BOstageR Website Privacy Policy
- Version
- 1.0
- Effective date
- 10 August 2026
- Last updated
- 10 August 2026
1. Who we are
This Privacy Policy explains how BOtag Norge AS processes personal data in connection with the BOstageR public website and demo requests.
Data controller
BOtag Norge AS
Reg. no. 932 017 814
VAT no. 932 017 814 MVA
Tordenskiolds gate 2
0160 Oslo
Norway
Privacy contact: support@botag.no
In this Privacy Policy, "BOtag", "we", "us" and "our" refer to BOtag Norge AS.
2. Scope of this Privacy Policy
This Privacy Policy applies to the public BOstageR website at bostager.botag.no and to personal data processed by BOtag as controller when you visit the website or submit a Book Demo request.
It does not govern Customer Personal Data that BOtag processes on behalf of a BOstages customer as a data processor. Such processing is governed by the applicable customer agreement and BOstages Data Processing Agreement.
External websites and services linked from BOstageR may have their own privacy policies. When you leave the BOstageR website, the privacy practices of the destination service apply.
3. Personal data we process
When you visit the website, our hosting and security infrastructure may process technical information necessary to deliver and protect the website, including your IP address, user agent, requested URL or page, HTTP headers and related request metadata.
When you submit a Book Demo request, we process:
- your name;
- work email address;
- country;
- company name, if you choose to provide it;
- the BOstageR page from which the request was submitted;
- interface language;
- submission timestamp;
- user-agent information; and
- a pseudonymised hash derived from your IP address for abuse and rate-limit protection.
Your raw IP address is available transiently as part of the network request but is not stored in the Book Demo database. The stored rate-limit value is a truncated SHA-256-derived hash rather than the raw IP address.
The hidden anti-bot honeypot field is checked during submission but is not stored.
4. Why we process your data and our legal basis
We process ordinary website request data to deliver the website, maintain availability and security, prevent abuse and diagnose technical problems.
Our legal basis is GDPR Article 6(1)(f), legitimate interests. Our legitimate interests are operating a secure and reliable business website, protecting our infrastructure and users, and detecting or preventing misuse.
When you submit a Book Demo request, we process the information to receive your request, assess it, contact you, arrange or discuss a BOstageR demonstration and follow up on that specific enquiry.
Our legal basis is GDPR Article 6(1)(f), legitimate interests. Our legitimate interest is responding to and managing a B2B enquiry that you have deliberately submitted to BOtag. We consider this processing reasonably expected in the context of a requested business demonstration and limit the processing to what is necessary for that purpose.
We also process limited technical information associated with Book Demo requests to prevent spam, duplicate submissions and abuse.
We do not use Book Demo details for unrelated marketing under this processing purpose. If BOtag later wishes to use personal data for a materially different purpose, we will establish an appropriate legal basis and provide any additional information required by law before doing so.
We do not use the public website to make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Book Demo email handling
After a valid Book Demo request is submitted, the request is stored server-side and an email notification is sent to BOtag at support@botag.no.
The notification may contain your name, work email, country, company if provided, originating page, interface language and submission timestamp. Your email address is also used as the Reply-To address so that BOtag can respond directly to you.
The notification does not contain the stored IP hash or user-agent value.
The message is delivered using Lovable's managed transactional-email service and is received in BOtag's Microsoft 365 environment.
6. Service providers and recipients
BOtag uses service providers to operate the website and process Book Demo requests.
Cloudflare — content delivery, network security, TLS termination and bot/abuse protection.
Lovable — website hosting, application/server functionality and operational infrastructure.
Lovable Cloud / Supabase infrastructure — server-side database storage for Book Demo requests. The currently confirmed database region is AWS eu-west-1, Ireland.
Lovable managed email — transactional delivery of Book Demo notifications. The downstream email-delivery provider used behind this service is not exposed to BOtag through the current project configuration.
Microsoft 365 — BOtag's business email environment for receiving and responding to demo requests.
We may also disclose personal data where required by law, regulation, court order or competent authority, or where reasonably necessary to establish, exercise or defend legal claims.
Service providers may process personal data only for the purposes for which they are engaged and subject to applicable contractual and legal requirements.
7. International processing and transfers
The Book Demo database is currently hosted in Ireland within the EEA.
Other infrastructure providers operate global services. Depending on the provider and the location of a request, personal data may in some circumstances be processed outside Norway or the EEA.
Where a transfer of personal data outside the EEA is subject to GDPR Chapter V, BOtag requires an applicable lawful transfer mechanism and safeguards as required by data-protection law.
You may contact us at support@botag.no if you would like information about safeguards applicable to a particular processing activity.
8. Retention and deletion
We keep personal data only for as long as necessary for the purpose for which it was collected, subject to applicable legal, security and dispute-related requirements.
For a Book Demo request that does not become part of an ongoing customer relationship, the dedicated Book Demo record is retained for 12 months after the last meaningful contact relating to the enquiry.
"Last meaningful contact" means a substantive interaction relating to the demo request, evaluation of BOstageR or related commercial follow-up.
After that period, the Book Demo record is permanently deleted, unless retention is required because:
- the prospect has become a customer and the information is required as part of the customer relationship;
- BOtag has a legal or regulatory retention obligation;
- the information is reasonably required for an active dispute or legal claim; or
- a documented security, fraud or compliance reason requires temporary retention.
Any such exception will last only for as long as the relevant reason requires.
Non-customer correspondence relating to the demo enquiry is also retained only for as long as necessary for the enquiry and applicable legal or security requirements.
Technical and security logs are retained according to operational necessity and the retention configurations of the relevant infrastructure providers. Where BOtag does not control a fixed provider-side retention period, we apply the principle that the data should not be retained longer than necessary for security, operations and troubleshooting.
10. Security
BOtag applies technical and organisational measures intended to protect personal data from unauthorised access, loss, alteration or disclosure.
Book Demo records are stored server-side. The current database has Row Level Security enabled and does not permit anonymous or authenticated browser access to the demo_requests table; access is performed through the protected server-side service role.
We also use rate limiting, input validation, anti-bot controls and pseudonymisation of IP-derived rate-limit identifiers.
No method of transmission or storage is completely risk-free, but BOtag applies safeguards appropriate to the nature and purpose of the processing.
11. Your rights
Subject to the conditions and exceptions in applicable data-protection law, you may have the right to:
- obtain information about and access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive personal data in a portable format where the legal requirements for data portability apply; and
- lodge a complaint with a competent supervisory authority.
Because our website and Book Demo processing relies in relevant parts on legitimate interests, you have the right to object on grounds relating to your particular situation.
To exercise your rights, contact support@botag.no.
We may need information reasonably necessary to verify your identity before acting on a request.
12. Complaints
If you believe BOtag's processing of your personal data infringes applicable data-protection law, please contact us so we can review the matter.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or another competent supervisory authority where applicable.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our website, processing activities, providers or legal requirements change.
The current version and last-updated date will always be shown on this page.
If a change materially affects how we process personal data, we will provide appropriate additional notice where required.
14. Contact
For privacy questions or to exercise your data-protection rights:
BOtag Norge AS
Tordenskiolds gate 2
0160 Oslo
Norway
support@botag.no