This notice applies to activitybox.co (English) and aktivitetskassen.no (Norwegian). The data controller is the National Center for Food, Health and Physical Activity (MHFA) at Western Norway University of Applied Sciences. We process personal data with data minimization and privacy by default.
1. What we collect
The website has no user accounts, registration, or forms that store personal data with us. We do not normally ask for your name, email, or other contact details to use the site.
When you visit the website, the following may be processed automatically:
- Technical server logs at our hosting provider (Cloudflare), for example IP address, timestamp, requested page, and browser type, for secure operation and troubleshooting.
- Aggregated usage statistics via Plausible Analytics (see section 2).
- Requests to our content service when your browser fetches activities, images, and videos from our CMS on Cloudflare. These requests may be logged by the provider with technical information such as IP address.
If you contact us by email, we process the information you choose to send in order to respond.
2. Analytics
We use Plausible Analytics, a privacy-friendly analytics service, to understand website usage in aggregated form (for example page views and which pages are visited). Both language domains share the same Plausible dashboard; traffic is separated with a hostname filter.
We use Plausible without marketing or tracking cookies. The default setup does not build personal profiles. Logged page URLs may include search terms if you use site search (for example /search?q=…).
3. Images and video
The website does not use third-party video players (such as YouTube or Vimeo). Video is played with the browser’s built-in player. Images and video files are stored and served from Cloudflare R2 (EU) via our CMS. Images may be resized with Cloudflare Image Transformations.
4. Cookies and local storage
We do not use cookies for advertising or profiling.
Necessary technical mechanisms may still be used by our hosting/CDN provider (Cloudflare) to deliver the website securely.
We also use browser local storage (sessionStorage) to remember whether you chose light or dark display mode. This preference is cleared when you close the browser tab and is not used for tracking or marketing.
5. In-browser features
PDF download is generated locally in your browser; activity content is not sent to a separate PDF service operated by us. The share feature uses your browser’s share or copy function and does not send data to us beyond what you choose to share.
6. Legal basis
Our legal basis is legitimate interest for operation, security, troubleshooting, and service improvement (aggregated analytics), under GDPR Article 6(1)(f). Email enquiries are processed on the basis of legitimate interest or your consent when you contact us.
7. Processors
We use the following providers to operate the website. Required data processing agreements are in place where applicable:
- Cloudflare – hosting (Workers), CDN, database (D1), and file storage (R2) in the EU for the website and CMS
- Plausible Analytics – aggregated usage statistics
External links in content (for example to supervisory authorities or other websites) open in a new tab. The privacy rules of the destination site then apply.
8. Your rights
You have the right to access, rectification, erasure, restriction, objection, and data portability where applicable. Contact us at post@mhfa.no to exercise your rights.
You may also lodge a complaint with your data protection authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet): datatilsynet.no.
9. Contact
Email: post@mhfa.no
Organization: National Center for Food, Health and Physical Activity (MHFA), at Western Norway University of Applied Sciences
10. Last updated
4 November 2026