Privacy policy

Privacy Policy for visitbardufoss.no

Effective date: 18.09.2025

We at visitbardufoss.no respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information when you use our website.

1. Who We Are

The website visitbardufoss.no is operated by:

Up in the Arctic AS
Høgtunveien 68
9321 Moen
Norway

We are the “data controller” responsible for your personal data under the General Data Protection Regulation (GDPR).

2. What Personal Data We Collect

We may collect and process the following types of information:

Information you provide directly: e.g. when you fill out a contact form, sign up for our newsletter, or make a booking (such as name, email address, phone number, and payment details for bookings).
Technical data: e.g. IP address, browser type, device information, and usage data collected automatically through cookies and similar technologies.
Communication data: e.g. records of correspondence when you contact us.

3. How We Use Your Data

We use personal data only when we have a legal basis under GDPR, such as:

To provide and manage bookings through our website
To respond to your inquiries or requests
To send newsletters and marketing communications (if you have opted in)
To analyze website usage and improve our services
To comply with legal obligations

4. Cookies & Analytics

We use Google Analytics to help us understand how visitors interact with our website. Google Analytics uses cookies to collect information such as pages visited, time spent on the site, and general location data (based on IP address).

This information is anonymized and used only to improve website performance and user experience. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser settings to refuse cookies.

5. Email Marketing (Mailchimp)

If you subscribe to our newsletter, we collect your name and email address. This information is stored and processed by Mailchimp, our email marketing service provider.

Mailchimp may process your data outside the EU/EEA, but they comply with GDPR and have appropriate safeguards in place. You can unsubscribe from our emails at any time by clicking the “unsubscribe” link in our newsletters.

6. Bookings (Bókun Booking Engine)

When you make a booking on our website, your information (such as name, email address, phone number, and payment details) is collected and processed through the Bókun booking engine.

Bókun acts as a data processor on our behalf. They store and handle booking information securely and in accordance with GDPR. Payment information is processed securely and is not stored by us.

7. Sharing of Data

We do not sell or rent your personal data. We may share data with:

Service providers such as Google (analytics), Mailchimp (email), and Bókun (bookings), who process data on our behalf.
Authorities, if required by law.

All third-party providers are required to keep your information secure and to process it only according to our instructions.

8. Data Retention

We keep personal data only as long as necessary for the purposes for which it was collected, or to comply with legal and regulatory obligations.

9. Your Rights Under GDPR

You have the right to:

Access the personal data we hold about you
Request correction or deletion of your data
Restrict or object to certain processing activities
Withdraw consent at any time (when processing is based on consent)
Data portability (receive your data in a structured, commonly used format)
Lodge a complaint with your local Data Protection Authority

To exercise your rights, please contact us at: post@visitbardufoss.no

10. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

11. International Data Transfers

Some of our service providers (e.g., Google, Mailchimp, Bókun) may transfer and process personal data outside the EU/EEA. These transfers are protected by safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.