Noe i boks
Donate

Privacy policy for Noe i boks

Last updated: 26.04.2026

Overview

This privacy policy has been prepared by Noe i boks, company registration number 936 429 750 ("Noe i boks" or "we") to provide you with information about how, why and on what basis we process your personal data. Noe i boks is a voluntary organization that connects donors with children in low-income families who need help at major events such as the start of school or the start of kindergarten with an earmarked gift card, through an anonymous matching platform between donors and recipients. In addition, the privacy policy describes what rights you have under the EU General Data Protection Regulation 2016/679 (GDPR) and the Norwegian data protection legislation (together the "Data Protection Legislation").

Noe i boks is the data controller for the processing of personal data described in this statement. It is the data controller who is responsible for safeguarding your rights under the Data Protection Act, including your right to receive information about how your data is processed.

We mainly process information about you in the following cases:

  • When you register as a recipient to get help for your child
  • When you donate as a donor through our platform
  • When you visit our website
  • When you communicate with us
  • When you are a contact person at one of our partners

We use personal data mainly for the following purposes:

  • Manage matching between donors and recipients
  • Make donations and payments
  • Communication and marketing
  • Reporting to tax authorities in connection with tax deductions
  • Manage collaboration with partners

Information for children

Hi! If you are a child who is going to get help from Noe i boks, this section has been written especially for you. We will explain in simple terms what we do with information about you.

What is personal data? Personal data is information about you – for example, whether you are a boy or a girl, how old you are, and whether you are going to kindergarten or school. It can also be things like your wishes, such as a backpack for school or a rain suit.

What do we do with the information? When mum, dad or another adult registers you with us, they tell us a little about you. We use this information to find a kind person who will help you get what you need for the start of school, the start of kindergarten or other events covered by our organization – for example, a new backpack or pencil case. The person helping you will not know who you are or your address. It's a secret!

Who looks after your information? We at Noe i boks take good care of all information about you. We don't share it with anyone who doesn't need to know, and we delete it when we don't need it anymore.

Your Rights. You have the right to know what we know about you. You can also ask us to correct things that are wrong or delete information about you. If you have any questions, you can ask an adult to help you contact us.

Do you have any questions? If you have any questions about how we use information about you, please ask your mom, dad or another adult to contact us at post@noeiboks.no. You can also ask them to read the rest of this Privacy Policy with you.

Contact Us

If you have any questions about how we process your personal data, or wish to exercise your rights, please contact us at post@noeiboks.no.

What is personal data?

Personal data is all information that can be linked to you as a person, such as your name, telephone number, e-mail address, address and postal code. Payment information and information about a child's gender, age and needs can also be personal data when they can be linked to a specific person.

By processing personal data, we mean the collection, storage, use, sharing and deletion of personal data.

Who do we process personal data about?

This Privacy Policy applies to our processing of personal data about the following groups:

  • Recipients – parents/guardians who register to receive help for their child, as well as the child
  • Donors – people who donate money through our platform
  • Visitors to our website
  • Contact persons at partners (e.g. the Single Parents Association and other organisations we work with)

What Personal Data do we process?

Recipients

When you register as a recipient through the code you have received from one of our partners, we collect the following information:

  • Contact information about parent/guardian: Name, phone number, email address and postcode
  • Information about the child: Gender, age and whether the child will start kindergarten or grade level or other events relevant to our service
  • Wish list: Wishes or needs the child has, such as a school bag, pencil case or park suit

Purpose: Match the recipient with a donor, deliver earmarked gift cards to the family, and manage the recipient relationship.

Basis for processing: Consent when registering on the platform (GDPR Art. 6 (1) (a)) and necessary for the performance of the agreement to provide the assistance (GDPR Art. 6 (1) (b)).

In some cases, we will receive anonymized information about the recipient from our partners. In such cases, we process limited information about the recipient on our site, and we do not receive the name, phone number or email address of the recipient.

Donors

When you register as a donor and donate through our platform, we collect the following information:

  • Contact information: Name, phone number, email address and zip code
  • Payment information: Information that is necessary to complete the payment via Vipps or card (processed by our payment providers Vipps and Stripe)
  • Match information: Information about the recipient child you are matched with, such as gender, age, and what the donation has enabled (e.g., "You helped a 6-year-old boy start 1st grade, and thanks to the donation, he was able to buy a blue school bag")
  • Social security number: If you want a tax deduction for your donation, we will collect your social security number for reporting to the tax authorities. We will inform you more about this when the scheme is in place.

Purpose: Complete the donation, match the donor with a recipient, send information about the match, and manage the donor relationship. In the case of tax deductions, personal identity numbers are processed for reporting to the tax authorities.

Basis for processing: Necessary for the performance of a contract (GDPR Art. 6 (1) (b)), consent for marketing (GDPR Art. 6 (1) (a)), and legal obligation for tax reporting (GDPR Art. 6 (1) (c)).

Partners

For contact persons at our partners, such as the Single Parents Association, we process:

  • Contact information: Name, phone number, email address and any role in the organization

Purpose: To manage the collaboration and communicate with contact persons at our partners.

Basis for processing: Legitimate interest in administering the cooperation (GDPR Art. 6 (1) letter f).

Marketing and Communications

We send emails and SMS to donors with information about the matching, as well as more general information about Noe i boks. We also use social media such as LinkedIn and Facebook to inform about our business. In this connection, we process:

  • Contact information: Name, email address, and phone number

Purpose: Communicate with you about the matching, send newsletters and inform about Noe i boks's activities.

Basis for processing: Consent for marketing by e-mail and SMS (GDPR Art. 6 (1) (a)).

Visit our website

When you visit our website, we may collect information about how you use our website using cookies. A cookie is a small text file that is stored on your device. Among other things, we use Google Analytics for statistical and analysis purposes. You can read more about our use of cookies in our cookie policy [here].

Purpose: To ensure that the website functions well and understand how it is used to improve the user experience.

Legal basis: Necessary cookies are processed on the basis of legitimate interest (GDPR Art. 6 (1) (f)). Analytics and marketing cookies are processed on the basis of consent (GDPR Art. 6 (1) (a)).

What is the purpose of processing personal data?

As mentioned under the various points above, we process personal data about recipients in order to be able to match the recipient with a donor, deliver earmarked gift cards to the child, and manage the recipient relationship. Information about the child's wishes is used to inform the donor, so that the gift is as useful and meaningful to the giver as possible.

We process personal data about donors in order to be able to complete the donation, match the donor with a recipient, send information about the matching and otherwise administer the donor relationship. If you want a tax deduction, we process your personal identity number for reporting to the tax authorities.

We process contact information in order to be able to send you information about Noe i boks' business, including updates about the matching, newsletters and other relevant information by e-mail and SMS. We also use cookies on our website to ensure that the website works well and to understand how it is used.

What is the legal basis for our processing of personal data?

We process personal data on the following legal bases:

  • Consent: We obtain your consent before sending you marketing emails and SMS. You can withdraw your consent at any time by contacting us or using the unsubscribe link in our emails. We also obtain consent from recipients before registering on the platform.
  • Agreement: We process personal data about donors because it is necessary to carry out the donation and matching. For recipients, we process data because it is necessary to deliver the help you have registered for.
  • Legal obligation: We process certain information, including social security numbers, because we are required to report to the tax authorities when we have approval for tax deductions. Documentation that is subject to the bookkeeping obligation is processed in accordance with the bookkeeping legislation.
  • Legitimate interest: We process contact information about partners and suppliers because it is necessary to administer our cooperation. We also use necessary cookies on our website based on our legitimate interest in the website functioning properly. We consider that these interests do not come at the expense of your privacy.

Disclosure of personal data and use of data processors

We do not share your personal information with others unless there is a lawful basis for such sharing. Where we use data processors to process personal data on our behalf, we enter into necessary agreements to ensure information security at all stages of the processing.

  • Payment solutions: We work with Vipps and Stripe for the processing of payments. Our payment provider Stripe processes payment information on our behalf to process donations via card. We have entered into a data processing agreement with Stripe that ensures that your information is processed in a secure manner. Stripe is a U.S. company and may transfer personal data to the United States. Stripe is certified under the EU-U.S. Data Privacy Framework (DPF), which ensures an adequate level of protection for the transfer of personal data from the EEA to the United States in accordance with the GDPR.
  • IT providers: We use service providers for the operation of our platform and website. We have entered into data processing agreements with these suppliers that require them to process personal data in a secure manner and only in line with our instructions.
  • Partners: We do not share personal data about recipients with our partners (such as the Single Parents Association etc.) beyond what is necessary to mediate contact. The matching between donors and recipients is anonymous.
  • Tax authorities: If we have approval for tax deductions, we will report the necessary information to the Norwegian Tax Administration in accordance with applicable legislation.
  • Social media: We use LinkedIn, Facebook and other platforms to inform about Noe i boks. The processing of personal data on these platforms is subject to the platforms' own terms and conditions and privacy policies. We encourage you to read these.

As a general rule, we do not transfer personal data to countries outside the EEA, but if necessary, we will ensure that the transfer takes place in accordance with the Data Protection Legislation, for example by using the EU Standard Contractual Clauses.

Safety Precautions

Noe i boks takes your privacy seriously and has taken steps to protect your personal information from unauthorized access, loss, or misuse.

  • Access control: Only authorised employees with a professional need have access to personal data. We treat all personal data, in particular about recipients and payment information, as strictly confidential.
  • Encryption: We use encryption when transmitting sensitive information, including payment information.
  • Data processing agreements: We have entered into data processing agreements with all suppliers who process personal data on our behalf, which require them to ensure security.
  • Anonymization: The matching between donors and recipients is anonymous, so donors do not have access to identifying information about the recipient family.
  • Ongoing work: We work continuously to ensure the security of our processing of personal data.

How long will we keep your personal data?

We delete or anonymize personal information when it is no longer necessary for the purpose for which it was collected. Below we describe the most important deletion routines.

Information about recipients related to a match is deleted when the matching has been completed and any follow-up actions have been completed, unless further storage is necessary for bookkeeping or reporting to the tax authorities.

Documentation that is subject to the bookkeeping obligation, including payment documentation, is stored for 3 1/2 or 5 years in accordance with the Bookkeeping Act.

Donor data and marketing: We want to keep in touch with you as a donor to send you newsletters, information about Noe i boks and calls to support us again. Your contact information is therefore kept for up to 3 years after your last donation unless you request deletion. If you request deletion, we will remove you from our marketing database. Please note that deletion from the marketing database does not affect information we are required by law to store, such as payment documentation related to bookkeeping and any tax reporting. You can request deletion from the marketing database or unsubscribe from newsletters at any time by contacting us as indicated in section 2.

Information about partners is stored for as long as Noe i boks exists.

What rights do you have?

You have the following rights under data protection legislation:

  • Access: You can request a copy of the personal data we process about you (GDPR art. 15).
  • Correction: You can ask us to correct incorrect or incomplete data (GDPR Art. 16).
  • Deletion: You can request the deletion of personal data that is no longer necessary (GDPR art. 17).
  • Restriction of processing: You can ask us to restrict the processing of your data in certain situations (GDPR art. 18).
  • Data portability: You can request to be provided with personal data you have provided to us in a structured, machine-readable format (GDPR art. 20).
  • Object to processing: You may object to processing based on legitimate interest (GDPR Art. 21).
  • Withdrawing consent: Where we process information based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that has already taken place.

There are exceptions and further conditions for the rights above. You can read more about your rights on the website of the Norwegian Data Protection Authority.

If you wish to exercise one of your rights, please contact us as set out in section 2 above. We may ask you to identify yourself so that we can ensure that you are who you say you are.

The Norwegian Data Protection Authority, complaints and applicable data protection legislation

The Norwegian Data Protection Authority is responsible for monitoring the data protection regulations in Norway. If you have any questions or complaints related to our processing of your personal data, please feel free to contact us. You can also complain to the Norwegian Data Protection Authority.

Contact information for the Data Protection Authority can be found on www.datatilsynet.no.

The current data protection legislation is available at Lovdata (www.lovdata.no).

Changes

We may update this Privacy Policy from time to time, for example, if our processing of personal data changes or if data protection laws change. Updated versions will be published on our website. This Privacy Policy is effective as of the date indicated initially.