Privacy policy
Last updated: 23 October 2026
Who we are
Celeste is a brand of Shreds AS. Shreds AS is responsible (the "controller") for the personal data described in this policy.
- Company: Shreds AS, org. no. 936 558 844
- Address: Castbergs gate 11, 3257 Larvik, Norway
- Privacy contact: privacy@shreds.no
This policy covers our website and webshop, our newsletter and pre-launch sign-ups, and our presence on Instagram and Facebook. We keep it short on purpose. If anything is unclear, email us.
What we collect and why
We only collect what we need for each purpose below.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Newsletter and pre-launch sign-ups, including via Instagram/Facebook lead forms | Email, first name (if given), what you open and click | Your consent (Art. 6(1)(a)). You can withdraw it any time via the unsubscribe link. |
| Processing and delivering your order | Name, address, email, phone, order details, payment status | Contract with you (Art. 6(1)(b)) |
| Customer service, returns and complaints | Your messages and order details | Contract (Art. 6(1)(b)) and our legitimate interest in helping you (Art. 6(1)(f)) |
| Bookkeeping | Order and payment records | Legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(c)) |
| Website analytics | How you use the site, device and browser info | Your consent via our cookie banner (Art. 6(1)(a)) |
| Advertising on Instagram and Facebook, including measuring our ads | Site activity via the Meta pixel; for subscribers, a hashed email used to show or exclude ads | Your consent (Art. 6(1)(a)) |
| Preventing fraud and keeping the shop secure | Order, payment and technical data | Legitimate interest (Art. 6(1)(f)) |
We do not sell your personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who we share data with
We share data only with services we need to run the shop. Most process data on our behalf under a data processing agreement. Some act as independent controllers under their own privacy policies.
| Recipient | What they do | Role |
|---|---|---|
| Shopify | Hosts our webshop and stores orders | Processor |
| Shopify Payments | Card payments | Processor and independent controller for payment and fraud checks |
| Vipps MobilePay | Vipps payments | Independent controller for the payment |
| Klarna | Invoice and instalment payments, including credit checks | Independent controller |
| Posten/Bring and DHL | Deliver your parcel | Receive name, address, phone and email for delivery |
| Klaviyo | Sends our newsletters and order emails | Processor |
| Google Analytics | Website statistics (only with consent) | Processor |
| Meta (Instagram and Facebook) | Ads, ad measurement and lead forms (only with consent) | Joint controller with us for collecting data via the Meta pixel; independent controller for its own further use |
We may also share data when the law requires it, for example with public authorities.
Transfers outside the EEA
Some of our providers (Shopify, Klaviyo, Google and Meta) may process data in the USA or other countries outside the EEA. When they do, the transfer is protected by the EU-US Data Privacy Framework, which the providers are certified under, or by the EU Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.
How long we keep data
- Newsletter and sign-ups: until you unsubscribe. We delete or anonymise inactive subscribers after 12 months without opens or clicks.
- Orders: for as long as needed to deliver, handle returns and complaints, and for up to 5 years after you buy, which covers the complaint period for goods.
- Bookkeeping records: 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act.
- Customer service messages: up to 2 years after the case is closed.
- Analytics and advertising data: as set out in our cookie banner, normally no longer than 14 months.
Cookies
We use cookies and similar technology on our website. Strictly necessary cookies, such as those that keep your shopping cart, are always on. Everything else is off until you say yes in our cookie banner:
- Analytics (Google Analytics): helps us understand how the site is used.
- Marketing (Meta pixel, Klaviyo): lets us measure our ads and show relevant ads and emails.
You can change your choice at any time via the cookie settings link at the bottom of every page.
Your rights
You have the right to:
- see the data we hold about you, and get a copy
- have incorrect data corrected
- have your data deleted, unless we must keep it by law
- restrict or object to our use of your data, including for direct marketing
- withdraw your consent at any time, without affecting what we did before
- get your data in a portable format
Email privacy@shreds.no to use any of these rights. We reply within one month.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). We'd appreciate the chance to sort it out with you first.
Changes to this policy
We update this policy when our services or the law change. The date at the top shows the latest version. If we make significant changes, we will tell subscribers and customers by email.