In short
- We only collect what we need to design your trip and follow up your order.
- We never sell your data, and we never use it for advertising.
- Erivia doesn't book your trip for you, so we don't share your data with hotels or other travel providers.
- You can ask for access, correction or deletion at any time by emailing post@erivia.no.
1. Data controller
Osland Erivia (sole proprietorship), company reg. no. 938 345 732, Sandevegen 515, 5977 Ånneland, Norway, is the data controller for personal data collected on erivia.no and when you use our services. The person responsible is the owner, Tone Kristine Osland.
If you have any questions about privacy, contact us at post@erivia.no.
2. What information we collect
When you place an order
Your name, email address, phone number and country, what you've ordered, the price and the payment status. Card details are handled by the payment provider, and we have no access to them.
The travel brief and consultation form
Your answers about the trip – for example your dream destination, timing, the size of your travel party, the type of trip and accommodation, activities, budget, departure point and how you'd like to be contacted. All fields are optional, except "What would you like help with?" in the consultation form. Your answers are saved as a note on your order.
When you contact us
Whatever you write in the contact form or by email, or tell us by phone or FaceTime, along with the contact details you provide.
Customer account
If you create an account under "My account", we store your contact details and order history so you can see your previous orders.
Technical information
When you visit the website, the server records technical information such as your IP address, browser type and the time of your visit. This is necessary for the website to work and stay secure.
3. Health, allergies and special needs
In the travel brief, you can tell us if anyone in your travel party needs extra support, or has phobias, fears or allergies we should take into account. This may be health information, which is a special category of personal data.
You provide this information entirely voluntarily, and we only process it because you ask us to take it into account when designing your trip. The legal basis is your explicit consent (GDPR Article 9(2)(a)). We only use it for this purpose. You can withdraw your consent at any time by letting us know, and we will then delete the information.
If you share information about others in your travel party, please check with them first.
4. Purposes and legal basis
- Delivering the service: Designing your trip, staying in touch along the way and delivering the travel design. Legal basis: our agreement with you (Article 6(1)(b)).
- Responding to enquiries: Answering questions you send us before or after a purchase. Legal basis: steps taken before entering into an agreement, or our legitimate interest in replying to you (Article 6(1)(b) and (f)).
- Accounting: Keeping sales records as required by the Norwegian Bookkeeping Act. Legal basis: legal obligation (Article 6(1)(c)).
- Operations and security: Keeping the website and cart running and protecting them against misuse. Legal basis: our legitimate interest (Article 6(1)(f)).
- Health information: Taking allergies and special needs into account in your trip. Legal basis: your explicit consent (Article 9(2)(a)).
We do not use your data for marketing or automated decision-making.
5. Who we share your data with
Erivia doesn't book your trip for you, so we don't share your data with hotels, transport companies or other travel providers. When you book the trip yourself, you give your details directly to them, and their privacy policies apply.
We use a few suppliers (data processors) to run the business, and they process data on our behalf under a data processing agreement:
- the web hosting and server provider where the website and orders are stored
- the email provider
- the payment provider that handles payments
- our accountant or accounting system
The website loads fonts from Google Fonts, which means your IP address is sent to Google when the page loads. Otherwise, we do not disclose data to anyone else unless required by law.
We prefer suppliers that store data within the EU/EEA. If data is transferred to a country outside the EEA, we make sure the transfer has a lawful basis, such as the European Commission's standard contractual clauses.
6. How long we keep your data
- Travel brief, consultation form and trip correspondence: Up to 12 months after the travel design is delivered, so we can answer questions and handle any complaints. The data is then deleted, except for what must be kept for accounting purposes.
- Health information: Deleted once the travel design is delivered and any revisions are complete – or sooner if you withdraw your consent.
- Sales records: Five years after the end of the financial year, as required by the Norwegian Bookkeeping Act.
- Enquiries via the contact form and email: Until the enquiry has been dealt with, and no later than 12 months afterwards.
- Customer account: Until you delete your account or ask us to delete it.
7. Cookies
We use cookies in four categories. Necessary cookies are always set, as the website cannot work without them. The other categories are only set if you consent. On your first visit, you choose "Accept all", "Reject all" or "Customise" – rejecting is just as easy as accepting.
Necessary
- Cart and checkout: woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_*
- Signing in to "My account": wordpress_logged_in_* and wordpress_sec_*
- Your cookie choice: its_consent, stored for 12 months
Statistics (requires consent)
If you consent, the online shop records which channel brought you here – for example a Google search or a link on Instagram – and links it to your order if you make a purchase. This information is stored in the sbjs_* cookies during your visit and deleted shortly afterwards. It is not shared with anyone. The legal basis is your consent (section 3-15 of the Norwegian Electronic Communications Act and GDPR Article 6(1)(a)).
Functional and marketing (requires consent)
Functional cookies remember choices you make on the website, such as language and settings. Marketing cookies are used to show relevant advertising and measure its effectiveness. Both categories are only set if you have consented to them.
Changing or withdrawing your consent
You can change or withdraw your consent at any time under "Privacy settings" at the bottom of the page, or here: open privacy settings.
To document your consent, we keep a log of the choices made. The log contains your choice, the time, your browser type and a pseudonymised (hashed) version of your IP address.
8. Security
The website uses an encrypted connection (HTTPS). Only Erivia has access to your orders and answers, and we work to protect your data against unauthorised access, loss and alteration.
9. Your rights
You have the right to:
- access the information we hold about you and receive a copy of it
- have inaccurate or incomplete information corrected
- have your data deleted when we no longer need it
- restrict how your data is processed
- object to processing based on our legitimate interest
- receive the data you have given us in a machine-readable format (data portability)
- withdraw your consent at any time
Send your request to post@erivia.no. We'll reply as quickly as we can, and within 30 days at the latest. If you believe we are processing your data in breach of the rules, you can complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no. We'd appreciate it if you contacted us first.
10. Changes
We may update this privacy policy, for example if we start using new suppliers or services. The current version is always available on this page. See also our terms and conditions.