How we handle personal data

Last updated: October 2026

Data controller

MVC Technologies is the name we use publicly. The registered company name is MV Cerda Technologies, which is the data controller for the personal data described here.

• MV Cerda Technologies
• Org. no. 938 159 238
• Bergen, Norway
• Email: post@mvctech.no
• Phone: +47 469 65 906

What information we receive

The website has no login, no user account and no comment field. The only way to send us personal data from the site is the contact form. The form contains:

• Name (required)
• Company (optional)
• Email address (required)
• Phone number (optional)
• What the enquiry is about (required, chosen from a list)
• Preferred timeframe (optional, chosen from a list)
• Free text about what you would like to achieve (required)

In addition, the time of submission, the page the form was sent from and the page language are recorded. Please don't write sensitive personal data, passwords, account numbers or national identity numbers in the free-text field. They are not needed to assess an enquiry.

Why we process it, and on what basis

The information is used to assess and follow up on your enquiry: to understand the need, reply, ask follow-up questions and possibly prepare a proposal.

The legal basis is taking steps at your request before a possible contract is entered into, under Article 6(1)(b) of the General Data Protection Regulation (GDPR). For enquiries that don't lead to a client relationship, the basis is our legitimate interest in answering enquiries we have invited, under Article 6(1)(f).

We don't use the information for marketing, profiling or automated decisions, and we don't sell it on.

Who is involved in the processing

We use a small number of subcontractors to run the website and deliver email. They process data on our behalf and according to our instructions.

• Vercel: hosting of the website and of the server function that receives the form.
• Resend: sending the notification that a new enquiry has arrived. The content of the form is included in this email.
• Upstash Redis: an optional component that can be switched on for short-lived storage of counters that limit the number of submissions and prevent the same form from being sent twice. It then stores a salted hash of the IP address and a hash of the content, not readable information, with a lifetime of minutes.

Some of these providers may process data outside the EU/EEA. Such transfers are then based on the EU standard contractual clauses or an applicable adequacy decision.

Storage

The website has no database and does not store submitted forms permanently. The enquiry arrives in our inbox in the same way as an email you had written yourself, and stays there for as long as it is relevant to the conversation or to an ongoing or completed client relationship. We regularly review the inbox and delete enquiries that no longer serve any purpose. If you're unsure whether we still have an enquiry from you, ask us and we'll give you a concrete answer.

The counters used to limit misuse last for minutes and contain no readable personal data. If you change the language of the site, a small cookie (mvct_lang) remembers that choice. It contains only "nb" or "en" and is not used for tracking.

Cookies and tracking

Apart from the language cookie described above, the website sets no cookies, loads no third-party scripts and has no analytics or tracking tools enabled. That is also why there is no consent banner to deal with. If we later start using a privacy-friendly analytics tool, this page will be updated before it is switched on.

Technical logs

For security and operational reasons, the fact that an enquiry was received is logged, together with a reference number, the category chosen, the page language, whether a phone number was filled in, how many characters the free-text field contained, and a salted hash of the IP address. The logs do not contain names, email addresses, phone numbers, company names or the text you wrote. Vercel also keeps its own technical logs of traffic to the website.

Security

The website is served over HTTPS only, with strict security headers and a content security policy that does not allow third-party scripts. The form accepts enquiries from our own domain, and the content is validated and sanitized before it is put into an email. Keys and secrets exist only as server-side environment variables and are never exposed in the browser.

Your rights

You have the right to ask for:

• access to the information we hold about you
• correction of information that is wrong
• deletion of information we no longer have grounds to keep
• restriction of the processing
• the information in a common machine-readable format
• to object to processing based on legitimate interest

Send your request to post@mvctech.no. We'll reply as soon as we can, and within one month at the latest. If you used the form, feel free to include the reference number you received. It makes it quicker to find the right enquiry.

Complaints

If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet), or to the supervisory authority in your own country. We would appreciate hearing about it first, so we can put it right.

Changes

If the website or the providers we use change, this page is updated and the date at the top is adjusted accordingly. The Norwegian version of this page is the original; if the two ever differ, the Norwegian text applies.

If you have questions about anything on this page, contact us at post@mvctech.no or +47 469 65 906.