How this site handles your data.
Most visits leave nothing behind. If you send a message, this page explains what is kept, why, for how long and what you can ask for. Last updated 11 September 2026.
Who is responsible
The data controller is JKRB AS, the Norwegian company through which Jon-Kristian Ruiz Bruheim works. Questions about your data go through the contact page.
Visiting the site
Reading pages requires no account and sets no cookies. The web server keeps standard access logs (your IP address, the page requested, the time and your browser’s user-agent string) to troubleshoot problems and detect attacks. They are rotated and deleted after 14 days at the latest. The legal basis is our legitimate interest in keeping the site running and secure (GDPR Article 6(1)(f)).
Contact form
When you send a message, the site stores the name, email address and message you typed so that I can reply. A copy is also sent to my mailbox through Twilio SendGrid, an email delivery service. The legal basis is our legitimate interest in answering messages sent to us (Article 6(1)(f)); where a message is about a possible assignment, the processing is also a step taken at your request before entering into a contract (Article 6(1)(b)).
To detect abuse of the form, the site also stores a keyed hash of your IP address and your browser’s user-agent string. The hash is created with a secret key, so it can only be matched by this site and cannot be turned back into an address.
Retention is automatic:
- The hashed IP address and user-agent string are deleted 30 days after the message was received.
- A message is deleted 90 days after I have handled it, and in any case 365 days after it was received, unless we have started working together and the message has become part of that correspondence.
Analytics
The site can use Google Analytics 4 to count visits and see which pages are read. Analytics is not loaded unless you choose to allow it in the notice at the bottom of the page, so the legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time by clearing this site’s data in your browser. Your preference is stored locally in your browser, not in a cookie. If you allow it, Google processes the data on behalf of the site owner; Google Analytics 4 does not log or store IP addresses.
Who else sees the data
The site runs on a server hosted by DigitalOcean, which stores the database and the server logs. Contact messages are delivered by Twilio SendGrid. Analytics, when enabled and allowed, is processed by Google. These providers act as processors under data-processing agreements and may process data outside the EEA; such transfers rest on the safeguards the GDPR allows, such as the EU standard contractual clauses or the EU–US Data Privacy Framework. No data is sold or shared for advertising.
Cookies
The public site sets no cookies. The administration area uses a single session cookie, which only concerns the site’s owner.
Your rights
You can ask for access to the data stored about you, have it corrected or deleted, ask that its use be restricted, object to processing based on legitimate interest, and receive the data you provided in a portable form. Use the contact page. If you believe your data is handled unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.