THE BALD GANG SHOP · PRIVACY
Your data.
Ludvig keeps it tidy.
The Duck gets no mailing list. Here is how Grandia AS uses the information needed to run the shop.
Who looks after your data
Grandia AS (organisation no. 928 529 908), Storgata 45, 2000 Lillestrøm, Norway, is the controller for the GrandAmmi – Bald Gang shop. Contact mail@grandammi.com or +47 977 36 135 about your data. This notice covers the merch shop and its orders.
What we use and why
We receive the contact and delivery details you provide, your chosen products, sizes, quantities, payment status and payment references. We use these to take payment, deliver your order, handle cancellations, returns and customer service (GDPR Article 6(1)(b), performing the contract). Name, delivery address and a working email address are necessary to fulfil an order; without them we cannot accept it. We retain required transaction documentation to meet accounting and other legal duties (Article 6(1)(c)). We use limited technical and order information to protect the shop, prevent payment abuse and resolve disputes (Article 6(1)(f), our legitimate interests in secure trading and establishing or defending claims). You may request information about that assessment. Stripe handles card details; full card numbers are not stored by the shop.
Who receives information
Only people and providers who need the information for their task receive it: our authorised order/customer-service staff; website and email hosting providers in the EEA; Stripe for payments and payment security; the courier and any import representative handling your parcel; and accounting or professional advisers where needed for legal documentation or a dispute. International couriers are FedEx, UPS and, for some parcels, DHL. Delivery and import providers receive only the name, address and contact details needed for transport and customs handling, not your card details. The factory receives product, size and quantity information only. It does not receive customer names, delivery addresses or other customer personal information. We do not sell customer information or send newsletters.
International processing
Stripe may process payment information outside the EEA, including in the United States and India. Couriers may process delivery information in the destination country and transit countries needed for international delivery. Depending on the country and provider, safeguards include an applicable adequacy decision, EU standard contractual clauses or approved binding corporate rules. You can contact us for the safeguards applicable to your order and how to obtain a copy. Stripe and the courier also explain their own processing and transfer safeguards in their privacy notices linked below.
How long we keep it
Order information needed to fulfil a pre-order is kept through delivery and any outstanding return, complaint or payment issue. Accounting records are normally kept for five years after the end of the relevant financial year. Information relevant to an ongoing claim is kept until that claim and applicable limitation periods have ended; this may require longer retention. Routine customer-service correspondence is reviewed for deletion when the case is closed and no later than two years after closure unless it forms part of required order documentation or an ongoing claim. Unpaid, expired checkout records are reviewed for deletion after 90 days. Access is limited during retention, and unnecessary information is deleted or anonymised during these reviews. These periods apply to our records; payment providers and couriers may have their own legal retention duties. Hosting backups may retain deleted copies for a limited backup cycle, with access restricted to recovery.
Your choices and rights
Ask mail@grandammi.com for access to your information or correction of an error. You may request deletion or restriction where the conditions apply; we cannot erase records we must keep by law or still need for an unresolved order or claim. You may request a portable copy of data you supplied where we process it automatically to perform the contract. You have the right to object to processing based on our legitimate interests. We will assess your circumstances and stop that processing unless there are overriding lawful grounds or a need to handle legal claims. We normally respond within one month and may ask for proportionate identity verification. You can complain to Datatilsynet (datatilsynet.no) or the competent data-protection authority where you live or work. We do not use the shop to make solely automated decisions with legal or similarly significant effects on you; Stripe separately assesses payments and fraud under its own notice.
Cookies, local storage and updates
The shop uses a necessary session cookie to secure checkout and link the payment return to your session. Your browser also keeps your cart, delivery country, currency choice, cached exchange rates and recent confirmation references in local storage so the shop works across visits. You can remove these using your browser’s site-data controls; doing so clears those preferences and may interrupt checkout. The merch shop does not use advertising cookies or newsletter tracking. Stripe’s hosted checkout has its own notice and necessary payment/security technologies. This notice is dated 17 October 2026. We will give appropriate notice of material changes affecting how existing customer data is used.
Provider privacy notices
Stripe · FedEx · UPS · DHL · Datatilsynet