
• How to withdraw: Click “unsubscribe” at the bottom of any issue — one click, no login. You can also write to post@torgplass.no.

Google Cloud (Firebase), EU region, hosts the site and the database. SparkPost sends our email. Stripe handles payments for markets that have opened for bookings. Google Ireland Limited provides the statistics described above, and only once you have allowed them. Each has a data processing agreement with us, and data stays within the EU/EEA.

You may ask for access to the data we hold about you, correction of what is wrong, deletion, or restriction of processing, and you may object to our processing. Write to hei@torgplass.no and we answer within 30 days. You may also complain to Datatilsynet, the Norwegian Data Protection Authority.

We update this page when what we do changes. The version date at the top tells you when it was last revised.