Privacy statement for GenePaws

Data controller is Invested AS, registration number 917212791, Slemdalsveien 1, 0369 Oslo. If you have questions about privacy, contact us at personvern@invested.no.

DNA test enquiries

When you submit an enquiry, we store your name, email address, selected species, purpose, number of animals and any details you enter. We use this information to assess and follow up on the enquiry. An enquiry does not create an order or subscribe you to marketing.

Customer reviews and feedback

We use your order email address and delivery status to request feedback. Your rating, comment and chosen display name are stored with the order reference. Your email address is not published. A review is only published with your consent and after moderation. Your personal link lets you withdraw publication and stop further review requests.

What information the service can process

The list must be checked against the functions that are actually enabled at launch. Information shall not be collected until it is needed for a stated purpose.

About you as owner/breeder (personal information)

• Name, email address, postal address and telephone number
• Account and login information when login is activated
• Payment details (handled by our payment provider; we do not store full card numbers)
• Communication with us (email, customer inquiries)
• Usage data from the service (see "Information capsules" below)

About your pet

• Information you register: name, species, breed, sex, date of birth, chip/ID number, pedigree/family tree, vaccinations and health information you enter yourself
• Genetic data from the sample (DNA profile) and the analysis results (breed/origin calculation, health markers, characteristics and comparisons of registered markers in breeding animals)

Please note that information about your animal may be linked to you as the owner, and thus indirectly to you as a person. We therefore treat the entire animal profile with the same care as your own information.

Why we process the information (purpose) and on what basis

We request consent before we use the animal's genetic data for anything beyond delivering the actual service to you (for example, research or product improvement). Such consent is voluntary, specific and may be withdrawn at any time without affecting the service you have already purchased.

Signing up to the newsletter uses double confirmation: the address only becomes active when you have opened the confirmation link we send you. Each newsletter contains a personal unsubscribe link. We retain the necessary documentation on consent and cancellation to be able to respect your choice and document the treatment.

Laboratory and processing of genetic data

When a laboratory partner has been chosen, the agreement must describe which data the laboratory receives, why it is processed, where it is stored, how long the sample is kept and how deletion is carried out. If the laboratory is a data processor, the relationship must be regulated in line with GDPR article 28.

Data processors we use

The final list of data processors and any transfers outside the EEA must be confirmed before launch. The product is prepared for these categories:

• Laboratory: receipt and analysis of sample. Supplier and terms have not been confirmed.
• Payment: Stripe is technically prepared, but the active provider, processing location and transfer basis must be confirmed. GenePaws must not store complete card numbers.
• Email and notification: Supplier and treatment center must be confirmed.
• Vipps MobilePay: When you choose Vipps Login, GenePaws receives a point of sale-specific user ID and the information you agree to share: name, verified email address and phone number. The Vipps token is not stored.
• Operation and hosting: Actual supplier, subcontractors and processing site must be entered.

How long we store the information

• Account information and animal profile: standard storage time and deletion deadline must be determined. Information that is necessary for statutory duties may need to be retained after the account has been closed.
• Physical sample: destruction deadline must be confirmed with the laboratory and stated before the sample is submitted.
• Genetic raw data and results: storage location and default period must be confirmed. You can request deletion; any legal exceptions must be explained in the answer.
• Accounting documentation: is stored for as long as the Bookkeeping Act requires.

Your rights

According to the Personal Data Protection Regulation, you have the right to:

• request access in what information we have about you (art. 15),
• get fixed information that is incorrect (art. 16),
• get deleted information, also called "the right to be forgotten" (art. 17),
• request restriction of the processing (art. 18),
• get extradited your data in a common, machine-readable format (data portability, Art. 20),
• protest against processing (art. 21), and
• withdraw consent at any time.

We normally respond within one month, and it's free. Contact us at personvern@invested.no.

If you disagree with how we process your information, you can complaint to the Norwegian Data Protection Authority (art. 77). We appreciate that you contact us first, so we can correct it.

Access to animal genetic data

You can request access to, disclosure of, or deletion of raw data and results associated with your account. Exact export format and deletion process must be described before the service is final. If you have consented to the use of data for research or product improvement, you can withdraw that consent at any time without cumbersome processes, and without affecting the service you have already purchased.

Cookies and analysis

The website stores necessary choices for shopping cart and cookie settings, among other things. If GenePaws uses optional cookies for statistics, they must only be set after consent. An updated overview of the name, purpose, supplier and lifespan must be published before such cookies are put into use.