Privacy Policy
We care about protecting your privacy. This statement explains what personal data we process when you use our website, why we do so, and the rights you have.
Data controller
Borggården AS (org. no. 979 295 197), Fridtjof Nansens plass 5, 0160 Oslo, is the controller for the personal data processed on this website.
Questions about privacy can be sent to borggarden@online.no, or you can call us on +47 22 42 09 05.
The website is built and operated by Mekanismer, which processes personal data on our behalf as a processor.
About this notice
This notice explains what personal data we process when you use the website, why we do it, who receives it and how long it is kept. It only describes what is actually in use on the website, and it is updated automatically when we start or stop using a service.
Visitor statistics
We count visits with our own solution, without cookies and without storing any ID in your browser. Your IP address is not stored. For each visit, our server creates a code from your IP address and browser type, combined with a secret value and today’s date. The code changes every day, so we cannot recognise the same visitor from one day to the next.
Together with the code, we store which pages are visited, which page you came from, campaign tags in the link, approximate country, device type and language. The data is pseudonymous, not anonymous, and we only use it for aggregated statistics. The statistics are stored with Tinybird in the EU. Before it is sent there, the data is temporarily stored for up to 3 hours in our database in the EU, and never longer than 7 days in the event of an operational error.
The legal basis is our legitimate interest in running and improving the website, Article 6(1)(f) of the General Data Protection Regulation (GDPR). You can object to this processing by contacting us.
Campaign tag
If you come to us from a tagged advert or link, the campaign tag (source, medium and campaign name) is only remembered while the page is open, so the visit can be counted for the right campaign. Nothing is stored in your browser. The legal basis is our legitimate interest, Article 6(1)(f).
Table bookings
You book a table in the booking system from ResDiary, which processes the data on our behalf as a processor. The booking window is only loaded from ResDiary when you open it. ResDiary then receives your IP address and may set cookies that are necessary for the booking to work.
Your name, contact details, number of guests, time and any requests you give are used to handle the booking and your visit. The legal basis is the agreement with you, Article 6(1)(b).
When a booking is completed, our visitor statistics record that it happened, together with a few rough details we derive from it: how many days ahead the visit is, the weekday and time of day of the visit, and roughly how many guests (for example 3 to 4). Name, contact details, booking number and date are not stored in the statistics. The legal basis is the same as for the visitor statistics.
Enquiries via the form
If you send us an enquiry through the form on the website, for example about a private event, we store what you write together with your IP address, browser type and the page you sent it from. The enquiry is stored in our database with Supabase in the EU and sent to our email through Resend. The IP address and browser type are only used to stop abuse and spam.
The legal basis is answering and following up your enquiry, Article 6(1)(b). For the IP address and browser type, the legal basis is our legitimate interest in preventing abuse, point (f).
Email to us is stored with our email provider, which processes it on our behalf. The same applies to enquiries from the form.
We use email to answer you and follow up the matter. The legal basis is answering your enquiry, Article 6(1)(b) and (f).
Opening hours
Our opening hours are fetched from Google by our server. Your browser does not contact Google when you view the page, and no data about you is sent there.
Running the website
The website is hosted by Vercel, and images and film are delivered by Cloudflare. When you visit the website, they process your IP address to deliver the page and protect it against attacks, and the IP address is kept in technical logs for a short time. The fonts are served from our own server, so your browser does not contact Google Fonts.
The legal basis is our legitimate interest in secure and stable operation, Article 6(1)(f).
Who receives personal data
We never sell personal data. These parties receive or store data for us, depending on what you use on the website:
| Recipient | Role | Purpose | Country |
|---|---|---|---|
| Mekanismer | Processor | Development and operation of the website | Norway |
| Vercel Inc. | Processor | Hosting the website | USA |
| Cloudflare Inc. | Processor | Delivering images and film, protection against attacks | USA |
| Tinybird | Processor | Storing visitor statistics | EU |
| Supabase Inc. | Processor | Storage of enquiries from the form and temporary storage of visitor statistics | EU |
| Resend | Processor | Sending enquiries by email | USA |
| ResDiary | Processor | Table bookings | United Kingdom |
Transfers outside the EEA
Vercel Inc., Cloudflare Inc., Tinybird, Supabase Inc. and Resend are American companies or use American sub-processors. Data may therefore be processed in, or made accessible from, the USA, even when it is stored in the EU. Such transfers are based on the EU-U.S. Data Privacy Framework for companies certified under it, and otherwise on the European Commission’s standard contractual clauses.
ResDiary is based in the United Kingdom, which the European Commission has recognised as providing adequate protection of personal data.
Cookies and storage in your browser
This is what the website stores in your browser, what it is used for and how long it lasts. The website uses no cookies for measurement or advertising.
| Name | Type | Purpose | Duration | When |
|---|---|---|---|---|
| Cookies from ResDiary | Cookie | ResDiary: necessary for the booking to work | Set by ResDiary | When you open the booking |
How long we keep personal data
- Visitor statistics: as long as they are useful for comparing visits over time.
- Table bookings: with ResDiary for as long as needed to carry out and follow up your visit.
- Enquiries from the form: until the matter has been followed up and is no longer needed.
- Email: until the matter has been followed up.
- Technical logs at Vercel and Cloudflare: for a short time, for operation and security.
- Data we must keep under the Norwegian Bookkeeping Act is kept for as long as the law requires.
Your rights
You have the right to access the data we hold about you, and to have it corrected, erased or restricted. You can receive data you have given us in a machine-readable format, and object to processing based on legitimate interest. If you have given consent, you can withdraw it at any time. We make no automated decisions about you.
Contact us at borggarden@online.no, and we will reply within one month.
Complaint
If you believe we process personal data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). We would appreciate it if you contacted us first, so we can put things right.
Changes
This notice is updated automatically when we start or stop using a service that processes personal data. Last updated 30 September 2026.