1. Data Controller

When you visit our website and/or contact us in connection with booking accommodation, experiences, catering or other services, Flatheim on Gaularfjellet will process personal data about you. This privacy policy explains what information we collect, why we process it, and what rights you have.

The data controller for the personal data is Flatheim on Gaularfjellet (org. no. 994 940 309), represented by General Manager Heidi Vallestad.

If you have any questions about how we process your personal data, please contact us at:

• Address: Gaularfjellvegen 2275
• Email: post@gaularfjellet.no
• Telephone: +47 461 99 597

2. Purpose of Processing

When you book accommodation, an experience, catering or other services with Flatheim on Gaularfjellet, we process your personal data in order to provide the service and ensure you have a good experience. We process your data for the following purposes:

1. Registration of customer details in our systems
   Legal basis: necessary to fulfil a contract with you (GDPR Art. 6(1)(b) / Personal Data Act § 8).
2. Conclusion and follow-up of a contract (booking, confirmation, changes, customer service)
   Legal basis: necessary for the performance of a contract with you (GDPR Art. 6(1)(b) / Personal Data Act § 8).
3. Invoicing and payment (including processing of payment information and documentation)
   Legal basis: necessary to fulfil a contract with you (GDPR Art. 6(1)(b) / Personal Data Act § 8), and where applicable to comply with a legal obligation under the Accounting Act (GDPR Art. 6(1)(c) / Personal Data Act § 8).
4. Analysis of booking patterns and user behaviour to improve services, accessibility and digital platforms (website, booking system, social media and email).Legal basis:
   • our legitimate interests in developing and improving our services (GDPR Art. 6(1)(f) / Personal Data Act § 8)
   • consent where marketing or tracking requiring consent is involved (GDPR Art. 6(1)(a) / Personal Data Act § 8)
5. Ensuring the delivery of purchased products and services, as well as efficient logistics for accommodation, activities and events.
   Legal basis: necessary to fulfil a contract with you (GDPR Art. 6(1)(b) / Personal Data Act § 8).

3. What Personal Data Is Stored?

We collect personal data directly from you. The personal data processed may include:

• Name
• Email address
• Postal address
• Telephone number
• Payment details
• Services booked (accommodation, activities, guiding, hire, catering)
• Any health information necessary for safety or to make reasonable adjustments (for example, food allergies or physical limitations regarding outdoor activities)

We do not share your personal data with others without a legal basis. This may be necessary to fulfil a contract with you (GDPR Art. 6(1)(b)) or if we are legally obliged to disclose information (GDPR Art. 6(1)(c)).

Third parties with whom we may share information include:

• Booking.com, Hotels.com, Airbnb and similar platforms (where bookings are made via these)
• Payment intermediaries (card processing and transaction documentation)
• IT providers and system providers operating the booking system and website (SynXis and Limedrop)

4. Retention Period

We store personal data for as long as is necessary to fulfil the purpose of the processing and in accordance with applicable legislation.

Booking and purchase information (such as name, email address, telephone number, service details and payment reference) is generally stored for up to 5 years after the purchase, in accordance with Section 13 of the Norwegian Accounting Act and to enable us to handle customer service, complaints and any disputes.

If we are required to retain data for longer due to legal or regulatory requirements, we will only retain the data for as long as necessary and in accordance with Section 11 of the Personal Data Act and Article 5 of the GDPR (the principle of storage limitation).

5. Cookies

At gaularfjellet.no, we use cookies to improve your experience, collect information for marketing purposes and develop the website. We cannot identify you as a visitor using this information alone, but since an IP address is considered personal data, we provide information about its processing. In addition to this Privacy Policy, our Cookie Policy also applies.

The following cookies are used on gaularfjellet.no:

Category	Type	Purpose	Duration
Essential	Session cookies	Ensure the website functions, including booking flow and form submission	Until the browser is closed
Statistics	Google Analytics 4 (_ga, _gid)	Analysis of traffic and user behaviour to improve the website	Up to 2 years

You can change or withdraw your cookie consent at any time via the cookie banner on the website.

6. Your Rights

You have the right to access the personal data we hold about you, request correction, deletion or restriction of processing, object to processing, and receive your data in a portable format (data portability). You may also withdraw your consent at any time where processing is based on consent.

To exercise your rights, contact us on +47 461 99 597 or post@gaularfjellet.no. We may ask you to verify your identity before processing your request. We will respond within 30 days in accordance with the GDPR and the Norwegian Personal Data Act.

Further information about your rights can be found on the Norwegian Data Protection Authority website.

7. Complaints

If you believe that we are processing your personal data in breach of this Privacy Policy or applicable data protection legislation, you may lodge a complaint with the Norwegian Data Protection Authority.

More information is available at
www.datatilsynet.no.

8. Changes

If our services or the legislation governing the processing of personal data change, this Privacy Policy may also change. If we have your contact details, we will notify you of significant changes. Otherwise, the latest version will always be available at gaularfjellet.no.

Last updated: 14 July 2026