Privacy Policy — By the Fjord

1. Who we are

By the Fjord operates the website bythefjord.com and manages three holiday properties in Norway. For questions about this policy, contact us at [email protected].

2. Data we collect

We collect personal data only when you interact with us:

Booking enquiries and reservations — name, email address, phone number, country of residence, number of guests, and any notes you provide. This data is used solely to process and manage your booking.
Payments — payment card details are processed directly by Stripe and are never stored on our servers. We receive a payment confirmation and a booking reference from Stripe.
FjordVibes photo uploads — if you submit a photo or video to our FjordVibes gallery, we store the file and any caption you provide. Your email address is collected for moderation purposes and is not displayed publicly.
Analytics — we use Google Analytics 4 to understand how visitors use the site. This collects anonymised data such as pages visited, time on site, device type, and approximate location (country/city level). No personally identifiable information is sent to Google Analytics.
Cookies — we use essential cookies (session management, currency preference) and, with your consent, analytics cookies from Google Analytics.

3. Legal basis for processing (GDPR)

Contract performance — processing your booking and communicating about your stay.
Legitimate interests — fraud prevention, security, and improving our service.
Consent — analytics cookies. You may withdraw consent at any time via the cookie banner.

4. How we use your data

To confirm and manage your booking, including sending payment links and reminders.
To send a booking confirmation email to you and to our host address.
To moderate and display FjordVibes gallery submissions (with your permission).
To improve the website through aggregated, anonymised analytics.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-party services

Stripe — payment processing. Stripe's privacy policy: stripe.com/privacy.
Google Analytics — website analytics. Google's privacy policy: policies.google.com/privacy.
ExchangeRate-API / open.er-api.com — live currency conversion rates. No personal data is shared with these services.

6. Data retention

Booking records are retained for 5 years for accounting and legal compliance. Analytics data is retained for 14 months (Google Analytics default). FjordVibes submissions are retained until you request removal.

7. Your rights

Under GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (subject to legal retention requirements).
Object to processing or request restriction.
Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

To exercise any of these rights, email [email protected].

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance of the updated policy.