Privacy Policy
Last updated July 2026.
This is an informational translation. The Norwegian version (norsk versjon) is legally binding.
1. Data controller
Datamynt AS (org. no. 936 017 207), Maridalsveien 163, 0461 Oslo, is the data controller for personal data collected through merdata.no.
Contact: personvern@merdata.no
2. What data we collect
We collect a minimum of data to deliver the service:
• Email address — to send your receipt and activation link
• Phone number — only via Vipps payment, used to identify your order
• Order ID and package information — to deliver the correct eSIM profile
• IP address and browser information — logged automatically for security and troubleshooting
• Payment information — handled directly by Vipps or Stripe, we never store card numbers
• Chat messages — messages sent to our AI support (anonymised, no email addresses stored)
3. Purposes and legal basis
Your data is processed on the following legal bases:
• Contract (GDPR art. 6(1)(b)) — necessary to deliver the eSIM product you bought
• Consent (GDPR art. 6(1)(a)) — for emails beyond your receipt
• Legitimate interest (GDPR art. 6(1)(f)) — for security, troubleshooting and improving the service
• Legal obligation (GDPR art. 6(1)(c)) — for bookkeeping and accounting (5 years)
4. Sharing with third parties
We only share data with third parties where necessary to deliver the service:
• Vipps MobilePay — payment processing (email, phone number, amount)
• Stripe — card payments, Apple Pay and Google Pay (payment data)
• eSIMaccess — eSIM provider (receives only the package ID to allocate a profile)
• Celitech — fallback eSIM provider (receives only the package ID)
• Google Cloud Platform — infrastructure and hosting
• peck-mail — email delivery (magic link, order confirmation)
• LLM Gateway — AI support chat (message content, not your email or name)
• Referral partners (e.g. eSIMDB) — if you arrived via a partner link, the partner is notified of a completed purchase (package, price, time and the partner's own click ID) — never your name, email or any other personal data
• Sporløs (sporlos.no) — cookieless, anonymous web analytics; no tracking cookies and no personal data, so no consent is required
• BSV blockchain — a receipt hash is stored permanently and publicly (anonymised, no personal data)
We never sell your data to third parties. All our sub-processors are bound by their own data processing agreements.
5. Retention periods
• Order data (email, package info, receipt) — 12 months after purchase
• Accounting data (transaction amount, date) — 5 years (the Norwegian Bookkeeping Act (bokføringsloven))
• Server logs (IP addresses, error messages) — 30 days
• Session cookies — deleted when you close your browser
6. Your rights
Under the General Data Protection Regulation (GDPR) you have the following rights:
• Access — you can request a copy of all data we hold about you
• Rectification — you can ask us to correct inaccurate information
• Erasure — you can ask us to delete your data (except where retention is required by law)
• Data portability — you can ask to receive your data in a machine-readable format
• Objection — you can object to processing based on legitimate interest
• Complaint — you have the right to complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no)
To exercise your rights, contact us at personvern@merdata.no. We respond within 30 days.
7. Cookies
merdata.no uses essential session cookies to make the site work, and a language-preference cookie if you pick a language — these do not require consent (the Norwegian Electronic Communications Act (ekomloven) § 2-7b). We also set our own first-party attribution cookies: one remembering which campaign you arrived from (max 90 days), and — if you arrived via a partner link — one remembering the partner (30 days), so we can settle with the partner when you buy. These are never shared and do not track you across websites. Our web analytics (Sporløs) is fully cookieless. We use no advertising cookies or third-party marketing cookies — which is also why there is no cookie banner.
8. Contact
Datamynt AS, org. no. 936 017 207
Maridalsveien 163, 0461 Oslo
Email: personvern@merdata.no
Website: merdata.no
Datatilsynet (the Norwegian Data Protection Authority): datatilsynet.no — for complaints about our processing of personal data.
