# Privacy policy | Okam > How Okam AS stores and processes personal data in the Okam apps, the POS and on this website. Source: https://okam.no/en/privacy ## Privacy policy **Last updated: 19 October 2026** This is an English translation of [Personvernerklæring](https://okam.no/personvern). If the two differ, the Norwegian version applies. ### General Okam AS (org. no. 925 024 414), Landstads gate 54, 2000 Lillestrøm, Norway, is the company behind the Okam platform. This policy describes how we store and process information about you when you use the mobile app, buy from a shop that uses Okam, or visit our website. We collect and use information within the requirements of the EU General Data Protection Regulation (GDPR) and Norwegian law (personopplysningsloven). ### Who is the controller Okam AS is the controller for your Okam account, that is your phone number, your login and the overview of your orders across shops. When you order from a shop, in the Okam app, in the shop's own app, online or at the till, the shop is the controller for the order and for the customer details it records. Okam AS processes this information on the shop's behalf, under a [data processing agreement](https://okam.no/en/terms#vedlegg-1). You can ask the shop directly about an order. You can also contact us, and we will help you further. ### What we store When you use the Okam app, or other white-label apps delivered by Okam, the Okam system stores only the information needed to deliver the service to you. When you place an order, the system stores your phone number and the order details. Your phone number is your user identity, and your order history is stored with it to give you one overview of your orders. You can see this information in the app, and you can delete it at any time if you do not want it stored on your account. We use Dintero for card payment and Vipps online, Vipps directly at some shops, and Surfboard for card payment at the till. When a shop registers you as a customer in the Okam POS, for example for delivery, pickup or an invoice, your name, phone number, address and, if given, e-mail address and company details are stored in the shop's customer register. If you ask for a receipt by SMS or e-mail, your phone number or e-mail address is used to send it. If you book a table, your name, phone number, number of guests, time and any comment are stored, and you get a confirmation by SMS. If you use Okam's apps for shops (Okam Backoffice, Okam POS and Okam KDS), you sign in with your phone number and a one-time code by SMS or e-mail. Your profile stores your phone number, name, e-mail address and which shops you have access to. If you register a shop, its company details and public e-mail address are stored. Pictures you upload in Okam Backoffice, for example product pictures or a logo, are stored as part of the shop's content. Menu files you read in (a photo, a PDF or a spreadsheet) are read by Gemini and not stored; the reading itself is deleted after 30 days. The camera is used only when you take a picture or scan a barcode yourself, and the barcode is read on the device. If the shop has turned on usage statistics, the screens and features you use and where you tap are recorded, without amounts, names or text you type. Usage statistics are off unless the shop turns them on. ### How long we keep it Your Okam account is kept until you delete it. When the account is deleted, your phone number and account details are deleted, and your orders are no longer linked to you. The name and address on orders are part of the shop's accounts and must be kept for five years after the end of the financial year under the Norwegian Bookkeeping Act (bokføringsloven) § 13. Comments and delivery notes on orders are also kept today. You can ask for these to be deleted, see «Your rights». Your profile in the apps for shops is part of your Okam account and is deleted with it. Pictures you have uploaded are kept until the shop deletes them or the agreement with the shop ends. ### Why we process it We process the information to deliver the service you asked for: account, order, payment, delivery, receipt and table booking. The legal basis is our agreement with you (GDPR Article 6(1)(b)). Information that must be kept under the Bookkeeping Act is processed because the law requires it (Article 6(1)(c)). Error logs and security are processed on the basis of our legitimate interest in a safe and stable service (Article 6(1)(f)). Sign-in and the profile in the apps for shops are processed to provide the Okam account you use (Article 6(1)(b)) and on the basis of our legitimate interest in giving the shop's people secure access (Article 6(1)(f)). Usage statistics are processed on the basis of our legitimate interest in improving the apps (Article 6(1)(f)). If you ask to receive offers and news from a shop, the basis is your consent, and you can withdraw it at any time. ### Sharing with third parties We do not sell your personal data to third parties. When you place an order, we share the following with the shop: - Phone number - Date and time of the order - Payment method (no sensitive data) - Items and comments - Delivery address (if given) - E-mail address (if given) - First and last name (if given) ### Subprocessors To deliver the service, Okam uses these subprocessors: - Microsoft Azure: hosting, database, file storage, notifications and error logs - Cloudflare: hosting of the website - Twilio and GatewayAPI: SMS with one-time codes, receipts and messages - E-mail provider: sending one-time codes, receipts and invoices - Google: reading menus and answering the shop's questions about its own numbers (Gemini), translating menus, and address lookup for delivery (Google Maps) - Dintero: card payment, Vipps and invoice online - Vipps: Vipps payment directly at some shops - Surfboard: card payment and gift cards at the till - Wolt and Foodora: orders and delivery, when the shop uses them - Fiken, Tripletex, Emonkey and Kravia: accounting and invoicing, when the shop uses them - Discord (USA): internal notices about feedback and deletion requests - Cal.com: booking a demo on the website ### Transfers outside the EEA Some subprocessors are based in the USA. We only transfer data there when the transfer has a lawful basis: the EU adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or the EU standard contractual clauses. ### Cookies When the site requires login, one necessary cookie (__Host-okam_site) is set to keep you logged in. Your answers in «Find your Okam» are stored only in the browser until the tab is closed, and your cookie choice is stored in the browser (okam-samtykke). The fonts are served from our own servers. The demo booking from Cal.com is loaded only when you press «Book a demo», and Cal.com then receives your IP address. Statistics (Google Analytics) and marketing (Meta Pixel) are used only if you say yes, and can be switched off again here: [Change consent](https://okam.no/en/privacy#cookies). ### Your rights You have the right to see the information we hold about you, and to have it corrected or deleted. You can also ask to receive a copy of it, object to processing based on legitimate interest, and withdraw a consent. Write to kontakt@okam.no, and we will answer within one month. If it concerns an order or a shop's customer register, we pass the request on to the shop. If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).