Apps: Orteliu’s venue apps — CC Vest for iPhone (app and App Clip) and Android
Effective: 28 September 2026
This policy explains how personal data is processed in this app and its App Clip (“the app”).
1. Who is responsible
Orteliu AS (org. no. 933 786 439), Hellerdamsvegen 10, 2009 Nordby, Norway, is the controller for the processing described here. The venue supplies the store and venue information shown in the app; it does not receive personal data from the app.
Contact: privacy@orteliu.com
2. In short
- You don’t need an account, and we never ask for your name, e-mail address or phone number.
- Your position inside the venue is calculated on your phone. We don’t keep a record of where you have been.
- We don’t show ads, sell data, track you across other apps or websites, or build profiles of you.
- Only two things reach our servers: technical request data, including your IP address, and your location when the app works out which venue you are at.
3. What we process, and why
3.1 Your position, on your phone
To show where you are and guide you, the app uses your phone’s location services (GPS and network location), Bluetooth signals from beacons in the venue, and your phone’s motion sensors and compass. All of this is processed on your phone. The app doesn’t store your position history and doesn’t send the positions it calculates to us. Your phone may also pick up Bluetooth signals from other nearby devices while it scans; these are neither stored nor sent.
Your phone asks your permission before the app can use location, Bluetooth or motion data. You can refuse, or withdraw permission later in your phone’s settings. The map, search and store information keep working, but the app can’t show your position.
Legal basis: necessary to provide the service you ask for (GDPR art. 6(1)(b)).
3.2 Finding the venue you are at
When positioning starts, the app sends your current location (coordinates) to our servers to find out which venue and building you are at. If the venue isn’t found, the app asks again after you have moved some distance. We use the coordinates only to answer that question and don’t store them.
Legal basis: necessary to provide the service (art. 6(1)(b)).
3.3 Technical data in server logs
Whenever the app contacts our servers, for example to download maps and store information, our systems and our hosting provider record:
- your IP address
- the time
- the address requested
- the response
- the app version, phone model and operating system version the app reports
We use this to run, secure and troubleshoot the service and to prevent abuse.
Legal basis: our legitimate interest in operating a secure and reliable service (art. 6(1)(f)).
3.4 Voice search
If you ask by voice, where the app offers it, your phone’s speech recognition turns your speech into text. That is Apple’s service on iPhone and usually Google’s on Android. Depending on your phone, this happens on the phone itself or on Apple’s or Google’s servers, under their own privacy policies (Apple, Google). We never receive your voice. The microphone is used only after you grant permission and tap the microphone button.
3.5 Links to other websites
Store pages can link to a store’s website or phone number. Websites you open from the app are not part of it, and the store’s own privacy policy applies. If you use the app to search a store’s website, your search words are sent to that website.
3.6 Stored on your phone
The app stores the following on your phone:
- your settings (language, dark mode, step-free routes, map layers)
- the stores you save
- downloaded map and store information
Your phone’s own backup (iCloud or Google) may include this data, depending on your backup settings. Deleting the app removes it from your phone.
4. Who else processes data
Our servers run on Google Cloud in the EU (Belgium). Google processes data for us as our data processor, under a data processing agreement. Google may process some operational data, such as logs, outside the EEA; such transfers are protected by the EU–U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses.
We don’t share personal data with the venue or anyone else, unless the law requires it, for example a lawful order from the police or a court. Apple and Google (section 3.4) act as independent controllers and may process data outside the EEA under their own safeguards.
5. How long we keep data
We keep personal data only for as long as necessary for the purpose we collected it for, and then delete or anonymise it:
- Coordinates sent to find the venue (3.2) are not stored at all.
- Server logs (3.3) are kept for as long as necessary to operate and secure the service.
Deleted data can remain in our backups for as long as necessary to complete the regular backup cycle.
6. Your rights
You have the right to:
- see the personal data we hold about you
- have it corrected or erased
- restrict how we use it
- object to processing based on our legitimate interest
- receive your data in a portable format
You can also withdraw your phone permissions or delete the app at any time.
Write to privacy@orteliu.com and we’ll answer within one month. The app has no accounts, so we usually can’t tell which data is yours (GDPR art. 11). If you give us details that let us find it, such as your IP address and when you used the app, we will handle your request.
You can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the data protection authority where you live or work in the EEA.
7. Changes
We update this policy when the app changes. The date at the top shows the current version, and we’ll tell you in the app about changes that matter.