Privacy Policy

1. Data Controller

Borggården AS (org. no. 979 295 197), Fridtjof Nansens Plass 5, 0160 Oslo, is the data controller for the personal data processed through this website.

If you have questions about privacy or wish to exercise your rights, you can contact us at borggarden@online.no or by telephone at +47 22 42 09 05.

2. What personal data we process

We only collect the information we need to respond to you and operate the website:

• Event enquiries: contact name, email address, telephone number, preferred date and time, number of guests, chosen menu and add-ons, any invoicing details (organisation number, company name, reference) and the message you write yourself.
• Table reservations: name, telephone and email you provide in our booking system.
• Use of the website: anonymous, aggregated visitor statistics (page views, which links are clicked, which page you came from and any campaign parameters). See the section on cookies below.

3. Purpose and legal basis

We process personal data for the following purposes:

• To respond to event enquiries and complete table reservations. The legal basis is the performance or preparation of a contract with you (the GDPR Article 6(1)(b)).
• To understand and improve the website through anonymised visitor statistics. The legal basis is our legitimate interest in operating and improving the website (Article 6(1)(f)). The statistics cannot be linked to you as an individual.

4. Cookies and analytics

This website uses no cookies for tracking, marketing or analytics, and we share no data with advertising networks. You therefore do not need to make any decision about cookie consent.

Visitor statistics are collected without cookies: we count visits using a technical, anonymous code that is re-derived every day and cannot be traced back to you. Your IP address is used only for a brief moment in this calculation and is never stored.

To remember which campaign or link you may have arrived from, a small, anonymous marker is stored locally in your browser for up to 30 days. It contains no personal data and can be removed by clearing your browser data.

5. Who we share information with

We never sell personal data. We use certain suppliers (data processors) who process information on our behalf and under a data processing agreement:

• ResDiary — table booking.
• Google (Google Workspace) — email when we respond to enquiries.
• Our operations and publishing platform (Mekanismer), with sub-processors for cloud hosting (Vercel and Cloudflare) — technical operation of the website and receipt of form submissions.

Opening hours shown on the website are retrieved from Google, but this happens on our server and sets no cookies in your browser.

6. Transfers outside the EEA

Some of our providers may process data outside the EEA. Where this happens, the transfer is safeguarded by a valid transfer mechanism, such as the European Commission's Standard Contractual Clauses (SCC).

7. Storage period

We store personal data for as long as is necessary for the purpose for which it was collected. Event enquiries and other requests are deleted once the matter is closed, unless we are legally required to retain them longer (for example, the Norwegian Bookkeeping Act's requirements for retaining accounting records). Visitor statistics are stored only in anonymised form.

8. Your rights

Under the GDPR, you have the right to access your own data, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest.

To exercise your rights, contact us at borggarden@online.no. We will respond as quickly as possible, and no later than within one month.

9. Security

We have technical and organisational measures in place to protect personal data against unauthorised access, alteration and deletion.

10. Changes to this privacy policy

We may update this privacy policy as needed. The current version is always available on this page.

11. Complaints to the Norwegian Data Protection Authority (Datatilsynet)

If you believe we are processing personal data in breach of the regulations, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). We would appreciate it if you contacted us first, so that we have the opportunity to put things right. You will find contact information at www.datatilsynet.no.