Privacy policy

This privacy policy explains how Wonder Technologies AS (org. no. 929 267 834 VAT) processes personal data in connection with the website homepagehero.ai and our services (WordPress websites, WooCommerce stores, hosting, operations, maintenance, support, and add-on services). The document primarily covers the processing of personal data we carry out as data controller, and also describes our role as data processor when we process data on behalf of customers.

• Data controller: Wonder Technologies AS
• Address: Oreliveien 8, 0580 Oslo, Norway
• Contact: hello@homepagehero.ai (we may also communicate with customers by email and/or Slack where this is agreed as a customer channel)

1. Roles: data controller and data processor

1.1 When we are the data controller

We are the data controller when we determine the purpose and the means of the processing, for example when:

• handling enquiries, leads, and the customer relationship
• preparing contracts/quotes, invoicing, and payment follow-up
• operating homepagehero.ai (including security, troubleshooting, and statistics)

1.2 When we are the data processor for the customer

When we deliver operations, hosting, maintenance, or support and are given access to the customer's WordPress or WooCommerce environment, we may process personal data on the customer's behalf (for example visitors' form data, IP addresses, order data, users in the WordPress admin, and so on). In such cases the customer is normally the data controller, and we are the data processor.

Where needed, a separate data processing agreement (DPA) is entered into, see our Terms.

2. What personal data we may process

Depending on the situation, we may process:

2.1 Customer and contact data

• name, email, phone
• company name, organisation number, address
• communication (email, Slack, support enquiries, meetings, notes)

2.2 Agreement and transaction data

• data relating to quotes, orders, deliveries, and follow-up
• invoicing data and payment status
• any references to the chosen billing cycle (monthly/quarterly/annual)

2.3 Technical logs and security data

• IP address, device/browser data, timestamps, event logs
• login and access-related metadata (for example during troubleshooting, security measures, and incident handling)

2.4 Data in the customer's solution (when we are the data processor)

This may include personal data that the customer collects via:

• contact forms, newsletter forms, chat
• online store (order/customer data)
• cookies and analytics tools the customer has chosen to enable
• user profiles/roles in WordPress

We do not ask for, and do not wish to process, special categories of personal data (sensitive data) unless this is strictly necessary, agreed, and there is a valid legal basis.

3. How we collect data

We collect personal data when:

• you contact us via the website, email, or other channels
• you place an order or enter into an agreement with us
• you use homepagehero.ai (technical data/cookies)
• we are given access to the customer's systems to deliver agreed services (as data processor)

4. Purposes and legal basis

We process personal data for the following purposes:

4.1 Delivering services and fulfilling the agreement

Purpose: delivery, support, operations, maintenance, changes, and administration of the customer relationship.
Legal basis: GDPR art. 6(1)(b) (contract).

4.2 Invoicing, accounting, and payment follow-up

Purpose: invoices, reminders/debt collection, documentation, bookkeeping.
Legal basis: GDPR art. 6(1)(c) (legal obligation) and/or art. 6(1)(f) (legitimate interest).

4.3 Security, troubleshooting, and prevention of misuse

Purpose: access management, logging, operational security, detecting unwanted activity and vulnerabilities.
Legal basis: GDPR art. 6(1)(f) (legitimate interest).

4.4 Marketing (where relevant)

Purpose: sending relevant updates and offers.
Legal basis: GDPR art. 6(1)(a) (consent) where consent is required, or art. 6(1)(f) for certain forms of B2B communication where this is permitted.

You can opt out of marketing at any time by contacting us.

5. Sharing of personal data and recipients

We do not share personal data unnecessarily. Where needed, data may be shared with:

5.1 Subcontractors (data processors)

We may use subcontractors to deliver services (for example hosting, email delivery, domain/email, operations/monitoring, and customer communication). Examples of subcontractors are listed in our Terms.

5.2 Debt collection and payment follow-up

In the event of non-payment, data may be shared with providers for reminders and debt collection (for example Kravia), see our Terms.

5.3 Authorities

We may disclose data where we are legally obliged to do so.

6. Transfer to countries outside the EU/EEA

We aim for processing and storage to take place within the EU/EEA where this is practically possible. In some cases, third-party providers or technical metadata may involve transfer outside the EU/EEA.

If a transfer takes place, we ensure a valid transfer mechanism (for example the EU Standard Contractual Clauses) and the necessary security measures.

7. Storage and deletion (retention period)

We store personal data for as long as it is necessary for the purpose:

• Customer/agreement data: for as long as the customer relationship lasts, and thereafter for the period we are required to retain documentation under bookkeeping and accounting rules (typically 5 years).
• Support and operational logs: stored for as long as necessary for operations, troubleshooting, and security, and deleted or anonymised on an ongoing basis once the purpose is fulfilled.
• Data we process on behalf of the customer (data processor): normally deleted or anonymised within 30 days after the agreement ends, unless otherwise agreed or unless the law requires longer storage.

8. Cookies

homepagehero.ai may use cookies for:

• necessary functionality
• statistics and improvement
• security measures

Where consent is required, it is obtained via a cookie banner. You can also manage cookies through your browser settings.

9. Your rights

You have rights under the GDPR, including the right to:

• access the personal data we hold about you
• rectify inaccurate data
• erasure (where the conditions are met)
• restriction of processing
• object to processing based on legitimate interest
• data portability (when the legal basis is consent or contract and the processing is automated)
• lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet)

To exercise your rights, contact us at hello@homepagehero.ai. We normally respond within 30 days.

10. Security

We use technical and organisational measures to protect personal data, including:

• access control and least-privilege access
• security updates and monitoring (where this is part of the agreed operations and maintenance)
• logging and procedures for handling security incidents

In the event of a personal data breach, we handle the incident in accordance with applicable regulations. Where we are the data processor, we notify the customer without undue delay.

11. Changes to this privacy policy

We may update this privacy policy when needed. The updated version is published on our website, and significant changes may be notified directly to customers.

12. Contact