Privacy Policy

At Northern Yachting AS, we are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and Norwegian data protection laws.

This Privacy Policy outlines how we collect, process, store, and protect your personal information, as well as your rights as a data subject.

1. Data Controller

Håkon Haug Enga, on behalf of Northern Yachting AS, is the data controller responsible for the processing of personal data. Our contact details are provided at the end of this policy.

2. Personal Data We Collect

We collect and process the following personal data about our customers:

Basic Information: Name, address, telephone number, and email address.
Purchase and Behavioral Data: Purchase history and behavioral patterns on our website (e.g., navigation and interaction data).
Special Trip Data: For bookings requiring special equipment (e.g., ski or diving gear), we may collect body measurements to ensure proper fit.

3. Purpose of Processing

We process your personal data for the following purposes:

Contract Fulfillment: To execute agreements with you, such as bookings for tours, activities, or services.
Customer Experience: To manage registrations and participation in our activities, ensuring a seamless experience.
Marketing and Communication (with your consent): To send personalized offers, recommendations, and service updates via email, telephone, or SMS.
Website Optimization (with your consent): To analyze purchase history and website behavior to provide tailored recommendations and advertisements.

4. Legal Basis for Processing

Our processing of personal data is based on the following GDPR provisions:

Article 6(1)(b): Processing is necessary to fulfill a contract with you (e.g., using name, address, phone, and email for bookings).
Article 6(1)(a): Processing for marketing, personalized offers, or behavioral analysis is based on your explicit consent. You may withdraw consent at any time by contacting us or opting out of communications.
Article 6(1)(f): In limited cases, we process data based on legitimate interests (e.g., improving our website functionality), ensuring your rights are not overridden.

5. Collection of Personal Data

We collect personal data in the following ways:

Directly from You: Information you provide via our website, booking forms, customer forms (e.g., body measurements for equipment), or other interactions.
Cookies and Analytics: We use cookies on our website to enhance user experience and collect behavioral data. For details, see our Cookie Policy [Note: Replace with actual link if available]. We comply with the Norwegian Electronic Communications Act by informing you about cookie usage and obtaining consent where required.

6. Disclosure to Third Parties

We do not share, sell, or transfer your personal data to third parties, except:

Legal Obligations: When required by law or public authorities (e.g., tax or regulatory reporting).
Service Providers: Trusted processors (e.g., payment or booking system providers) acting under our instructions and GDPR-compliant agreements. These providers do not use your data for their own purposes.

For special trips requiring external equipment or services, we may share necessary data (e.g., body measurements) with suppliers solely to fulfill the contract. We ensure such disclosures are minimized and protected.

7. Data Retention and Deletion

Contract-Related Data: Personal data collected for purchases or bookings is retained in our active customer database for 3.5 years from the date of the transaction, unless longer retention is required by law (e.g., accounting regulations).
Consent-Based Data: Marketing or behavioral data is retained until you withdraw consent or request deletion.
Deletion: Upon expiration of retention periods or at your request, we securely delete or anonymize your data, unless legally required to retain it.

8. Your Rights as a Data Subject

Under GDPR and the Norwegian Personal Data Act, you have the following rights:

Access: Request insight into the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your data, subject to legal retention obligations.
Restriction: Request restricted processing in certain cases (e.g., while disputes are resolved).
Data Portability: Request a copy of your data in a structured, machine-readable format.
Objection: Object to processing based on legitimate interests or for marketing purposes.
Withdraw Consent: Revoke consent for marketing or behavioral analysis at any time, with effect from the date of withdrawal.

To exercise these rights, contact us using the details below. We will respond within one month, as required by GDPR. If you believe our processing violates data protection laws, you may lodge a complaint with Datatilsynet (www.datatilsynet.no).

9. Data Security

We implement robust technical and organizational measures to protect your personal data, including:

Access Controls: Physical and virtual restrictions to prevent unauthorized access.
Encryption: Secure encryption of sensitive data during transmission and storage.
Regular Audits: Ongoing reviews of our systems to ensure compliance and security.

10. Contact Information

For inquiries about your personal data, including requests for access, correction, or deletion, please contact:

Northern Yachting AS
Blåbærvegen 41, 9024 Tomasjord, Norway
Email: haakonenga@northernyachting.com
Website: www.northernyachting.com

For general data protection concerns or complaints, you may also contact:

Datatilsynet
Website: www.datatilsynet.no

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The latest version will be available on our website, with the update date noted above. Significant changes will be communicated directly to you where required.

Thank you for trusting Northern Yachting AS with your personal data. We are dedicated to ensuring your privacy and delivering exceptional experiences.