Privacy Notice

The platform canishundeskole.no is a mediation platform used by independent course instructors. Data controller responsibility is shared:

Canis Hundetrening AS is the controller for:
- Operation of the website and admin platform
- General enquiries via the contact form (when the recipient is head office)
- Newsletters and training tips by e-mail
- The AI chat function and conversations stored
- User accounts for logged-in instructors
- Aggregated/anonymised statistics on platform usage

The individual instructor is themselves controller for:
- Enrolments to their own courses (contact information, dog information, comments)
- Communication with their own course participants
- Their own invoices and payment data
- Marketing the instructor carries out outside the Canis platform

When you enrol on a course, the agreement is entered into between you and the instructor in question. Canis Hundetrening AS is then a data processor and stores the data in shared infrastructure on behalf of the instructor.

Employed instructors and lead instructors:
Some instructors are employed by another instructor ('lead instructor'). In such cases, the division of responsibility is as follows:
- The employed instructor delivers the teaching and is responsible for delivery quality
- The lead instructor is the formal seller and controller for the course participants' data, and receives the course payment
- The lead instructor has administrative access to the employee's profile, courses and enrolments as part of employer responsibility
- The lead instructor does not have access to the employee's private blog posts or personal communications
- Both the employee and lead instructor are bound by UK GDPR and course participants' rights — the lead instructor's organisation number is shown on the course details page
- In some cases — where the employed instructor has their own agreement for direct payment — the employee is themselves the controller. This will be indicated on the course details page

Contact:
Canis Hundetrening AS
Org. no: 912 079 953
Øyåsvegen 228, 7224 Melhus
E-mail: canis@canis.no

We collect only what we need to deliver our services.

When you enrol on a course:
- Name, address, e-mail, telephone number
- Information about your dog (name, breed, date of birth, health/behaviour notes)
- Any free text you write yourself
- Payment information (handled directly by Stripe — we never store card numbers)

When you buy a product in the shop:
- Name, email, phone number
- Delivery address (only for physical products sent by post)
- Billing address (for digital purchases — used on the receipt)
- Which products you have ordered
- Payment information (handled directly by Stripe)
- For digital products: timestamps for downloads and the number of times you have downloaded the file

When you subscribe to the newsletter:
- First name and e-mail

When you send a message via the contact form:
- Name, e-mail, chosen recipient, message

When you use the AI chat (from Phase 7):
- The content of the conversation
- Timestamp
- Anonymised IP address

When you visit the website:
- Technical data about your device and browser (IP address, browser type)
- Click patterns via our own anonymised analytics tools
- Cookies (see separate cookies notice)

We process the information to:

• Deliver the courses you have enrolled on — legal basis: performance of contract (UK GDPR article 6 1.b)
• Send you confirmations, invoices and course information — legal basis: performance of contract
• Deliver newsletters and training tips — legal basis: consent (UK GDPR article 6 1.a). You can unsubscribe at any time.
• Respond to enquiries — legal basis: legitimate interest (UK GDPR article 6 1.f) or performance of contract
• Operate the AI chat service — legal basis: consent given before the chat starts
• Improve our platform via anonymous statistics — legal basis: legitimate interest
• Fulfil bookkeeping and tax obligations — legal basis: legal obligation (UK GDPR article 6 1.c)

We only share information with third parties necessary to operate the service, and we have data processor agreements with all of them.

• Vercel Inc. (USA) — website hosting, image storage (Vercel Blob)
• Neon Inc. (EU) — database
• Stripe Inc. (USA/EU) — payment processing (card, Apple Pay, Google Pay, Stripe Link, Klarna, MobilePay)
• Resend Inc. (USA/EU) — transactional email (course confirmations, order confirmations, newsletters, notifications)
• OpenAI L.L.C. (USA) — embeddings for semantic search in Canis' knowledge library (from Phase 7)
• Anthropic PBC (USA) — the AI chat feature and AI-assisted content (from Phase 7)

The instructor or seller you have signed up for a course with, or purchased a product from, gets access to the information necessary to deliver the course or product.

We never sell data to third parties for marketing purposes.

Some of our data processors are established in the USA. Transfers to the USA take place either:

• Under the EU-USA Data Privacy Framework (2023) where the data processor is certified
• Or on the basis of the EU's Standard Contractual Clauses (SCC) with supplementary security measures

You can request a copy of the contractual basis by contacting us at canis@canis.no.

• Enrolments, orders and invoice documents: At least 5 years, cf. the Norwegian Bookkeeping Act § 13.
• General contact form enquiries: 2 years after last contact.
• Newsletter: Until you unsubscribe. We use Resend for sending and open/click statistics; data is stored in the EU.
• Digital download (shop purchase): Download access expires after the period the seller has set (typically 1 year). Log data on the number of downloads is kept as long as the order is active.
• AI chat conversations: 90 days. Conversations are then anonymised and used for quality improvement in aggregated form.
• User accounts (instructors): As long as the agreement with Canis is active, then 1 year before deletion.
• Technical log data: 12 months.

Under the UK GDPR, you have the following rights:

• Access — you can request to know what information we have about you
• Rectification — request that incorrect information is corrected
• Erasure — request that we delete your information, insofar as the law allows
• Restriction — request that we temporarily stop using your information
• Data portability — obtain a copy of your information in a structured format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where we process based on consent, you can withdraw it at any time

To exercise your rights, send an e-mail to canis@canis.no. We will respond within 30 days.

Right to lodge a complaint: You have the right to lodge a complaint with the Information Commissioner's Office if you believe we are processing information in breach of the regulations. See ico.org.uk.

We have technical and organisational measures such as:

• All traffic is encrypted with TLS
• Database data is located in the EU region (Neon) with regular backups
• Access control: only employees and instructors who need access have it
• Logging of access to sensitive systems
• Security requirements for instructors' own devices

If a data breach occurs, we will notify the Information Commissioner's Office within 72 hours and you as an affected party as soon as possible.

We may update this notice when our services or the law changes. We will notify you of major changes via e-mail (for instructors) or website notification (for customers).

The version date is shown at the top of the page.