Privacy and cookies

Last updated: 1 October 2026

Greenleaf Accounting AS processes personal data when you contact us or, if you consent, when you use our website. This page explains briefly what we process and why.

Data controller

Greenleaf Accounting AS is the data controller for the processing described on this page.

When you contact us

When you send us an enquiry through the contact form, by email or by any other means, we process the information you give us. That may include your name, email address, telephone number, company name, the service areas you selected and the content of your message.

We use the information to answer and follow up your enquiry.

Where the enquiry concerns a possible client relationship, the legal basis is normally that the processing is necessary in order to take steps at your request before a contract is entered into, cf. the General Data Protection Regulation article 6(1)(b). For other enquiries the legal basis is our legitimate interest in being able to receive and answer enquiries, cf. article 6(1)(f).

Technical suppliers used to operate the website, the form or email may process information on our behalf where that is necessary to deliver the services.

Enquiries that do not lead to a client relationship are deleted once we no longer need them, normally no later than 12 months after the last relevant contact. Where an enquiry does lead to a client relationship, relevant information may form part of the client documentation and be subject to other retention requirements.

Google Analytics and cookies

We use Google Analytics 4 to understand how the website is used. Analytics cookies are only used if you have consented to them.

Google Analytics may process information about page views, sessions and actions on the website, browser and device, approximate geographic area and pseudonymous identifiers.

Google Analytics uses cookies including:

• _ga – used to distinguish between users
• _ga_SK6QZ1V367 – used to retain information about a session

Google states a default lifetime of up to two years for these cookies. Your browser may shorten that further.

We use Google’s Consent Mode. The Google tag therefore also loads before you have made a choice, but with every consent set to denied. It then sets no analytics or advertising cookies, and Google receives only limited signals without cookies, for example the time, which page was viewed, the browser type, whether the visit came from an ad click, and that consent has not been given. Google may use such signals to model statistics and advertising results.

The legal basis for analytics is your consent, cf. the General Data Protection Regulation article 6(1)(a). The use of cookies and similar technology follows the Norwegian Electronic Communications Act (ekomloven) section 3-15.

Information from Google Analytics is made available to Google Ireland Limited. Google may also process information outside the EEA. Google states that relevant transfers are based on approved transfer mechanisms including the EU–U.S. Data Privacy Framework and standard contractual clauses where applicable.

You can withdraw your consent to analytics at any time. The Google Analytics cookies are then deleted, and Google again receives only the limited signals described above.

User and event data in Google Analytics is set to a retention period of 2 months. Standard aggregated reports may remain available for longer.

You can read more about how Google uses information from sites that use Google’s services at Google.

The website may store one necessary value in your browser to remember the cookie choice you have made. It is not used for analytics or marketing.

Ad measurement with Google Ads and ChatGPT Ads

If you consent to ad measurement, we use conversion measurement in Google Ads and in ChatGPT Ads from OpenAI. The purpose is to see whether an ad led to an enquiry, so that we know which advertising is worth paying for.

When you submit the contact form while this consent is active, Google and OpenAI receive the technical information needed for that measurement. This includes advertising and conversion data, a random reference number for the enquiry and pseudonymous identifiers associated with ad clicks. Both may store such identifiers in cookies on this website.

We do not send your name, email address, phone number, company name or the content of your message to Google, including in hashed form.

After you consent to ad measurement, the OpenAI Pixel may automatically detect supported contact information in the form, such as email address, phone number and name. It normalises this information and converts it to SHA-256 hashes in your browser before sending it to OpenAI to match the enquiry to an ad click. The contact information itself is not sent in plain text through this feature. We do not supply such information ourselves, and what we report to OpenAI from our server contains no contact information.

The OpenAI Pixel may use the cookies __oppref, for up to 30 days, and __obref, for up to 365 days. Data about users in the EEA is processed by OpenAI Ireland Limited. OpenAI states that valid transfer mechanisms are used for onward transfers outside the EEA where required.

The legal basis for ad measurement is your consent, cf. the General Data Protection Regulation article 6(1)(a). Ad measurement cookies are not set, and the OpenAI Pixel is not loaded, until you have consented to ad measurement. The Google Ads tag follows the Consent Mode described above. You can withdraw your consent at any time.

We do not use ad personalisation, remarketing or similar targeting in this setup. The measurement is used only to count enquiries, not to build audiences.

Cloudflare Turnstile

The contact form is protected by Cloudflare Turnstile, which prevents automated spam and abuse. Cloudflare processes the technical information needed for that security check. Turnstile is not used by Greenleaf for analytics or advertising.

Your rights

Under data protection law you may have the right to access the personal data we process about you, to have information corrected or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest.

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that has already taken place.

If you wish to exercise your rights, you can contact us at post@greenleaf.no.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe your personal data is being processed contrary to data protection law.