Privacy
Privacy
What we store about you, why, and for how long.
Who is responsible
Søya Gard, Søyland 37, 4334 Ålgård, is the data controller for the personal data collected via soeya.no. You can reach us at soeya@online.no or by phone (+47) 95 81 23 25.
The website is run by Datahjelpen.IT AS on our behalf.
When you send a booking request
When you request a cabin, we store what you fill in on the form: name, e-mail address, phone number, number of guests, requested dates and your message. When we reply, the price, status (for example approved or paid) and any payment reference are added.
We use the information to reply to your request, carry out your stay and contact you about it. We contact you by e-mail or phone about the request. The legal basis is that you are asking to enter into an agreement with us (GDPR Art. 6(1)(b)). For paid stays we are also required to keep information under the Norwegian Bookkeeping Act (Art. 6(1)(c)).
How long
- Requests we have not answered before check-in are marked as expired.
- Declined, cancelled and expired requests, and approved stays that were not paid, are deleted automatically 6 months after the check-out date.
- Paid stays are deleted automatically 5 years after the end of the year of the stay, which is the retention period under the Bookkeeping Act.
Bookings are only visible to Søya Gard staff with their own login. Datahjelpen.IT AS has technical access as the operator of the website.
When you send a request, Søya Gard receives a short e-mail notification without your name or contact details. We only see the request itself in our administration system.
Messages between you and us about the booking – what we write to you, and replies you send to our e-mails – are stored with the booking and deleted together with it, according to the time limits above.
Notes about previous guests
After a stay, we may write a short internal note about how it went – for example whether we were satisfied, and what went well or less well – together with your name, phone number and e-mail address, so that we recognise you when you book again. The note is only visible to Søya Gard staff in the administration and is never sent to you or anyone else. It is deleted automatically 3 years after it was last changed. The legal basis is our legitimate interest in running the cabin rental safely and well (GDPR Art. 6(1)(f)).
Visitor statistics
We want to know how many people use the website and which pages are useful. Your browser therefore sends one anonymous signal when you leave a page. The signal says which page it was, how many seconds the page was visible, whether you came from another website (and if so, which one), and whether you clicked on to another of our pages. It contains no identifier and nothing you have typed, and no cookies or local storage are used. As with any request on the internet, the recipient sees your IP address when the signal arrives, but the IP address is not stored. Browsers that identify themselves as automated (testing tools) are not measured. The measurements are stored by Datahjelpen.IT AS in a database at Supabase, and individual measurements are deleted automatically after 13 months.
The legal basis is our legitimate interest in understanding how the website is used so that we can improve it (Art. 6(1)(f)). As nothing is stored on your device, we do not ask for consent.
Technical logs
To deliver the website and protect it against misuse, our hosting provider Netlify processes your IP address and the page you request in server logs, according to its own rules. The calendar of available dates and the booking form fetch and send data directly to our database at Supabase, which also sees your IP address. Error messages from sending e-mail may contain the recipient address and are stored in Supabase's log for a short time according to Supabase's rules. The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f)).
Cookies and third-party services
The website sets no cookies, and the fonts are hosted on our own server. The map and the video come from other providers – what they learn is described on the page about cookies.
Posts and events from our Facebook page are fetched by us and shown on the website. The images are stored on our own server, so your browser does not contact Facebook when you view them. If you follow a link to Facebook, Facebook’s own terms apply.
Who processes the data for us
| Provider | Task | Where |
|---|---|---|
| Datahjelpen.IT AS | Running the website and the visitor statistics (database at Supabase) | Norway |
| Supabase Inc. | Database for bookings, articles and calendar | Stored in the EU (Frankfurt) |
| Netlify Inc. | Hosting the website and server logs | USA – the transfer takes place under Netlify's privacy terms |
| Resend Inc. | Sending and receiving e-mail about bookings | USA – the transfer takes place under Resend's privacy terms |
Your rights
You can ask for access to the information we hold about you, and ask us to correct or delete it. You can also object to the visitor statistics, the technical logs and notes about previous guests, ask for the processing to be restricted, and receive the information from your booking in a machine-readable format (data portability). Information we are required to keep under the Norwegian Bookkeeping Act cannot be deleted before the deadline has passed. Contact us at soeya@online.no. Under data protection rules you should receive a reply within one month.
If you believe we process personal data in breach of the rules, you can complain to Datatilsynet (the Norwegian Data Protection Authority).