When you visit our website, submit an enquiry, or engage us to arrange a journey, we process personal data about you. This policy explains what we collect, why we collect it, and what rights you have.
The data controller is Norwegian Adventures AS, Camilla Colletts vei 9b, 0258 Oslo, Norway. Org. no. 984 621 256. Telephone: +47 22 44 17 00. For questions about our processing of your personal data, write to us at post@norwegian-adventures.com.
3.1 Enquiries through our website — When you submit the Request Access form, we collect your name, email address, whether you enquire as a private traveller or a travel advisor, your preferred destinations, group size, the experiences you are interested in, and your intended timeframe. We use this to assess your enquiry and respond with a proposal. The legal basis is GDPR Article 6(1)(b), steps taken at your request prior to entering into a contract.
3.2 Arranging and delivering journeys — If you engage us, we process contact details, payment information, travel dates, and any information necessary to make bookings on your behalf. Where a supplier requires it, this may include passport details and date of birth. The legal basis is Article 6(1)(b), performance of a contract. Where you provide health-related information such as dietary requirements or accessibility needs, we pass it on to the hotels, restaurants, guides and transport operators who need it in order to accommodate you, and we process it on the basis of your explicit consent under Article 9(2)(a).
3.3 Correspondence — We use your contact details to answer questions and provide relevant information about your journey. The legal basis is Article 6(1)(b) and/or (f), our legitimate interest in serving our clients well.
3.4 Spam protection — We use Google reCAPTCHA to protect our enquiry form from automated abuse. This sets cookies from Google and transfers technical data, including your IP address, to Google. The legal basis is our legitimate interest in preventing spam, GDPR Article 6(1)(f). We do not use analytics, advertising or tracking cookies, and we do not follow your activity across other websites.
3.5 Recruitment — If you apply for a position with us, we process your name, contact details, CV, application and references in order to assess your application. The legal basis is Article 6(1)(b), steps prior to entering into an employment contract.
We do not sell your personal data or share it for marketing purposes. We share data with the following categories of recipient:
Suppliers necessary to deliver your journey — hotels, guides, transport operators and similar partners, limited to what each needs to fulfil their part of your itinerary.
Service providers acting on our behalf as data processors, under written data processing agreements. These are Webflow, Inc. (website and form submissions), Microsoft (Outlook, for email correspondence) and Tripletex AS (accounting).
Public authorities, where required by law.
Some of our processors and travel suppliers are located outside the EU/EEA. Where this is the case, transfers are made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision. You may contact us for details of the safeguards applied to a specific transfer.
We store your personal data for as long as is necessary for the purpose for which it was collected. Enquiries that do not result in a booking, and job applications, are deleted once they are no longer necessary for that purpose. Accounting records are retained for five years after the end of the financial year, as required by the Norwegian Bookkeeping Act.
You have the right to request access to the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to request that we restrict our processing, to object to processing based on legitimate interest, and to receive your data in a portable format.
To exercise any of these rights, write to us at post@norwegian-adventures.com. We will respond within 30 days. We may ask you to verify your identity before we act on a request, to ensure we do not disclose data to the wrong person.
If you are dissatisfied with how we process your personal data, please contact us first so we can address it. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). Contact details are available at datatilsynet.no.
We may update this policy as our services develop. The current version is always available on this page. If we make significant changes, we will notify you by email or other appropriate means.
