Privacy policy for Hindrum Fjordsenter

2.1 Data controller

2.1.1. Hindrum Fjordsenter AS is the data controller for personal data collected in connection with bookings, stays and use of our services.

2.1.2. Contact details:

2.2 Personal data we process

2.2.1. We may process the following personal data:

• Name, address, telephone number and email address
• Booking information, including dates, number of guests and additional services
• Payment information, to the extent necessary to perform the agreement
• Communications with us by email, contact form or telephone

2.3 Purposes and lawful bases

2.3.1. Personal data is processed to perform our agreement with you, including the administration of bookings, payments and stays.

2.3.2. The processing is based on:

• Performance of a contract (GDPR Article 6(1)(b))
• Compliance with a legal obligation, including bookkeeping legislation (Article 6(1)(c))
• Legitimate interests, such as improving services and necessary customer communication (Article 6(1)(f))
• Consent where required (Article 6(1)(a))

2.4 Sharing personal data

2.4.1. Personal data is shared only when necessary to perform an agreement or when we are legally required to do so.

2.4.2. This may include payment providers, our accountant, IT providers and public authorities.

2.4.3. All data processors are subject to data-processing agreements in accordance with applicable legislation.

2.5 Retention and deletion

2.5.1. Personal data is retained for as long as necessary for the purpose for which it was collected.

2.5.2. Accounting-related information is retained for a minimum of five years in accordance with the Norwegian Bookkeeping Act.

2.5.3. Information is deleted or anonymised when retention is no longer necessary.

2.6 Your rights

2.6.1. You have the right to access the personal data we process about you.

2.6.2. You may request the rectification or deletion of information in accordance with applicable legislation.

2.6.3. You have the right to object to processing or request restriction of processing where the relevant conditions are met.

2.6.4. Where processing is based on consent, you may withdraw that consent at any time.

2.6.5. You have the right to lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet, if you believe that the processing does not comply with the applicable rules.

2.7 Information security

2.7.1. Hindrum Fjordsenter implements necessary technical and organisational measures to protect personal data against unauthorised access, alteration or deletion.