Privacy and Cookies

This notice applies to activitybox.co (English) and aktivitetskassen.no (Norwegian). The data controller is the National Center for Food, Health and Physical Activity (MHFA) at Western Norway University of Applied Sciences. We process personal data with data minimization and privacy by default.

1. What we collect

The website has no user accounts, registration, or forms that store personal data with us. We do not normally ask for your name, email, or other contact details to use the site.

When you visit the website, the following may be processed automatically:

• Technical server logs at our hosting provider (for example IP address, timestamp, requested page, and browser type) for secure operation and troubleshooting.
• Aggregated usage statistics via Plausible Analytics (see section 2).
• Requests to our content service when your browser fetches activities, images, and videos from Strapi Cloud. These requests may be logged by the provider with technical information such as IP address.

If you contact us by email, we process the information you choose to send in order to respond.

2. Analytics

We use Plausible Analytics, a privacy-friendly analytics service, to understand website usage in aggregated form (for example page views and which pages are visited).

We use Plausible without marketing or tracking cookies. The default setup does not build personal profiles. Logged page URLs may include search terms if you use site search (for example /search?q=…).

3. Images and video

The website does not use third-party video players (such as YouTube or Vimeo). Video is played with the browser’s built-in player. Images and video files are served from our publishing platform on Strapi Cloud.

4. Cookies and local storage

We do not use cookies for advertising or profiling.

Necessary technical mechanisms may still be used by our hosting/CDN provider to deliver the website securely.

We also use browser local storage (sessionStorage) to remember whether you chose light or dark display mode. This preference is cleared when you close the browser tab and is not used for tracking or marketing.

5. In-browser features

PDF download is generated locally in your browser; activity content is not sent to a separate PDF service operated by us. The share feature uses your browser’s share or copy function and does not send data to us beyond what you choose to share.

6. Legal basis

Our legal basis is legitimate interest for operation, security, troubleshooting, and service improvement (aggregated analytics), under GDPR Article 6(1)(f). Email enquiries are processed on the basis of legitimate interest or your consent when you contact us.

7. Processors

We use the following providers to operate the website. Required data processing agreements are in place where applicable:

Netlify – hosting, CDN, and technical operation

Strapi Cloud – content management, images, and video

Plausible Analytics – aggregated usage statistics

External links in content (for example to supervisory authorities or other websites) open in a new tab. The privacy rules of the destination site then apply.

8. Your rights

You have the right to access, rectification, erasure, restriction, objection, and data portability where applicable. Contact us at post@mhfa.no to exercise your rights.

You may also lodge a complaint with your data protection authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet): datatilsynet.no.

9. Contact

Email: post@mhfa.no

Organization: National Center for Food, Health and Physical Activity (MHFA), at Western Norway University of Applied Sciences

10. Last updated

7 July 2026