Privacy policy

Last updated: 14 October 2026

1. Data controller

Bu Composite AS (org. no. 931 469 371) is the data controller for personal data collected via this website and our services.

Contact:
Email: [email protected]
Phone: +47 903 62 498
Address: Bergen, Norway

2. What data we collect

Booking a roof inspection or meeting

When you book an inspection or a meeting via the website, we collect: name, email address, phone number and address (for inspections). This data is necessary to deliver the service you request.

Legal basis: Contract (GDPR art. 6(1)(b)).

Launch notice

When you ask to hear about the launch under «Road to launch», we store your email address, the language you chose, the page you signed up from, the campaign code in the link you came from (if it has one) and when you signed up. The sign-up is not linked to your visits to the website. We only use the address to tell you about the launch. You can unsubscribe or ask us to delete the address at any time.

Legal basis: Consent (GDPR art. 6(1)(a)).

Pre-order

When you pre-order under «Road to launch», we store your name, email address, phone number, municipality, the language you chose, which button and page you came from, the campaign code in the link you came from (if it has one) and when you ordered. We use the data to hold your place in the queue, send you a confirmation with your place and contact you before production starts. We get a notice with your name, phone number and municipality in an internal channel of our messaging service (Slack), and the pre-order is recorded with the same details in our internal overview of customers and events. The overview is also used for internal daily summaries written with AI (see section 4). You pay nothing, and you can withdraw at any time by emailing [email protected].

Legal basis: Steps at your request before a possible contract (GDPR art. 6(1)(b)).

Email communication

Emails sent in connection with bookings and customer follow-up are stored to ensure good customer service and traceability. The content is available to relevant employees at Bu Composite.

Legal basis: Legitimate interest (GDPR art. 6(1)(f)).

Analytics and cookies

We use analytics tools to understand how the website is used. Analytics tools are loaded only after your consent via the cookie banner. No analytics cookies are set without your active consent.

Legal basis: Consent (GDPR art. 6(1)(a)).

Necessary storage

We store your cookie choice (cookie_consent) in your browser so we remember it. This is technically necessary and does not require consent. You can change your choice at any time with the «Cookie settings» link at the bottom of the page.

Visitor statistics

If you accept all cookies, we record your visits to the website with a visitor ID (the _buvidcookie). Among other things we record the pages you view, browser, operating system and device type, screen size and language, how far you scroll and how long you are active, clicks on links and buttons, and where you came from (the referring website and link parameters, see below). If you send a request or book, the visits and your email address are linked to the request. Without consent we do not record visits to the website.

Legal basis: Consent (GDPR art. 6(1)(a)).

The customer report

The first time you open the customer report we sent you, we store the time, so we know whether to follow up. We do not record which parts you look at, how far you scroll or how long you are active, and no cookie is stored on your device. What we recorded earlier about your use of the report has not been deleted.

Legal basis: Legitimate interest (GDPR art. 6(1)(f)).

Where you found us

When you send a request or book, we store where you found us, so we know which channels bring customers. That is:

• your answer to «How did you find us?», if you answer (optional)
• the link parameters in the address you arrived on: campaign codes (utm_) and click IDs from Google (gclid) or Facebook and Instagram (fbclid)
• Meta's IDs for the ad click (_fbc, _fbp), only if you have accepted all cookies

This is stored with your request on our side. If you have accepted all cookies, your browser keeps the link parameters for up to 30 minutes without activity, so they follow you as you move around the website. Without consent they are not stored in your browser. Our systems do not pass on Google click IDs. If you have accepted all cookies, the analytics and advertising tools in your browser (Google Tag Manager and Meta Pixel) send the address of the page you are on, with any link parameters, to Google and Meta, and we send Facebook and Instagram click IDs back to Meta with the ad events in section 3.

Legal basis: Legitimate interest (GDPR art. 6(1)(f)): knowing which channels bring customers.

Forms in our Facebook and Instagram ads

If you fill in a form in one of our ads on Facebook or Instagram, Meta passes on what you entered: name, phone number, email address and address, and which ad and form you answered. We store it in our customer system and use it to call or email you about what you asked for, for example a free roof check. So that we can call quickly, the person following you up gets an alert with your name, phone number and email address in our internal messaging service (Slack).

Legal basis: Steps at your request before a possible contract (GDPR art. 6(1)(b)).

3. Advertising and marketing

We use our own tools to manage advertising campaigns on social media.

Ad tracking

We use tracking tools from advertising platforms to measure the effect of our ads. The following events may be sent to the advertising platform:

• When you book an inspection or send a request about a meeting, a new build or the waiting list
• When a booking is confirmed
• When a quote is accepted (with the quote amount)

In addition, the Meta Pixel in your browser sends page views and submitted requests to Meta.

The events are sent only if you have accepted all cookies. Email and phone number are turned into a code (hashed) before they are sent, so the advertising platform cannot read them directly. IP address, browser information, Meta's own IDs for the ad click (_fbc, _fbp) and the campaign code may be sent as well. Meta uses this to link the event to the ad and to user profiles for ad optimisation.

Legal basis: Consent (GDPR art. 6(1)(a)).

Ad targeting

Our ads may be targeted based on geographic location, age group and interests. We do not use sensitive personal data for targeting.

4. AI tools

We use AI services (Anthropic) internally, among other things to analyse images and data from the inspection, write drafts of customer reports and drafts of emails to customers. Your name, address and information about your roof may then be sent to the service. A member of staff approves the customer report before it is shared with you, and emails written with AI are sent only after a member of staff has approved them.

We also use AI for internal daily summaries of what has happened. For a pre-order, the service then sees the place number and the municipality, not your name, email or phone number.

5. Calendar and email

When you book, a calendar event is created and a confirmation email is sent automatically. These services process your name, email address and appointment time.

6. Sharing of data

We do not share personal data with third parties, with the exception of:

• Cloud providers — email, calendar, database, hosting and internal messaging (Slack) (data processors)
• AI services — Anthropic, see section 4
• Advertising platforms — hashed event data for ad optimisation, only with consent

All data processors are subject to GDPR-compliant agreements.

7. Storage and deletion

Personal data related to requests, bookings and projects is stored for as long as the customer relationship is active, and deleted within 3 years of the last activity unless a statutory retention obligation applies.

Email addresses for the launch notice are stored until you ask us to delete them. If you unsubscribe, we keep the address only to know that we must not email you again.

Pre-orders are stored until you withdraw or ask us to delete them. If you withdraw, we delete the pre-order and the log of the confirmations we sent, and the people behind you in the queue move up. Emails you send us about the pre-order, and our replies, are stored like other email communication (see section 2). The notice in Slack and the entry in the internal overview are not deleted automatically. If you ask us to delete everything, we also delete them and the emails between us about the pre-order. If it becomes a request or a quote, the rules for requests above apply.

Hashed data held by advertising platforms is deleted in accordance with their retention rules. You may contact us at any time to request deletion of your data.

8. Your rights

You have the right to:

• Request access to the data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for analytics and advertising cookies, with the «Cookie settings» link at the bottom of the page. The analytics and advertising tools are then no longer loaded, and we delete the cookies from them that we know of (among them _buvid, _fbc, _fbp and Google Analytics' _ga).
• Object to processing based on legitimate interest
• Lodge a complaint with the Norwegian Data Protection Authority

To exercise your rights, contact us at[email protected].

9. Automatic deletion via social media

If you remove our app from your social media account, we automatically receive a deletion request. We then delete all data we have stored that is linked to your user ID within 30 days.

10. Changes

We may update this policy. Material changes will be announced via the website. The current version is always available on this page.