Privacy policy
Last updated 30 October 2026
Nordic Travel Services AS is responsible (data controller) for the personal data handled on nordicalps.com. We only collect what we need to book and deliver your stay, and we never sell your data.
1. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail, phone, country, arrival information, notes to the host, number of guests, dates, booked property, prices and payments | Make, confirm, deliver and support your booking; send arrival information; handle changes, cancellations and complaints | Contract, art. 6(1)(b) |
| Booking and payment records | Accounting | Legal obligation, art. 6(1)(c) (Norwegian Bookkeeping Act) |
| Messages via e-mail, contact form and chat | Answer your questions | Contract, or our legitimate interest in answering enquiries, art. 6(1)(b)/(f) |
| Card details | Payment – entered directly with Stripe; we never see the full card number | Contract, art. 6(1)(b) |
| Use of the website (pages viewed, searches, device, approximate location from IP) | Statistics and improving the site; measuring our advertising | Your consent, art. 6(1)(a) – see cookies |
| Data to prevent fraud and misuse (IP address, booking patterns) | Security | Legitimate interest, art. 6(1)(f) |
We send newsletters or offers by e-mail only if you have asked for them, and every e-mail has an unsubscribe link. Service e-mails about your booking are not marketing.
2. Who we share data with
- The accommodation provider of your stay (and their booking system, for example Mews or Hotelston): the details needed to deliver it. The provider is responsible for its own handling of the data.
- Stripe – card payments. Stripe is responsible for card data under its own privacy policy.
- Our processors, who handle data only on our instructions under a data processing agreement: our booking engine (Tripilio), web hosting, e-mail, the chat service (tawk.to), and Google (Tag Manager, Analytics) and Meta (advertising measurement) – the last two only if you accept statistics or marketing cookies.
- Public authorities when the law requires it.
Some of these companies are based outside the EU/EEA, mainly in the USA. Transfers are made under the EU-US Data Privacy Framework or the EU standard contractual clauses.
3. How long we keep data
- Booking and payment records: 5 years after the end of the financial year, as required by Norwegian accounting law.
- Other booking information, messages and chats: up to 3 years after your stay, so we can deal with questions and complaints.
- Statistics and advertising data: up to 14 months.
- Newsletter: until you unsubscribe.
4. Your rights
You can ask for access to the data we hold about you, have it corrected or deleted, restrict or object to its use, and get it in a portable format. You can withdraw consent at any time – for cookies via cookie settings. Some data must be kept for accounting even if you ask us to delete it.
Write to info@nordicalps.com. We answer within 30 days. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or the authority in your country.
5. Security
All traffic to nordicalps.com is encrypted (HTTPS). Access to booking data is limited to people who need it to serve you. Card data is handled by Stripe only.
6. Changes
We update this policy when our services change. The date at the top shows the latest version.
Nordic Travel Services AS · org. no. 925 901 911 (VAT registered) · Science Park Kongsvinger, Norway · info@nordicalps.com