Privacy Policy

Last updated: 17-June-2026

1. Introduction

BeingBasics respects your privacy and wants every visitor and customer to clearly understand how personal data is collected, used, stored, protected and shared when using our website and services.

This Privacy Policy explains how VKINGS AS, operating under the brand name BeingBasics, processes personal data when you visit beingbasics.com, browse our linen clothing, use our product pages, add items to cart, use wishlist, create an account, use Vipps login where available, place an order, make a payment, track an order, request delivery support, contact customer service, request a return or exchange, leave a review, subscribe to marketing, interact with cookies, or use agentic commerce features such as UCP, ACP and MPP.

We have written this policy in a detailed manner because we want visitors to understand not only what data is collected, but also why it is needed at each step of the shopping journey.

This Privacy Policy applies to:

• Website visitors who browse beingbasics.com.
• Customers who purchase products from BeingBasics.
• Users who create or access a customer account.
• Users who log in or register through Vipps or similar login methods, where available.
• People who contact us through forms, email, phone or social media.
• People who subscribe to newsletters or marketing communication.
• People who leave product reviews or submit review images.
• People who use order tracking, return or exchange features.
• People who use AI agents, shopping assistants, browsers, automation tools or agentic commerce protocols to interact with BeingBasics.

This Privacy Policy should be read together with our Terms and Conditions, Cookie Policy, Shipping Policy, Return and Exchange Policy and any checkout-specific payment terms shown during purchase.

2. Who We Are and Who Controls Your Data

For the purpose of applicable data protection laws, VKINGS AS is the data controller for personal data processed through BeingBasics and beingbasics.com.

A data controller is the business that decides why personal data is collected and how it is used. This means VKINGS AS is responsible for deciding how customer, visitor, order, payment, delivery, cookie, account and agentic-commerce-related data is processed on BeingBasics.

Data Controller Details

Legal business name: VKINGS AS

Brand name: BeingBasics

Organisation number: 922 082 928

Registered address: Drammensveien 270, 3420 Lierskogen, Norway

Email: info@beingbasics.com

Phone: +47 481 26 858

We have not appointed a Data Protection Officer because our current processing activities do not require one. However, all privacy questions, access requests, deletion requests, correction requests, cookie questions and agentic-commerce privacy questions can be sent to info@beingbasics.com.

3. What Personal Data Means

Personal data means any information that identifies you or can reasonably be connected to you.

Some personal data directly identifies you, such as your name, email address, phone number or delivery address. Other data may identify you indirectly, such as an IP address, cookie ID, order number, transaction reference, account login record, device information, browser information, agent session ID or order tracking request.

Examples of personal data include:

• Name, email address and phone number.
• Billing address and shipping address.
• Order number, product details, size, colour and variant choices.
• Payment status, transaction ID and payment provider reference.
• Account login details and password hash.
• IP address, device details, browser type and website activity.
• Cookie consent choices and cookie identifiers.
• Customer support messages, contact form messages and return requests.
• Product reviews, ratings and review images.
• Agentic commerce instructions sent through UCP, ACP, MPP or similar automated tools.
• Personal data does not include information that has been fully anonymised so that it can no longer identify you.

4. Our Privacy Principles

We process personal data carefully and only for clear, lawful and relevant purposes. Our goal is to collect only what is needed to operate our online store, provide customer service, fulfil orders, protect the website and improve the shopping experience.

Our privacy principles are:

• Transparency: We explain what we collect and why we collect it.
• Purpose limitation: We use personal data only for the purpose it was collected, unless another lawful and compatible reason applies.
• Data minimisation: We collect only the data needed for the relevant purpose.
• Accuracy: We aim to keep customer and order information accurate and updated.
• Security: We use reasonable measures to protect personal data.
• Retention control: We keep data only as long as needed or legally required.
• User control: You can exercise your privacy rights by contacting us.
• No sale of personal data: We do not sell your personal data.
• Agentic commerce clarity: When AI agents, shopping agents or machine-readable commerce protocols are used, we process the data only for the requested browsing, cart, checkout, payment, order, delivery or support purpose.

5. Personal Data We Collect

The personal data we collect depends on how you interact with BeingBasics. A person who only reads a blog page will usually share less data than a customer who creates an account, places an order, uses payment services or asks an AI shopping assistant to complete a cart action.

5.1 Website Visit and Technical Data

When you visit beingbasics.com, certain technical data may be collected automatically. This helps the website load correctly, protects the site from misuse and allows us to understand how the website performs.

This may include:

• IP address.
• Browser type and browser version.
• Device type, operating system and screen size.
• Language settings and time zone.
• Pages visited and time spent on pages.
• Products viewed, categories viewed and filters used.
• Referring website, campaign source or search source.
• Session ID, cookie ID and consent preference.
• Server logs, security logs and error logs.
• Approximate location based on IP address.

This information helps us keep the website functional, secure and useful. If analytics or marketing cookies are involved, they will be handled according to your cookie choices.

5.2 Product Browsing Data

When you browse our products, the website may process information about how you interact with the store. This helps us understand what customers are looking for and improve product pages, navigation, product availability and shopping experience.

This may include:

• Products viewed.
• Product categories viewed.
• Search terms used on the website.
• Sizes, colours or variants selected.
• Products added to cart.
• Products removed from cart.
• Products added to wishlist.
• Recently viewed products.
• Product recommendations shown or clicked.

Some product browsing functions are necessary for the website to work, such as remembering cart items during a session. Other browsing analysis may depend on analytics or marketing cookies and will follow your consent choices.

5.3 Contact Details

We collect contact details when you place an order, create an account, contact us, request support, subscribe to marketing, request a return or otherwise provide the information to us.

This may include:

• First name and last name.
• Email address.
• Phone number.
• Billing address.
• Shipping address.
• Country, city and postal code.
• Company name, if you provide it.
• Social media handle, if you contact us through social media.

We use contact details to communicate with you, process orders, deliver products, respond to questions, manage returns and provide support.

5.4 Customer Account Data

If you create a customer account, we process account data to help you log in, manage orders, view order history, save details and use account-related features.

This may include:

• Name and email address.
• Username.
• Password hash.
• Account creation date.
• Login activity.
• Saved billing and shipping address.
• Order history.
• Wishlist items, if enabled.
• Recently viewed products, if enabled.
• Communication preferences.
• Return, exchange or customer support history linked to your account.

We do not store your password in plain text. Passwords are stored in a protected hashed format. You are responsible for keeping your account login details safe.

5.5 Vipps Login or Third-Party Login Data

If BeingBasics allows login or registration through Vipps or another third-party identity provider, we may receive limited information needed to verify your identity and create or manage your account.

This may include:

• Name.
• Email address.
• Phone number.
• User ID or authentication reference from the login provider.
• Login timestamp.
• Authentication status.

The third-party login provider may also process your personal data under its own privacy policy. BeingBasics uses third-party login information only to authenticate access and support the customer account experience.

5.6 Cart and Checkout Data

When you add products to cart or start checkout, we process the information needed to maintain your cart, calculate order details, prepare checkout and complete the purchase.

This may include:

• Products added to cart.
• Product size, colour and variant.
• Quantity and cart value.
• Discount code, if used.
• Shipping method selected.
• Checkout step reached.
• Billing and shipping details entered.
• Email address entered during checkout.
• Payment method selected.
• Checkout errors or failed checkout attempts.
• Marketing consent choices selected during checkout.

If you do not complete your purchase, some cart data may remain temporarily so that the website can remember your cart. If abandoned cart reminders are active, they will be used only where legally permitted and according to applicable consent and marketing rules.

5.7 Order Data

When you place an order, we collect the information needed to process your purchase, confirm payment, prepare your products, arrange delivery and support your order after purchase.

This may include:

• Full name.
• Email address and phone number.
• Billing address and shipping address.
• Product name, size, colour, variant and quantity.
• Order number and order date.
• Order value, currency, tax and discount details.
• Payment method and payment status.
• Delivery method and delivery status.
• Customer notes added during checkout.
• Return, exchange or refund status, if applicable.
• Customer communication related to the order.

We use order data to fulfil your purchase, send order updates, provide support, handle returns and comply with accounting, tax and legal obligations.

5.8 Payment Data

Payments are processed through third-party payment providers. BeingBasics receives only the payment information needed to confirm and manage the order.

Depending on the payment options active on our website, providers may include:

• Vipps.
• Stripe.
• Klarna.
• Card payment providers.
• Other payment or checkout providers added in the future.
• Machine payment or agentic payment providers connected to MPP, where enabled.

Payment-related data may include:

• Payment method selected.
• Payment status.
• Transaction ID.
• Payment provider reference.
• Amount paid and currency.
• Payment date.
• Refund status.
• Fraud or verification status.
• Payment failure reason, where available.
• Machine-payment authorisation reference, if MPP is used.

BeingBasics does not store full card numbers, CVV codes or complete payment card details. Payment providers may process personal data for payment authorisation, fraud prevention, identity checks, credit checks, compliance, disputes and regulatory purposes under their own privacy notices.

5.9 Shipping and Delivery Data

To deliver your order, we process and share delivery information with shipping and logistics partners.

This may include:

• Name.
• Shipping address.
• Email address.
• Phone number.
• Order number.
• Delivery method.
• Delivery instructions.
• Tracking number.
• Delivery status.
• Return shipment details.

We use this data to create shipments, provide tracking updates, manage failed deliveries, process returns and resolve delivery-related support requests.

5.10 Return, Exchange and Refund Data

If you request a return, exchange, refund or complaint handling, we process the data needed to verify the order and manage your request.

This may include:

• Name and contact details.
• Order number.
• Product returned or exchanged.
• Reason for return, if provided.
• Photos of product condition, if provided.
• Return shipment information.
• Refund status or exchange status.
• Customer support communication.

Return and refund data may be kept where needed for customer service, accounting, fraud prevention, dispute handling and legal compliance.

5.11 Customer Support and Contact Form Data

When you contact us by form, email, phone, social media or another support channel, we process the data needed to respond to your request.

This may include:

• Name.
• Email address.
• Phone number.
• Message content.
• Order number, if provided.
• Product details, if relevant.
• Photos or attachments, if provided.
• Complaint details.
• Return or exchange request.
• Internal support notes and resolution status.

Please do not send sensitive personal information through contact forms or normal email unless it is necessary for your request.

5.12 Order Tracking Data

If you use order tracking, we process the information needed to verify and display order status.

This may include:

• Order ID.
• Billing email.
• Order status.
• Payment status.
• Delivery status.
• Tracking information.

Order tracking should require enough information to prevent unauthorised access to someone else’s order.

5.13 Product Review and Feedback Data

If you submit a product review, rating, image review or feedback, we process the information needed to display, manage and moderate the review.

This may include:

• Name or display name.
• Rating.
• Review title.
• Review text.
• Product reviewed.
• Review date.
• Verified purchase status, if available.
• Review image, if submitted.
• Moderation status.
• Follow-up communication related to the review.

Reviews may be displayed publicly on product pages or other areas of the website. We do not intentionally publish private information such as email address, phone number, billing address or shipping address as part of a review.

If you submit a review image, you confirm that:

• You have the right to share the image.
• The image does not violate another person’s rights.
• The image does not include private information you do not want public.
• BeingBasics may display the image together with your review.
• You may contact us to request removal or anonymisation.

5.14 Newsletter and Marketing Data

If you subscribe to our newsletter or agree to receive marketing, we process data needed to send relevant communication and manage your consent.

This may include:

• Name, if provided.
• Email address.
• Phone number, if SMS marketing is used.
• Signup date and signup source.
• Consent timestamp.
• Marketing preferences.
• Email open and click activity, if measured.
• Unsubscribe date.
• Suppression list status.

Marketing emails may include new product launches, linen styling ideas, seasonal updates, offers, brand updates, product recommendations and linen care content. You can unsubscribe from marketing at any time.

5.15 Analytics and Advertising Data

If analytics or advertising tools are enabled, we may process data that helps us understand website performance and advertising results.

This may include:

• Pages viewed.
• Products viewed.
• Events completed, such as add-to-cart or purchase.
• Traffic source and campaign source.
• Device and browser information.
• Approximate location.
• Conversion value.
• Cookie ID or advertising ID.
• Hashed customer data, where legally permitted and consented.
• Non-essential analytics and advertising tracking should only be used where required consent has been given.

5.16 Security and Fraud Prevention Data

To protect BeingBasics, our customers and our website, we process security-related data.

This may include:

• IP address.
• Login attempts and failed login attempts.
• Device and browser details.
• Suspicious activity logs.
• Firewall logs.
• Spam form submissions.
• Malware scan logs.
• Checkout fraud signals.
• Payment verification signals.
• Admin access logs.
• Agent request logs, where UCP, ACP or MPP is used.

This data is used to prevent fraud, spam, malicious activity, unauthorised access, account misuse, checkout abuse, payment misuse and cyberattacks.

6. Agentic Commerce, UCP, ACP and MPP

BeingBasics has implemented agentic commerce capabilities, including UCP, ACP and MPP protocols. These protocols are designed to help approved browsers, AI assistants, shopping agents, automation tools and machine-readable systems understand and interact with certain commerce functions on our website.

These tools may support activities such as product discovery, product availability checks, cart actions, checkout preparation, order status checks, payment authorisation and machine-readable commerce communication.

6.1 What Agentic Commerce Means for Privacy

Agentic commerce means that a customer may interact with BeingBasics directly, or through a tool acting on the customer’s behalf. For example, a customer may ask a browser assistant, shopping assistant or AI agent to compare linen shirts, add a product to cart, check product availability, prepare checkout, or request order status.

When this happens, BeingBasics may process data such as:

• Agent or tool identity.
• Protocol used, such as UCP, ACP or MPP.
• Request timestamp.
• Product requested or viewed.
• Cart action requested.
• Checkout instruction.
• Customer-provided delivery or contact information.
• Payment authorisation status.
• Order status request.
• Consent or authorisation signal from the customer or agent.
• Security and fraud prevention signals.

BeingBasics processes agentic commerce data only to complete or support the requested action, protect the website, maintain audit records, prevent misuse and comply with legal obligations.

6.2 Universal Commerce Protocol (UCP)

UCP may allow authorised tools to read machine-friendly commerce information from BeingBasics. This can help digital tools understand product data, store policies, checkout flow, availability, return rules and other commerce information.

UCP-related processing may include:

• Product discovery requests.
• Product detail requests.
• Price, stock or variant availability checks.
• Cart preparation instructions.
• Checkout path discovery.
• Policy discovery, such as shipping, return, privacy or terms links.
• Agent identity or request metadata.
• Rate-limit, abuse-prevention and security logs.

UCP should not require personal data for general product browsing. Personal data may be processed only when the tool or customer moves into account, cart, checkout, payment, delivery, order tracking, return or support actions.

6.3 Agentic Commerce Protocol (ACP)

ACP may allow authorised agents or tools to perform structured commerce actions on behalf of a customer. This can include actions such as adding a product to cart, preparing checkout, checking order status or passing customer instructions in a structured format.

ACP-related processing may include:

• Agent ID or tool identifier.
• Customer instruction provided to the agent.
• Product selection, size, colour and variant.
• Cart creation or cart update request.
• Checkout preparation request.
• Delivery preference or address, if provided.
• Order status request.
• Authentication or authorisation signal.
• Consent and audit logs.
• Fraud and misuse-prevention logs.

BeingBasics treats ACP interactions as customer-directed actions when the customer has authorised the agent or tool. If a third-party agent acts independently, that third party may also be responsible for how it collects and handles the customer’s data.

6.4 Machine Payment Protocol (MPP)

MPP may support machine-readable payment coordination or payment authorisation connected to agentic commerce. It may help an authorised tool or payment provider understand payment instructions, payment status, order reference or settlement information.

MPP-related processing may include:

• Order reference.
• Payment request reference.
• Payment authorisation status.
• Transaction ID or machine-payment reference.
• Payment provider response.
• Amount, currency and order total.
• Refund or cancellation status.
• Fraud prevention and risk signals.
• Audit logs for payment-related protocol calls.

BeingBasics does not store full card details through MPP. Payment credentials, payment instruments, wallets, tokens or card data are handled by the relevant payment provider, wallet provider, checkout provider or authorised payment service.

6.5 Customer Responsibility When Using Agents

If you choose to use an AI assistant, browser assistant, shopping agent or other automated tool, you are responsible for deciding what information you allow that tool to access and share with BeingBasics.

Before using an agent, you should check:

• What data the agent collects from you.
• Whether the agent can view your browsing, cart, account or checkout data.
• Whether the agent can submit delivery or contact details on your behalf.
• Whether the agent can initiate checkout or payment authorisation.
• Whether the agent stores your instructions or order history.
• The agent provider’s own privacy policy and terms.

BeingBasics is responsible for personal data it receives and processes as controller. Third-party agents, browsers, assistants or automation tools may act as separate controllers for the data they collect before sending requests to BeingBasics.

6.6 Security Logs for Agentic Commerce

To protect customers and the website, BeingBasics may keep logs of agentic protocol interactions.

These logs may include:

• Protocol endpoint requested.
• Agent or client identifier.
• IP address or network metadata.
• Timestamp.
• Request type.
• Order or cart reference, if relevant.
• Authentication or authorisation result.
• Error response or blocked request.
• Fraud or abuse-prevention signals.

These logs are used for security, fraud prevention, troubleshooting, auditability and compliance. They are not used to sell personal data.

7. Sources of Personal Data

We collect personal data from different sources depending on how you interact with BeingBasics.

7.1 Data Directly From You

We collect data directly from you when you:

• Visit the website.
• Create an account.
• Add products to cart or wishlist.
• Enter checkout details.
• Place an order.
• Make a payment.
• Contact customer support.
• Subscribe to marketing.
• Leave a review.
• Request a return or exchange.
• Track an order.
• Communicate with us on social media.

7.2 Data Collected Automatically

We may collect data automatically through:

• Cookies.
• Server logs.
• Website security tools.
• Analytics tools.
• Cart and checkout systems.
• WooCommerce functionality.
• Browser and device signals.
• Tracking pixels, where consented.
• Consent management tools.
• UCP, ACP or MPP protocol logs.

7.3 Data From Service Providers

We may receive personal data or status updates from service providers such as:

• Payment providers.
• Delivery providers.
• Email providers.
• Hosting providers.
• Security providers.
• Analytics providers.
• Marketing tools.
• WordPress and WooCommerce plugins.
• Login and authentication providers.
• Agentic commerce or payment protocol providers, where used.

8. How We Use Personal Data

We use personal data only when we have a clear purpose and a valid legal basis.

8.1 To Operate the Website

We use technical and session data to load pages, display products, support search, maintain cart, enable checkout, manage account login, remember cookie choices and protect the website.

Legal basis: legitimate interest and contract where needed for requested services.

Example: keeping products in your cart while you continue browsing.

8.2 To Process Orders

We use order and contact data to receive orders, confirm purchases, prepare products, send order confirmation and manage order updates.

Legal basis: contract and legal obligation.

Example: using your shipping address to prepare delivery.

8.3 To Process Payments

We use payment-related data to confirm transactions, process refunds, handle failed payments, prevent payment fraud and keep required transaction records.

Legal basis: contract, legal obligation and legitimate interest.

Example: receiving a payment confirmation from Stripe, Vipps, Klarna or another provider.

8.4 To Deliver Products

We use delivery data to create shipments, provide tracking, communicate delivery updates and resolve delivery problems.

Legal basis: contract and legitimate interest.

Example: sharing your name, address and phone number with a delivery provider.

8.5 To Manage Customer Accounts

We use account data to allow login, show order history, save customer details and protect accounts from misuse.

Legal basis: contract and legitimate interest.

Example: allowing you to log in and view previous orders.

8.6 To Provide Customer Support

We use communication and order data to answer questions, solve order issues, process returns, manage exchanges and respond to complaints.

Legal basis: contract and legitimate interest.

Example: using your order number to check delivery or return status.

8.7 To Send Marketing

We use marketing data to send newsletters, offers, new collection updates, style content and product recommendations where legally permitted.

Legal basis: consent or legitimate interest where permitted by law.

Example: sending a newsletter after you subscribe.

8.8 To Improve the Website and Product Experience

We use browsing, analytics and order data to understand what customers like, improve product pages, improve size information, improve checkout and make the website easier to use.

Legal basis: legitimate interest or consent depending on the tool used.

Example: reviewing which product pages have high interest.

8.9 To Support Agentic Commerce

We use UCP, ACP and MPP-related data to allow authorised tools to interact with product discovery, cart, checkout, payment and order features in a structured and secure way.

Legal basis: contract, legitimate interest, consent or legal obligation depending on the action.

Example: an authorised agent requests cart creation based on your instruction.

8.10 To Protect Security and Prevent Fraud

We use security data to prevent spam, unauthorised access, payment misuse, malicious activity, scraping abuse and protocol misuse.

Legal basis: legitimate interest and legal obligation where applicable.

Example: blocking suspicious agent requests or failed login attempts.

8.11 To Comply With Legal Obligations

We use order, payment, accounting and communication records to comply with tax, accounting, consumer rights, legal claims and regulatory obligations.

Legal basis: legal obligation and legitimate interest.

Example: keeping invoice records for accounting requirements.

9. Legal Bases for Processing

Under GDPR, we must have a legal basis for processing personal data. The legal basis depends on the purpose of processing.

9.1 Contract

We rely on contract when processing is needed to provide something you requested, such as processing an order, taking payment, delivering products, creating an account or handling returns.

9.2 Legal Obligation

We rely on legal obligation when we must process or keep data because the law requires it, such as accounting records, tax records, consumer rights records and lawful authority requests.

9.3 Consent

We rely on consent when you choose to allow certain processing, such as newsletters, non-essential cookies, analytics cookies, marketing cookies, advertising pixels or certain review image uses.

You can withdraw consent at any time. Withdrawal does not affect processing that happened before consent was withdrawn.

9.4 Legitimate Interest

We rely on legitimate interest when processing is necessary for normal business, website operation, customer support, fraud prevention, website improvement or security, and where your privacy rights do not override that interest.

9.5 Legal Basis Table

10. Cookies and Tracking Technologies

BeingBasics uses cookies and similar technologies to make the website work, improve user experience, understand website performance, support cart and checkout, remember consent choices and measure marketing where consent is given.

Cookies are small files stored on your device. Similar technologies may include pixels, tags, scripts, local storage, session storage, tracking IDs, server-side events and protocol request logs.

10.1 Essential Cookies

Essential cookies are necessary for the website to function. Without them, key features such as cart, checkout, login, cookie consent storage and website security may not work correctly.

Cart cookies.

Checkout cookies.

Login/session cookies.

Security cookies.

Cookie consent storage cookies.

Form protection cookies.

10.2 Functional Cookies

Functional cookies help improve convenience and user experience.

Wishlist preferences.

Recently viewed products.

Account preferences.

Display preferences.

Language or location preferences, where enabled.

10.3 Analytics Cookies

Analytics cookies help us understand how visitors use the website. This can include page visits, product views, session duration, device type, browser type, traffic source and checkout journey data.

Analytics cookies are used only where required consent has been given.

10.4 Marketing Cookies

Marketing cookies help measure advertising and show relevant ads.

They may process:

• Ad clicks.
• Product views.
• Add-to-cart events.
• Checkout events.
• Purchase events.
• Campaign source.
• Cookie ID and device data.
• Marketing cookies and advertising pixels should not run before required consent has been given.

10.5 WooCommerce Cookies

BeingBasics uses WooCommerce functionality. WooCommerce may use cookies to support cart, checkout, customer login, order flow, recently viewed products, source attribution and session security.

10.6 WooCommerce Sourcebuster Cookies

WooCommerce Sourcebuster or similar attribution cookies may help us understand how customers found BeingBasics before placing an order.

These cookies may record:

• First visit source.
• Current visit source.
• Referring website.
• Landing page.
• Campaign source.
• Session details.
• Browser or user-agent information.

This helps us understand whether customers came from search engines, social media, ads, direct visits or referral links. Where this is not strictly necessary, consent choices should apply.

10.7 Managing Cookie Choices

When you visit BeingBasics, you should be able to choose your cookie preferences.

Accept all cookies.

Reject non-essential cookies.

Manage cookie categories.

Change your choices later.

Withdraw consent.

Withdrawing consent should be as easy as giving consent. You can also control cookies through your browser settings, but blocking essential cookies may affect cart, checkout, login and order tracking.

11. Marketing, Advertising and Personalisation

BeingBasics may use personal data for marketing only where legally permitted.

Marketing may include:

• Email newsletters.
• Product offers.
• New collection announcements.
• Style inspiration.
• Linen care tips.
• Seasonal campaigns.
• Customer surveys.
• Abandoned cart reminders, where enabled and lawful.
• Social media advertising, where enabled and consented.
• Search advertising, where enabled and consented.
• Retargeting, where enabled and consented.

You can unsubscribe from marketing emails at any time. Even if you unsubscribe from marketing, we may still send service messages related to orders, delivery, payment, returns, account security or customer support.

12. Automated Decision-Making and Profiling

BeingBasics does not intentionally use fully automated decision-making that produces legal or similarly significant effects on customers.

However, some automated tools may be used for normal ecommerce, payment, security and marketing operations.

Payment providers may use fraud checks or payment-risk checks.

Security tools may block suspicious traffic or login attempts.

Analytics tools may group website visitors by behaviour or traffic source.

Advertising platforms may create audience segments where consented.

Product recommendation tools may suggest products based on browsing or purchase behaviour.

UCP, ACP and MPP endpoints may use automated validation, authentication, rate-limiting and fraud checks.

If a third-party provider performs automated checks as an independent controller, that provider’s own privacy policy may also apply.

13. Who We Share Personal Data With

We share personal data only where necessary, lawful and connected to a clear purpose.

13.1 Payment Providers

We share payment-related data with payment providers to process payments, confirm transactions, prevent fraud, process refunds and handle disputes.

Name and billing details.

Email address.

Order reference.

Payment amount and currency.

Transaction reference.

Payment status.

Machine payment reference, if MPP is used.

13.2 Delivery Providers

We share delivery data with shipping providers so they can deliver your order and provide tracking.

Name.

Shipping address.

Phone number.

Email address.

Order number.

Tracking information.

13.3 Hosting and Technical Providers

We may use technical providers for website hosting, server management, CDN, WordPress maintenance, WooCommerce functionality, backups, security monitoring, error logging and email delivery.

These providers may access personal data only where needed to provide technical services.

13.4 Analytics and Marketing Providers

If analytics or marketing tools are used, we may share limited data with analytics, advertising, email or campaign tracking providers.

Non-essential analytics and marketing providers should only receive data where required consent has been given.

13.5 Agentic Commerce and Protocol Providers

If UCP, ACP or MPP interactions involve third-party agents, browsers, payment providers, wallets, automation systems or authorised commerce tools, certain data may be shared to complete the requested action.

This may include:

• Product and cart data.
• Checkout instruction data.
• Order reference.
• Payment request reference.
• Agent identifier.
• Customer authorisation status.
• Protocol request and response metadata.

Third-party agents and tools may have their own privacy policies. BeingBasics is not responsible for how a third-party agent processes your data before it is shared with us.

13.6 Customer Support, Legal and Accounting Providers

We may share data with customer support tools, accountants, bookkeepers, legal advisors, tax advisors, public authorities, courts or regulators where necessary.

13.7 Business Transfers

If BeingBasics or VKINGS AS is involved in a merger, sale, restructuring, acquisition, investment or transfer of business assets, personal data may be transferred as part of that transaction.

We will take reasonable steps to ensure personal data remains protected.

13.8 When You Ask Us to Share Data

We may share data when you direct us to do so, such as when you use a third-party login tool, authorise a payment provider, use a social media widget, use an AI shopping assistant or ask us to communicate with another person about your order.

14. Service Providers and Data Processing Agreements

When service providers process personal data on behalf of BeingBasics, we expect them to protect the data and process it only for the agreed purpose.

Where required, we use data processing agreements with service providers. These agreements may include requirements about:

• Processing instructions.
• Confidentiality.
• Security measures.
• Sub-processors.
• Data breach notification.
• Assistance with user rights.
• Deletion or return of data.
• International transfer safeguards.
• Audit and compliance obligations.

15. International Data Transfers

Some service providers may process personal data outside Norway or outside the European Economic Area.

This may happen when we use providers for:

• Payments.
• Analytics.
• Advertising.
• Email marketing.
• Hosting.
• CDN.
• Security.
• Backups.
• Customer support.
• Agentic commerce or payment protocol services.
• Where personal data is transferred outside the EEA, we use appropriate safeguards where required.
• Adequacy decisions.
• Standard Contractual Clauses.
• Data processing agreements.
• Transfer risk assessments where required.
• Encryption where appropriate.
• Access controls.
• Data minimisation.
• If a third-party provider acts as an independent controller, its own transfer terms and privacy policy may also apply.

16. How Long We Keep Personal Data

We keep personal data only for as long as necessary for the purpose it was collected, or for as long as required by law.

The retention period depends on:

• Why the data was collected.
• Whether an order was placed.
• Whether an account is active.
• Whether we need the data for accounting or tax records.
• Whether the data is needed for customer support.
• Whether there is a dispute, refund, return or legal claim.
• Whether consent has been withdrawn.
• Whether the data is stored in backups.
• Whether the data is needed for protocol security logs related to UCP, ACP or MPP.

When data is no longer needed, we delete, anonymise or securely archive it. Some information may remain in backups for a limited period until backups are overwritten.

17. Security of Personal Data

We use reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, disclosure or destruction.

Security measures may include:

• HTTPS/SSL encryption.
• Secure checkout.
• Trusted payment providers.
• Password hashing.
• Access control for admin users.
• Limited access to customer and order data.
• Strong password practices.
• Two-factor authentication for admin users where enabled.
• Firewall protection.
• Malware scanning.
• Spam protection.
• Login attempt protection.
• Regular WordPress, theme and plugin updates.
• Backup systems.
• Audit logs where available.
• Monitoring for suspicious activity.
• Rate limiting and validation for UCP, ACP and MPP endpoints.
• Developer confidentiality and access restrictions.

No website or online service can guarantee perfect security. You should also protect your account by using a strong password and not sharing login details.

If you believe your account has been accessed without permission, contact us immediately at info@beingbasics.com.

18. Data Breach Handling

If a personal data breach occurs, we will investigate the incident and take steps to reduce potential harm.

Our breach response may include:

• Identifying the affected system.
• Securing the website, account, endpoint or integration.
• Reviewing what data may be affected.
• Assessing risk to individuals.
• Documenting the incident.
• Notifying the relevant supervisory authority where required.
• Informing affected individuals where required.
• Fixing the cause.
• Reviewing security controls.
• Reviewing UCP, ACP or MPP protocol logs if agentic commerce endpoints are involved.

Where required by GDPR, a notifiable personal data breach will be reported to the relevant supervisory authority without undue delay and, where feasible, within 72 hours after we become aware of it.

19. Your Privacy Rights

Depending on your location and applicable law, you may have rights over your personal data.

19.1 Right of Access

You can ask us for a copy of the personal data we hold about you.

You can ask what data we process.

You can ask why we process it.

You can ask who we share it with.

You can ask how long we keep it.

You can ask whether agentic commerce data has been processed in relation to your account or order.

19.2 Right to Correction

You can ask us to correct inaccurate or incomplete personal data.

Name.

Email address.

Phone number.

Billing address.

Shipping address.

Account details.

19.3 Right to Deletion

You can ask us to delete personal data. This right may not apply where we need to keep data for legal, tax, accounting, fraud prevention, dispute, order, consumer rights or security reasons.

Where full deletion is not possible, we may anonymise, restrict or minimise the data where appropriate.

19.4 Right to Restriction

You can ask us to restrict processing in certain cases, such as when you dispute the accuracy of data, object to processing, or need the data for legal claims.

19.5 Right to Object

You can object to processing based on legitimate interest. You can always object to direct marketing.

If you object to direct marketing, we will stop using your personal data for that purpose.

19.6 Right to Data Portability

You can request certain personal data in a structured, commonly used and machine-readable format where the right applies.

19.7 Right to Withdraw Consent

Where we rely on consent, you can withdraw it at any time.

This may include consent for:

• Newsletter emails.
• Analytics cookies.
• Marketing cookies.
• Advertising pixels.
• SMS marketing, if used.
• Certain review image uses depending on the situation.

Withdrawing consent does not affect processing that happened before withdrawal.

19.8 Right Not to Receive Marketing

You can opt out of marketing communication at any time by clicking the unsubscribe link in emails, contacting us, updating preferences where available, or changing cookie choices for tracking-based advertising.

19.9 Right to Complain

You can complain to a data protection authority if you believe your personal data has been processed unlawfully.

For Norway, the relevant supervisory authority is Datatilsynet. You may contact us first so we can try to resolve your concern.

20. How to Exercise Your Rights

To exercise your privacy rights, contact us at info@beingbasics.com.

Please include:

• Your name.
• Your email address.
• Your request.
• Your order number, if relevant.
• Information that helps us identify the correct account or order.
• Whether your request relates to website use, an order, cookies, marketing, reviews, UCP, ACP, MPP or agentic commerce activity.
• We may ask you to verify your identity before responding. This helps us avoid sending personal data to the wrong person.

We will respond within the timeframe required by applicable law.

21. Authorised Agents

You may ask another person or authorised representative to make a privacy request on your behalf where permitted by law.

Before responding, we may ask for proof that you authorised the person, verification of your identity, verification of the agent’s identity and clarification of the request.

This protects your personal data from unauthorised access.

22. Children’s Privacy

Our website is not intended for children.

We do not knowingly collect personal data from children for marketing purposes.

If you are a parent or guardian and believe a child has provided personal data to BeingBasics, contact us at info@beingbasics.com. We will review the request and delete the data where appropriate.

23. Third-Party Websites, Tools and Links

Our website may contain links to third-party websites, payment pages, delivery tracking pages, social media pages, embedded content, review tools, login providers, AI agents, browser assistants or automation tools.

We are not responsible for the privacy practices, security or content of third-party websites or tools.

Examples of third-party services may include:

• Payment providers.
• Delivery providers.
• Social media platforms.
• Video or embedded content providers.
• Login providers.
• Analytics or advertising platforms.
• AI shopping assistants or agentic commerce tools.
• Wallet or machine-payment providers.

When you use a third-party service, its own privacy policy and terms may apply.

24. Public Content

If you post public content, other people may see it.

This may include:

• Product reviews.
• Review images.
• Comments.
• Tagged social media posts.
• Public messages.
• Public mentions of BeingBasics.

Please do not include private information in public reviews, comments or social media posts.

25. Customer Responsibility

You are responsible for providing accurate information and keeping your account secure.

Your responsibilities include:

• Providing correct name, email, phone and address details.
• Checking delivery details before placing an order.
• Keeping your password secure.
• Not sharing account login details.
• Using secure devices where possible.
• Updating your account information when needed.
• Making sure gift recipient information is correct.
• Reviewing third-party AI agent, browser assistant or shopping assistant privacy policies before using them.
• Contacting us if you suspect account misuse or unauthorised order activity.

26. Data Accuracy and Data Minimisation

We aim to keep personal data accurate and collect only the data needed for each purpose.

For example:

• We need your address to deliver an order.
• We need your email to send order confirmation.
• We need payment status to process your order.

We do not store full card details.

We do not ask for sensitive data unless necessary.

We do not collect marketing data without a valid legal basis.

We do not use UCP, ACP or MPP data for unrelated purposes.

27. Do We Sell Personal Data?

No. BeingBasics does not sell personal data.

We may share personal data with service providers where needed to operate the website, process orders, deliver products, send communication, maintain security, comply with law or provide customer support.

28. Do We Use Targeted Advertising?

BeingBasics may use targeted advertising or retargeting tools if enabled and where legally permitted.

This may include platforms such as:

• Google Ads.
• Meta Ads.
• TikTok Ads.
• Pinterest Ads.
• Other advertising platforms.

Targeted advertising may use:

• Cookie IDs.
• Product views.
• Add-to-cart events.
• Purchase events.
• Campaign source.
• Device and browser data.
• Hashed customer data where legally permitted.

These tools should only run where legally permitted and where required consent has been given. You can reject or withdraw marketing cookie consent through cookie settings.

29. Email, SMS and Service Communication

BeingBasics may contact you by email, phone, SMS where enabled, postal mail where needed, or social media if you contact us there.

29.1 Service Communication

Service communication is necessary to complete or support your order.

Order confirmation.

Payment confirmation.

Delivery updates.

Return updates.

Exchange updates.

Customer support replies.

Account security messages.

Protocol-related checkout or payment status updates, where applicable.

29.2 Marketing Communication

Marketing communication includes offers, product launches, style content, seasonal updates, brand updates and surveys.

You can opt out of marketing, but service communication may still be sent where needed.

30. Legal and Consumer-Rights Processing

We may process personal data to comply with consumer rights, legal duties and business obligations.

This may include:

• Order records.
• Delivery records.
• Return records.
• Refund records.
• Complaint records.
• Product issue records.
• Customer communication.
• Payment records.
• Accounting records.
• Agentic commerce audit records, where relevant to an order or payment.

This Privacy Policy explains how personal data is processed. Your commercial rights as a customer are explained separately in our Terms and Conditions, Shipping Policy and Return and Exchange Policy.

31. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Updates may happen because of:

• Website changes.
• New payment methods.
• New delivery providers.
• New marketing tools.
• New cookie tools.
• Legal updates.
• Security improvements.
• Business changes.
• New UCP, ACP, MPP or agentic commerce features.
• New integrations or service providers.

When we update the policy, we will change the “Last updated” date at the top of this page. If the changes are important, we may provide additional notice through the website or email where appropriate.

32. Contact Us

If you have questions about this Privacy Policy, cookies, customer data, order data, marketing data, UCP, ACP, MPP or agentic commerce processing, contact us using the details below.