Privacy notice

Controller

The controller of personal data collected through lauvaasen.net is:

Lauvåsen Fjellstue AS
Lauvåsvegen 260
2646 Gålå, Norway
Company registration no. 934 396 006
Telephone: +47 95 92 47 44
E-mail: fjellstue@lauvaasen.net

The undertaking is not required to designate a data protection officer under GDPR article 37. Privacy enquiries are to be addressed as above.

Enquiries sent through a form

Data. Name, e-mail address, telephone number, requested dates, number of guests and the message text. In addition: the time of receipt, the page and language the form was sent from, a shortened IP address (last octet removed, e.g. 81.166.42.0) and the browser's user agent.

Purposes. To answer the enquiry, to prepare and perform any agreement for accommodation or an event, and to prevent spam and abuse of the form.

Legal basis. GDPR article 6(1)(b) for enquiries concerning a reservation, and article 6(1)(f) for other enquiries and for protecting the form. The legitimate interest is being able to receive and answer enquiries from guests.

Robot check. When the form is used, the browser loads a robot check (Cloudflare Turnstile) from challenges.cloudflare.com. Cloudflare then processes the IP address, information about the browser and signals from the interaction with the page, and returns a one-time proof that the sender is a person. The content of the form is not transferred to Cloudflare in this check. With JavaScript switched off no such check is made; a confirmation page is shown before the enquiry is sent instead. Legal basis: article 6(1)(f) – preventing automated abuse of the form.

Obligation to provide data. There is no statutory or contractual obligation to provide the data. Without contact details the enquiry cannot be answered.

No automated decision-making and no profiling within the meaning of article 22 take place.

Use of the website

Visit statistics. The date, page, language and any referring address are recorded. No IP address, cookie or other identifier is stored, and individual visits cannot be linked to each other or to a person. Legal basis: article 6(1)(f). Retention: 90 days.

Server log. The web server records IP address, timestamp, requested address, status code and user agent, for operation, troubleshooting and information security. Legal basis: article 6(1)(f). Retention: 14 days.

Cloudflare. All traffic to the site passes through Cloudflare, which performs traffic filtering and content delivery on our behalf. Cloudflare processes the IP address as a necessary part of that delivery.

Cookies and browser storage

The site uses no cookies for statistics, tracking or marketing, and no third-party analytics or advertising services. The only content fetched from another address is the robot check on the forms, and it is fetched only once a form is used. The following is stored in your browser:

This storage is necessary in order to deliver the service the user has requested and is therefore covered by the exemption from the consent requirement in section 3-15(2) of the Norwegian Electronic Communications Act. Stored data can be removed at any time by clearing site data for lauvaasen.net in the browser.

Recipients and transfers

Personal data is not sold and is not disclosed for marketing purposes. It is processed by the undertaking itself and by the following processors, acting under a data processing agreement and on our instructions:

Cloudflare, Inc. is established in the United States. Transfers outside the EEA are made on the basis of the European Commission's Standard Contractual Clauses and the company's certification under the EU–US Data Privacy Framework, cf. GDPR articles 45 and 46.

Beyond this, data is disclosed only where required by law or by order of a public authority.

Retention

• Enquiries that do not lead to an agreement: deleted when the matter is closed, and no later than 12 months after receipt.
• Enquiries that lead to an agreement: retained as part of the customer relationship. Data forming part of accounting documentation is kept for five years after the end of the financial year, cf. section 13(2) of the Norwegian Bookkeeping Act.
• Visit statistics: 90 days.
• Server log: 14 days.

Earlier erasure may be requested under article 17 where the conditions there are met.

Your rights

You have the right of access (article 15), rectification (article 16), erasure (article 17), restriction of processing (article 18) and data portability (article 20). Processing based on article 6(1)(f) may be objected to under article 21.

Requests should be sent to fjellstue@lauvaasen.net and will be answered without undue delay and within one month at the latest, cf. article 12(3). No fee is charged.

A complaint about the processing may be lodged with the Norwegian Data Protection Authority, Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, cf. article 77.

Security of processing

All traffic to the site is transmitted encrypted (HTTPS). The administration page is protected by a one-time e-mail code through Cloudflare Zero Trust and restricted to named addresses. The forms are protected against automated abuse by a robot check, a hidden field and a limit on how many enquiries may be sent from one address. These measures are taken pursuant to GDPR article 32.

Personal data breaches are notified to Datatilsynet within 72 hours under article 33, and to the data subject under article 34 where the breach is likely to result in a high risk.

Changes to this notice

This notice is updated whenever the processing changes. The version in force is dated at the top of the page.