Privacy notice
Information under GDPR articles 13 and 14 on the processing of personal data on lauvaasen.net.
Last updated
Controller
The controller of personal data collected through lauvaasen.net is:
Lauvåsen Fjellstue AS
Lauvåsvegen 260
2646 Gålå, Norway
Company registration no. 934 396 006
Telephone: +47 95 92 47 44
E-mail: [email protected]
The undertaking is not required to designate a data protection officer under GDPR article 37. Privacy enquiries are to be addressed as above.
Enquiries sent through a form
Data. Name, e-mail address, telephone number, requested dates, number of guests and the message text. In addition: the time of receipt, the page and language the form was sent from, a shortened IP address (last octet removed, e.g. 81.166.42.0) and the browser's user agent.
Purposes. To answer the enquiry, to prepare and perform any agreement for accommodation or an event, and to prevent spam and abuse of the form.
Legal basis. GDPR article 6(1)(b) for enquiries concerning a reservation, and article 6(1)(f) for other enquiries and for protecting the form. The legitimate interest is being able to receive and answer enquiries from guests.
Obligation to provide data. There is no statutory or contractual obligation to provide the data. Without contact details the enquiry cannot be answered.
No automated decision-making and no profiling within the meaning of article 22 take place.
Use of the website
Visit statistics. The date, page, language and any referring address are recorded. No IP address, cookie or other identifier is stored, and individual visits cannot be linked to each other or to a person. Legal basis: article 6(1)(f). Retention: 90 days.
Server log. The web server records IP address, timestamp, requested address, status code and user agent, for operation, troubleshooting and information security. Legal basis: article 6(1)(f). Retention: 14 days.
Cloudflare. All traffic to the site passes through Cloudflare, which performs traffic filtering and content delivery on our behalf. Cloudflare processes the IP address as a necessary part of that delivery.
Cookies and browser storage
The site uses no cookies for statistics, tracking or marketing, and no third-party analytics, advertising or embedding services. The following is stored in your browser:
| Name | Type | Purpose | Duration |
|---|---|---|---|
lauvLang | Local storage | Stores the chosen language. | Until browser data is cleared |
lauvLangRouted | Session storage | Prevents repeated redirection to the browser's preferred language. | Until the tab is closed |
__cf_bm, cf_clearance | Cookie (Cloudflare) | Bot filtering. Set only when the firewall is triggered. | 30 minutes / 1 year |
CF_Authorization | Cookie (Cloudflare Access) | Sign-in to /admin. Not set for visitors. | 24 hours |
This storage is necessary in order to deliver the service the user has requested and is therefore covered by the exemption from the consent requirement in section 3-15(2) of the Norwegian Electronic Communications Act. Stored data can be removed at any time by clearing site data for lauvaasen.net in the browser.
Recipients and transfers
Personal data is not sold and is not disclosed for marketing purposes. It is processed by the undertaking itself and by the following processors, acting under a data processing agreement and on our instructions:
| Processor | Processing | Location |
|---|---|---|
| dataflair – Kurz & Lankow GbR | Server hosting (this website) | Germany (EEA) |
| Cloudflare, Inc. | Content delivery, firewall and the /admin sign-in | USA / EEA |
| Outdex Hosting | Outgoing e-mail (SMTP) | Germany (EEA) |
| Webhuset AS | Our mailbox | Norway (EEA) |
| Meteorologisk institutt (MET Norway) | The forecast on /webcam – fetched by our server, never by your browser | Norway (EEA) |
Cloudflare, Inc. is established in the United States. Transfers outside the EEA are made on the basis of the European Commission's Standard Contractual Clauses and the company's certification under the EU–US Data Privacy Framework, cf. GDPR articles 45 and 46.
Beyond this, data is disclosed only where required by law or by order of a public authority.
Retention
- Enquiries that do not lead to an agreement: deleted when the matter is closed, and no later than 12 months after receipt.
- Enquiries that lead to an agreement: retained as part of the customer relationship. Data forming part of accounting documentation is kept for five years after the end of the financial year, cf. section 13(2) of the Norwegian Bookkeeping Act.
- Visit statistics: 90 days.
- Server log: 14 days.
Earlier erasure may be requested under article 17 where the conditions there are met.
Your rights
You have the right of access (article 15), rectification (article 16), erasure (article 17), restriction of processing (article 18) and data portability (article 20). Processing based on article 6(1)(f) may be objected to under article 21.
Requests should be sent to [email protected] and will be answered without undue delay and within one month at the latest, cf. article 12(3). No fee is charged.
A complaint about the processing may be lodged with the Norwegian Data Protection Authority, Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, cf. article 77.
Security of processing
All traffic to the site is transmitted encrypted (HTTPS). The administration page is protected by a one-time e-mail code through Cloudflare Zero Trust and restricted to named addresses. These measures are taken pursuant to GDPR article 32.
Personal data breaches are notified to Datatilsynet within 72 hours under article 33, and to the data subject under article 34 where the breach is likely to result in a high risk.
Changes to this notice
This notice is updated whenever the processing changes. The version in force is dated at the top of the page.