Cookie policy

Ren Mester AS · Org. no. 837 980 232 · Skiringsalgaten 6 B, 3116 Tønsberg, Norway · post@renmester.no · Last updated 20 September 2026 · English courtesy translation; the Norwegian version is the binding one

This policy sets out which cookies and equivalent storage technologies are used on renmester.no, the purposes they serve, which providers are involved, how long the data is retained, and how you give, change and withdraw your consent. It forms an integral part of our privacy notice, which describes our processing of personal data in full. In the event of any conflict, the privacy notice prevails.

Ren Mester AS is the controller for the processing described here.

1. What cookies are

A cookie is a small text file stored in your browser when you visit a website. It normally holds a name, a value and an expiry date, and is returned to the party that set it on subsequent requests. Its purpose may be to keep track of an action in progress, to remember a choice you have made, or to collect statistics on how the site is used.

Cookies are usually classified in three ways:

• By origin. First-party cookies are set by the site you are actually visiting. Third-party cookies are set by another party, typically a provider of a service the site relies on.
• By duration. Session cookies are deleted when you close your browser. Persistent cookies remain until the stated expiry date, or until you delete them yourself.
• By purpose. Necessary cookies are required for the site to function. Cookies serving other purposes, such as statistics, are not necessary and require consent.

Browsers additionally offer other forms of storage on your device, notably localStorage and sessionStorage. These are not cookies in the technical sense — they are not transmitted automatically with requests to a server — but they involve the same storage in your terminal equipment and are therefore covered by the same rules. We treat them identically in this policy, and all storage of both kinds is listed in the register in section 4.

2. Legal basis

Storing information in, and gaining access to information already stored in, a user's terminal equipment is governed by section 3-15 of the Norwegian Electronic Communications Act (ekomloven), which carries forward the requirement previously set out in section 2-7b of that Act, and which implements Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive).

The provision permits such storage only where

1. the user has been informed of what data is processed, the purpose of the processing and who carries it out, and
2. the user has given consent.

The consent requirement does not apply where the storage is strictly necessary in order to provide a service explicitly requested by the user, or where its sole purpose is to carry out the transmission of a communication over an electronic communications network. The storage listed as "necessary" in section 4.1 falls within that exemption and is therefore set without consent.

Where the processing of that data also constitutes processing of personal data, the General Data Protection Regulation (Regulation (EU) 2016/679) and the Norwegian Personal Data Act apply in addition. The consent we obtain for analytics and for marketing meets the requirements of Article 4(11) and Article 7 of the Regulation: it is freely given, specific, informed and unambiguous, it is given by a clear affirmative action for each category separately, and it may be withdrawn at any time as easily as it was given. Processing of personal data arising from necessary storage rests on Article 6(1)(b) (performance of a contract) or Article 6(1)(f) (legitimate interest in the secure and sound operation of the website).

Withholding consent to analytics or marketing has no consequences for your use of the site. Every function, including price calculation, booking and payment, works regardless of your choice, and the price is the same.

3. Giving, changing and withdrawing consent

3.1 First visit

On your first visit a consent panel is displayed at the bottom of the page. You may select Accept, which consents to every category, or open Cookie settings, where the categories are listed individually with a switch you control yourself. Necessary storage is marked "Always on" and cannot be switched off, as the site cannot be delivered without it. Your choices are stored when you select Save choices.

Until you have answered, neither analytics nor advertising tooling is loaded, and no cookies are created beyond the necessary storage listed in section 4.1.

The categories are independent of each other. You may, for instance, consent to analytics without consenting to marketing. If you answered the consent bar earlier, before the "Marketing" category existed, that category stands as not consented to — we never read an earlier answer as a yes to a purpose you were not shown. You can switch it on whenever you like under Change consent.

3.2 Changing and withdrawing

You may change or withdraw your consent at any time by selecting Change consent at the foot of any page. The consent panel then opens in its settings view with your previously saved choices pre-selected, and you may switch categories off or on and save again.

If you withdraw consent to marketing, reporting to Meta and TikTok ceases immediately: the advertising tools receive no further events in the active tab, on the next page view they are not loaded at all, and bookings you make after the withdrawal are not reported from our server either. Cookies already set can be deleted in your browser under section 3.4.

If you withdraw consent to analytics, collection ceases immediately. The analytics tool is instructed to stop transmitting in the active tab, and on the next page view it is not loaded at all. Withdrawal does not operate retroactively: statistics already collected on the basis of valid consent remain lawfully collected. If you wish data already collected to be erased, you may request this under section 7.

3.3 How long your answer is stored

Your choice is stored in your browser, both as the cookie rm_consent and in localStorage under the same name. The cookie is set with a duration of 400 days. This is not an arbitrary figure: Chromium-based browsers cap the lifetime of any cookie at 400 days, and a longer duration would be truncated automatically. 400 days is therefore the longest duration that can be implemented technically.

So that you are not asked again without cause, the cookie is renewed on every page view, so that the 400-day period starts afresh each time you visit the site. Your answer is also stored in localStorage, which has no expiry. Provided you do not delete stored site data yourself, you will therefore not be asked for consent again.

3.4 Browser settings

You may also manage and delete cookies directly in your browser. Deleting stored site data will also remove your stored consent choice, and the consent panel will then reappear on your next visit. The providers describe how to do so here:

• Google Chrome
• Apple Safari
• Mozilla Firefox
• Microsoft Edge

Please note that blocking all storage may prevent booking and payment from completing, as those functions depend on the necessary storage described in section 4.1.

4. Complete register of cookies and other storage

The register below covers all storage that may occur in your browser when using renmester.no. The durations stated are the maximum possible; some entries are created only if you use the function in question.

4.1 Necessary — set without consent

4.2 Analytics — set only with your consent

PostHog is downloaded to your browser only after you have consented; without consent the program code is never fetched and no ph_* entries can arise. The Google tag is present on all pages but runs in Google's Consent Mode: without consent no _ga cookies are set, and only aggregated, cookieless signals without identifiers are sent. Full cookie-based measurement is activated only when you consent to the "Analytics" category.

The analytics setup is configured to collect as little as possible: person profiles are created only for identified users, which on a site with no customer log-in does not occur in practice, and page views are recorded by our own code rather than automatically. The recordings of usage patterns are processed in PostHog on servers within the EU and are not linked to payment information; payment is completed on Stripe's own payment page, which is not covered by the recording. Analytics data is not shared with advertising networks — the advert measurement in section 4.3 is a separate category, with its own consent and its own providers.

4.3 Marketing — set only with your consent

Neither Meta's nor TikTok's program code is downloaded to your browser before you have consented to the "Marketing" category. Unlike the Google tag in section 4.2, these two have no consent-free mode — they set cookies as soon as they run — and they are therefore not loaded at all without a yes.

What is sent: that a page was opened, that the booking form was opened, that "Pay" was pressed, and that a booking was paid for, with the amount in kroner, the currency and the name of the service. We never send names, addresses, registration numbers, free text or anything from the payment page, and links containing a key to your booking (?token=) are removed from the address bar before any advertising event can be sent.

A copy from our server. Paid bookings are additionally reported once from our own server, through Meta's Conversions API and TikTok's Events API. The reason is accuracy: browser events are lost to ad blockers and abandoned tabs, and without the copy we pay for adverts we cannot measure. The copy is sent only for bookings where you had consented to marketing, it carries the same event id as the browser event so that one sale is never counted twice, and your e-mail address and phone number are sent solely as a one-way cryptographic digest (SHA-256) — never in the clear. The purpose is to let the provider recognise a sale they have already recorded, not to give them new information about you.

4.4 Storage we do not control

Certain functions send requests directly from your browser to an external service. This does not in itself involve storage on your device, but it does mean that the service receives your IP address. This applies to the address lookup in the booking form, which queries the Norwegian Mapping Authority's open address register (Geonorge) as you type, and to the "find my address" location lookup, which — only after your express permission in the browser — sends your coordinates to the same service. See section 5.

5. Third parties and transfers of personal data

The following providers are involved in the storage described above, or receive data as a consequence of it:

• Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) as a sub-processor. Payment processing. Transfers to the USA take place on the basis of the European Commission's standard contractual clauses under Article 46(2)(c) of the GDPR, supplemented by the EU–US Data Privacy Framework. Stripe acts as an independent controller for data processed for fraud prevention and to meet Stripe's own legal obligations.
• PostHog. Usage statistics. The project is provisioned in the provider's EU region, and both collection and storage take place on servers within the EU/EEA.
• Meta Platforms Ireland Ltd. Advert measurement for Facebook and Instagram, only with consent to the "Marketing" category. Data may be transferred to Meta Platforms, Inc. in the USA on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework and standard contractual clauses. Meta acts as an independent controller for its further use of the data. E-mail address and phone number are sent only as a one-way cryptographic digest.
• TikTok Technology Limited (Ireland). Advert measurement for TikTok, only with consent to the "Marketing" category. Data may be transferred outside the EEA on the basis of standard contractual clauses under Article 46(2)(c) of the GDPR. E-mail address and phone number are sent only as a one-way cryptographic digest.
• Supabase. Database and file storage, operated in the EU region (eu-west-2). The sign-in cookies in section 4.1 apply to staff only.
• The Norwegian Mapping Authority (Geonorge). Open address lookup. The service is called directly from your browser, so the Mapping Authority receives your IP address and the characters you have typed into the address field. The Mapping Authority is a Norwegian public body, and the data does not leave Norway.

A complete list of all processors we engage, including those unrelated to storage in your browser, is set out in section 5 of the privacy notice.

6. Changes to this policy

We update this policy when the storage used on the site changes, when we adopt or discontinue a provider, or when the law or its interpretation makes it necessary. The current version is always available on this page, and the date at the top states when it was last amended.

Where a change means that consent is sought for new or altered purposes, we obtain fresh consent before the storage in question is brought into use. Purely editorial changes are not notified separately.

7. Contact

Questions about this policy, about the storage described here, or about exercising your rights may be directed to:

Ren Mester AS Skiringsalgaten 6 B, 3116 Tønsberg, Norway Org. no. 837 980 232 Email: post@renmester.no

Enquiries are answered without undue delay, and within one month at the latest. If you consider that the processing of personal data concerning you infringes the rules, you may lodge a complaint with the Norwegian Data Protection Authority.

---

Ren Mester AS — One Master, for all your cleaning needs