Privacy policy

Norrøna Tours AS, represented by the General Manager / CEO, is the data controller responsible for the processing of personal data. Providing personal data when using services on adventure.norrona.com is voluntary.

Legal Basis for Processing

We process personal data based on the following legal grounds:

• Performance of a contract (GDPR Art. 6(1)(b)): When you register for or book a trip, we process personal data necessary to perform the travel agreement and deliver the contracted services.
• Consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)): For sending newsletters, collecting medical statements/health forms for demanding tours, or using optional marketing cookies.
• Legitimate interests (GDPR Art. 6(1)(f)): To improve and maintain our websites, optimize user experience, and ensure web security.
• Legal obligation (GDPR Art. 6(1)(c)): Retaining transaction and accounting data in compliance with the Norwegian Bookkeeping Act.

Website Operations and Data Processors

Catch Media AS acts as our data processor for the development and maintenance of the website. Data collected in connection with website operations is stored on servers hosted by Group.One Norway AS. A separate Data Processing Agreement (DPA) governs what information the provider can access and how it must be handled.

Trip Bookings, Booking System, and Retention Periods

When registering for a tour, you are asked to provide personal data. To manage bookings, participant lists, and rooming arrangements, we utilize the cloud-based booking system Qondor (Qondor AS) as a data processor. Data is shared with local operating partners, guides, airlines, or accommodation providers only to the extent strictly necessary to execute the trip.

• Passport details: Erased from our active booking systems shortly after the journey has concluded.
• Health and medical information: For challenging expeditions where medical declaration forms or doctor certifications are required, this information is treated with strict confidentiality and securely shredded/erased after the trip has concluded.
• Accounting and transaction records: Stored for 5 years in compliance with statutory bookkeeping obligations.

On-Site Search

We collect aggregated data on keywords entered into site search via Google Analytics to enhance our information offering. Search behavior is aggregated; queries are not linked to IP addresses or individual identities.

Newsletter

If you subscribe to our newsletter, we store your name and email address to send relevant information and travel offers. Our dispatch system records open and click rates to tailor communication. Your details are never shared with third parties and are permanently deleted upon unsubscribing via the link included in each newsletter.

Intercom (Live Chat)

You may chat with us directly via our website chat tool. Providing an email address is voluntary. Chat logs are retained within the platform to contextualize and respond to inquiries. Data is stored by the software provider, Intercom (intercom.com).

Comments

If you comment on articles or blog posts via Facebook login, your name, profile photo, and profile URL may be displayed alongside the comment. This information is not stored in Norrøna Tours AS's internal systems.

Web analytics and cookies

We use cookies for functionality, analytics, and targeted marketing:

• Google Analytics & Google Tag Manager: Measures site usage patterns (visitor count, session duration, referral source). IP addresses are anonymized prior to storage.
• Facebook Pixel & Delta Projects: Tracks advertising conversions and assists with audience segmentation for marketing campaigns.
• Transfers to Third Countries (USA): Services provided by Google, Meta (Facebook), and Intercom may involve data transfer to servers in the United States. Such transfers are safeguarded under approved transfer mechanisms, including the EU-U.S. Data Privacy Framework or standard contractual clauses (SCCs) approved by the European Commission.
• Necessary Cookies: Support basic site features such as server load-balancing, language preferences, and checkout authentication.

You can manage or withdraw cookie consent via your browser settings or directly through our website consent banner. For further guidance on cookie management, see AboutCookies.org. 

Your Rights

Under the GDPR, you have the following rights regarding personal data held by Norrøna Tours AS:

• Right of access: Request confirmation as to whether we process your data and receive a copy of that data.
• Right to rectification: Request correction of inaccurate, incomplete, or outdated data.
• Right to erasure ("Right to be forgotten"): Request deletion of your personal data where the original purpose has lapsed or consent is withdrawn (subject to retention required by accounting law).
• Right to restriction of processing: Request that processing be suspended under certain statutory conditions.
• Right to data portability: Request a copy of data provided on the basis of contract or consent in a structured, commonly used, machine-readable format.
• Right to object: Object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent: Withdraw previously granted consent at any time without affecting prior lawful processing.

Exercising Your Rights

Requests are addressed free of charge and answered within 30 days. Inquiries regarding data subject rights should be sent by email to [email protected].

Complaints to the Supervisory Authority

If you believe our data processing fails to comply with statutory privacy rules, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at www.datatilsynet.no/en.

Published: 15.12.2022, Last revised: 02.11.2026