Privacy Policy

1. Data controller

The service is provided by HEM, a sole proprietorship registered in Norway with organisation number 924 807 342 and business address Folke Bernadottes vei 6, 0862 Oslo. Digital Skademelding (skademeldingbil.no) is the trading name used for the service. HEM is the data controller for personal data collected through the service.

You can reach us at [email protected].

The service is not directed at children under 16. We do not knowingly process personal data about minors.

2. What data do we collect?

We collect the following data:

• Name, date of birth, address, phone number, and email
• Driver's license information
• Vehicle and insurance information
• Photos of vehicle damage
• Accident sketch
• Digital signature
• Payment information (via Stripe)
• Visit data such as which website you came from, which ad you may have clicked on, and your page views in the service.

Some data is obtained from external sources rather than directly from you:

• Vehicle data (make, model, etc.) is retrieved from Statens vegvesen Autosys when looking up a registration number.
• Address data for the accident location is retrieved from Kartverket via address search.

3. Purpose of processing

The data you provide is used to generate an accident report according to the European standard (EA form).

Visit data is used to understand where users come from and how the service is used, so we can improve the user experience. We do not use the data for marketing or other purposes.

4. Legal basis

Processing is based on contract (GDPR Art. 6(1)(b)) — we need the data to deliver the service you have ordered. For visit data, we rely on legitimate interest (GDPR Art. 6(1)(f)) in understanding and improving the service.

5. Storage and deletion

We do not store personal data longer than necessary. Concrete retention periods:

• Signed accident reports are stored for up to 24 months after delivery so you can download them again from your account page. After that, they are anonymized or deleted.
• Unfinished (unsigned) reports are automatically deleted after 90 days of inactivity.
• Payment data is handled by Stripe and is not stored by us beyond a transaction reference.
• Email logs (processing and delivery logs from Resend) are deleted after 12 months.
• Visit data is anonymised or deleted after at most 24 months.

If you want your data deleted earlier, email us at [email protected] and we will remove it.

6. Third parties

We share personal data with the following categories of service providers, only to the extent necessary to deliver the service:

• Payment processing: Stripe
• Email delivery: Resend
• Server hosting: EU/EEA-based provider
• Map services and error monitoring: providers outside the EU/EEA (USA), under Standard Contractual Clauses and the EU-US Data Privacy Framework as transfer basis

We never sell personal data, and do not use it for marketing.

7. Your rights

You have the right to access, rectification, deletion, and data portability. Contact us at [email protected] to exercise your rights.

8. Right to lodge a complaint with Datatilsynet

You have the right to lodge a complaint about our processing of personal data with Datatilsynet (the Norwegian Data Protection Authority). We encourage you to reach out to us first at [email protected] so we can try to resolve the matter directly.

9. Automated decision-making

We make no automated decisions or profiling that have legal or similarly significant effects on you. The accident report is generated mechanically based on the information you enter yourself, but the content is not evaluated or processed by an automated decision-making system.

10. Cookies

We use a necessary session identifier (stored in your browser's sessionStorage) to link your form actions together and improve the user flow. We do not use any third-party tracking or marketing cookies.

11. Contact

For privacy inquiries, contact us at [email protected].