Introduction
Gaute Dvergsdal Bøyum Mountaingoat Guiding (Organisation number 913850874) (“we”, “us”, “our”) respects your privacy and processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Norwegian law. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, your rights, and how to contact us.
Contact details and data controller
Data controller: Gaute Dvergsdal Bøyum Mountaingoat Guiding
Organisation number: 913850874
Address: Bøyavegen 159, 6848 Fjærland, Norway
Email: gaute@glacierguiding.com
Scope
This policy applies to personal data collected through our website (https://glacierguiding.no), booking processes, email, telephone, in-person bookings, and during Activities.
Types of personal data we collect
- Identity data: name, date of birth, gender.
- Contact data: email address, postal address, telephone number.
- Booking and payment data: booking details, dates, price paid, payment transaction references (note: full card details are processed by payment provider, not stored by us unless explicitly stated).
- Health and fitness data: medical conditions, allergies, medications, emergency contact details, any information necessary to assess fitness to participate. (Special category data — processed only with explicit consent or necessary for safety.)
- Communication data: emails, messages, feedback, complaints.
- Technical and usage data: IP address, device and browser information, cookies and analytics data.
- Photographs and videos: images taken during Activities (may be used for marketing unless you opt out).
Purposes and legal bases for processing
We process personal data for the following purposes and legal bases:
- To manage bookings and provide Activities (performance of contract).
- To process payments and refunds (performance of contract / legal obligation).
- To assess fitness and safety, and to manage health-related risks (necessary for our legitimate interests in safe operations and/or explicit consent for special category health data).
- To communicate with you about bookings, changes, reminders and customer service (performance of contract / legitimate interest).
- To send marketing communications about our services where you have consented (consent). You may withdraw consent at any time.
- To maintain records for accounting, tax, and legal compliance (legal obligation).
- To improve our services and for analytics (legitimate interest). We anonymise or aggregate data where possible.
- To use photographs/videos for promotion (consent). We will respect requests not to be photographed — inform the Guide before the Activity.
Special category (sensitive) data
Health, medical and similar sensitive information is treated as special category data. We process this only when necessary for your participation and safety (legal basis: explicit consent and/or necessity for provision of health-related/ safety services). You must provide accurate information; if you refuse to provide required health information we may be unable to accept your Booking.
Recipients and third-party processors
We may share personal data with:
- Payment processors and banks (to process payments).
- Booking platforms and third‑party booking partners (when booking through those services).
- Subcontractors and suppliers (transport providers, accommodation, equipment suppliers), only to the extent necessary to provide the Activity.
- Emergency services, rescue organisations or healthcare providers if required for safety or legal reasons.
- Legal, accounting or regulatory authorities when required by law.
We use processors who provide sufficient guarantees of appropriate technical and organisational measures. We keep processor agreements in place to protect your data.
International transfers
Data is primarily stored and processed within the EEA. If personal data is transferred outside the EEA (e.g., cloud services or third‑party processors located outside the EEA), we will ensure appropriate safeguards (EU Commission adequacy decision, standard contractual clauses, or other lawful transfer mechanisms).
Retention periods
We retain personal data only as long as necessary to fulfil the purpose collected and to satisfy legal, accounting, insurance or safety obligations. Typical retention periods:
- Booking, payment and accounting records: 5 years (or longer if required by law).
- Health and safety incident records: as required by law/insurance (varies).
- Marketing consents and preferences: until consent is withdrawn.
- Photographs/videos used for marketing: until you request removal or withdraw consent; we will remove images on reasonable request where feasible.
Cookies and tracking
Our website uses cookies and similar technologies for functionality, analytics and marketing. You can control cookie settings via our cookie banner and your browser. For details on cookies used, see our Cookie Notice (link) or contact us.
Your rights Subject to applicable law, you have the right to:
- Request access to the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request deletion of personal data where we no longer have a lawful basis to keep it.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests or direct marketing.
- Request data portability (for data you provided to us in a structured, machine-readable format).
- Withdraw consent where processing is based on consent (withdrawal does not affect lawfulness of processing prior to withdrawal).
To exercise your rights, contact us at privacy@glacierguiding.com. We will respond within one month, or longer where permitted by law (we will inform you if an extension is necessary).
Complaints to supervisory authority
If you consider our processing does not comply with data protection law, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or the competent data protection authority in your EU/EEA member state.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These measures are reviewed and updated as necessary. However, no system is completely secure; if a security incident affects your data we will notify you and the relevant authorities where required by law.
Children
Our services are not directed at children under 16 without parental/guardian consent. If you are booking for a minor, you must provide accurate parental/guardian contact details and medical information.
Photographs and marketing opt-out
If you do not wish to be photographed or featured in marketing materials, inform the Guide before the Activity or contact us at privacy@glacierguiding.com. We will make reasonable efforts to honour requests and remove materials where feasible.
Changes to this Privacy
Policy We may update this Privacy Policy periodically. Changes will be posted on our website with a revised effective date. Significant changes affecting your rights will be notified to you where required.
Contact information
Data controller and contact:
Gaute Dvergsdal Bøyum Mountaingoat Guiding
Email: gaute@glacierguiding.com
Address: Bøyavegen 159, 6848 Fjærland, Norway
Effective date
This Privacy Policy is effective as of 02/26/2026.
If you have questions about this Privacy Policy or how we process personal data, please contact us at privacy@glacierguiding.com.
