Last updated: August 2026
Our Commitment to GDPR
Tea House Holland is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven). This page provides detailed information about your rights and how we process your data.
Data Controller Information
Tea House Holland acts as the data controller for personal data collected through our website and services.
Contact details:
Tea House Holland
Storgata 42
0182 Oslo
Norway
Email: [email protected]
Your Rights Under GDPR
As a data subject, you have the following rights:
Right of Access (Article 15)
You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data along with information about the processing. You may request a copy of your personal data free of charge.
Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.
Right to Erasure (Article 17)
Also known as the "right to be forgotten," you may request the deletion of your personal data when it is no longer necessary for the purpose it was collected, when you withdraw consent, when you object to processing, or when the data was unlawfully processed.
Right to Restriction of Processing (Article 18)
You may request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing pending verification of our legitimate grounds.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance, where processing is based on consent or contract and carried out by automated means.
Right to Object (Article 21)
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing for that purpose.
Right Not to Be Subject to Automated Decision-Making (Article 22)
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
How to Exercise Your Rights
To exercise any of your GDPR rights, please contact us at [email protected] with the following information:
- Your full name and contact details
- A description of your request
- Any information that will help us locate your data
We will respond to your request within 30 days. In complex cases, this period may be extended by two further months, and we will inform you of any such extension.
Verification of Identity
To protect your privacy and security, we may need to verify your identity before processing your request. We may ask for additional information to confirm that you are the data subject or authorised to act on their behalf.
Legal Bases for Processing
We process personal data under the following legal bases:
- Contract (Article 6(1)(b)): Processing necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract
- Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests, provided those interests do not override your fundamental rights and freedoms
- Legal Obligation (Article 6(1)(c)): Processing necessary to comply with legal obligations to which we are subject
- Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for specific purposes
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
- Customer account data: Duration of the customer relationship plus 3 years
- Transaction records: 7 years (accounting and tax requirements)
- Marketing preferences: Until consent is withdrawn
- Website analytics: 26 months
International Data Transfers
When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions for countries with adequate data protection levels
- Binding Corporate Rules where applicable
Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, and regular security assessments.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours. If the breach is likely to result in a high risk to you, we will also notify you directly.
Supervisory Authority
You have the right to lodge a complaint with the Norwegian Data Protection Authority:
Datatilsynet
Postboks 458 Sentrum
0105 Oslo
Norway
Website: datatilsynet.no
Updates to This Information
We may update this GDPR information page from time to time. Significant changes will be communicated through our website.