Privacy notice

In short: you can use Kalmark without us knowing who you are. We store your name and contact details only when you ask for an offer yourself, and only to prepare and follow up that offer.

Who is responsible

Nordic Retail Systems AS is the data controller. Contact us at contact@noresys.no.

When you use Kalmark

• What you enter about the store (area, choices, assumptions) and the place you pick on the map are sent to our server, which calculates the plan. We don't store them together with your name, unless you ask for an offer (see below).
• To see how many people get through the steps, we store pseudonymous events, such as "saw the result page", the store size, the band the spot got on the map and whether the page was in Norwegian or English. The events from one page view share a random ID that sits in the page itself, not in a cookie. It covers that one page view only, so two page views cannot be linked, not even within one visit. The time is stored to the hour only. We don't store IP addresses, names or positions in the events. The events from the offer form are stored without an ID and without the language, so they cannot be linked to an offer request.
• The legal basis for the events is our legitimate interest in improving the tool (GDPR Article 6(1)(f)). We delete them after 13 months.
• Cookies: we use none.
• The background map, on the map and on the store page, comes from our own server, and so do the address search and the names of places: your browser asks no other site for them.
• What you type in the address search and the place you pick on the map go to our server, which answers and forgets them. We don't store them, and our server's log doesn't record them. The legal basis is our legitimate interest in showing maps and finding addresses (GDPR Article 6(1)(f)).

When you ask for an offer

• We store your name and phone number, and whatever else you choose to give us: your email and a floor plan you upload. We also store your store plan, with the place you picked on the map (coordinates), the address shown for it, and whether the page was in Norwegian or English, so the designer can call you in that language.
• The request is stored in our database and sent to us by email, with your drawing attached. We don't send you any automatic email; a designer calls you.
• To prevent abuse, the server keeps your IP address in working memory for about an hour after you send the request, and counts how many requests come from it. The IP address is not written to the database. The legal basis is our legitimate interest in preventing abuse (GDPR Article 6(1)(f)).
• The purpose is to prepare the offer and follow it up with you.
• The legal basis is GDPR Article 6(1)(b): the processing is necessary to take steps you asked for before entering into a contract.
• We delete the data 24 months after you sent the request. If it leads to a contract, we keep the sales documents as long as the Norwegian Bookkeeping Act requires.
• Only the people at our company who prepare the offer see the data. Our email and hosting providers process it on our behalf, as our data processors. We don't sell it, and we don't use it for marketing unless you ask us to.

Your rights

You can ask for access, correction, deletion and restriction, ask for your data in a portable form, and object to the processing. Write to contact@noresys.no. You can also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

Last updated 3 October 2026.