Privacy Policy

1. Data Controller

Meshoter AS (Org. nr. 926 345 678 MVA), with registered office at Bryggen 15, 5003 Bergen, Norway, is the controller of the personal data you provide to us through this website or by other means. You can contact our Data Protection Officer at [email protected].

2. Data We Collect

We collect the following categories of personal data:

• Contact data: name, email address, phone number, postal address.
• Booking data: travel dates, destination preferences, group composition, passport details when required by suppliers.
• Billing data: tax information, payment method (card data is processed securely via PCI-DSS certified gateways).
• Browsing data: IP address, device type, pages visited, session duration (via cookies).

3. Purposes of Processing

We use your data to:

• Manage and confirm bookings and custom itineraries.
• Send service-related communications (confirmations, changes, reminders).
• Respond to enquiries and consultation requests.
• Comply with legal obligations (accounting, tax, tourism regulations).
• With your consent, send promotional offers about our services.
• Improve user experience via analytics (only with accepted cookies).

4. Legal Basis

Processing is based on: (a) performance of a contract — to deliver the services you booked; (b) explicit consent — for marketing communications; (c) legal obligations — for tax and tourism compliance; (d) legitimate interest — for security, fraud prevention and service improvement.

5. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described and thereafter for statutory retention periods (e.g. 5 years for accounting under Norwegian law). Marketing data is retained until you withdraw your consent.

6. Recipients & Transfers

We do not sell or rent your data. Your data may be shared with:

• Tourism suppliers (hotels, transport operators, activity providers) strictly to fulfil your booking.
• Public authorities where legally required.
• Technology providers (hosting, CRM, payment gateways) under strict data processing agreements.

Data is primarily stored within the EEA. Where transfers outside the EEA are unavoidable (e.g. an international airline), we ensure appropriate safeguards under GDPR Chapter V.

7. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion when data is no longer necessary.
• Objection — object to certain processing, including direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request temporary suspension of processing in certain cases.

To exercise these rights, email [email protected] with your request and proof of identity. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no).

8. Cookies

We use first-party and third-party cookies to enhance navigation, analyse traffic and personalise content. You can manage or reject cookies from your browser at any time. See our Cookie Policy for details.

9. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration. All transmissions use HTTPS, and payment gateways comply with the PCI-DSS standard.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via our website or by email if an active contract exists.

Contact

Questions about this policy? Contact us at: [email protected] · +47 55 12 34 56 · Bryggen 15, 5003 Bergen, Norway.