Privacy Policy
Last updated: 17 September 2026
Bonatt AS (“Bonatt”, “we”, “us”) is the data controller for the personal data described below. This policy explains what we collect, why, how long we keep it, and what rights you have.
1. Who we are
Bonatt AS Organisation number: 937 717 067 Registered address: [STREET ADDRESS], Bekkestua, Norway Email: contact@bonatt.com
For any question about this policy or your personal data, email contact@bonatt.com.
2. What we collect, and why
When you submit a Groups & Events enquiry
We collect the information you enter in the form:
- Your name
- Your work email address
- Your phone number (optional)
- Your company or organisation
- Destination, dates, number of rooms and attendees, budget, and any details you provide
We use this to understand your requirement, source suitable hotels and venues, negotiate rates, and come back to you with options. To do that we share the relevant parts of your enquiry with hotels and venues, and with our accommodation suppliers.
Legal basis: performance of a contract, or steps taken at your request prior to entering one (GDPR Article 6(1)(b)).
When you join the individual-booking waitlist
We collect your email address only. We use it to notify you once individual booking goes live.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by emailing us, and we will delete your address.
When you email us
We process the contents of your message and your contact details in order to reply.
Legal basis: legitimate interests in responding to enquiries (GDPR Article 6(1)(f)), or contract where relevant.
Technical data
Our web host records standard server log data, including IP address, browser type and pages requested, for security and to keep the site running.
Legal basis: legitimate interests in operating and securing the site (GDPR Article 6(1)(f)).
3. What we do not do
- We do not sell your personal data.
- We do not share it with anyone for their own marketing purposes.
- We do not use it to build advertising profiles.
- We do not send you marketing email unless you have asked us to.
4. Who we share it with
We use the following service providers, who process personal data on our behalf under a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Hostinger | Website hosting and server logs | EU |
| Brevo | Sending notification email from the website | EU (France) |
| Microsoft (Microsoft 365) | Our own email mailboxes | EU |
In addition, we pass the relevant parts of your enquiry to hotels, venues and accommodation suppliers in order to source your booking. Those parties act as independent controllers for the data they receive and apply their own privacy policies.
Where any provider transfers personal data outside the EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses or another valid transfer mechanism.
5. How long we keep it
| Data | Retention |
|---|---|
| Enquiries that did not lead to a booking | 24 months from last contact |
| Enquiries that led to a booking | 5 years from the end of the accounting year, as required by the Norwegian Bookkeeping Act (bokføringsloven) |
| Waitlist email addresses | Until individual booking launches, or until you withdraw consent |
| General correspondence | 24 months |
| Server logs | As retained by our host, typically up to 12 months |
We delete or anonymise data once these periods expire.
6. Cookies
This website does not use analytics, advertising or tracking cookies. It sets only the cookies WordPress requires to function — for example to keep an administrator logged in. These are strictly necessary and do not require your consent.
If we add analytics or any other non-essential cookie in future, we will ask for your consent first and update this policy.
7. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Erasure of your data where we no longer have grounds to keep it
- Restrict or object to our processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these, email contact@bonatt.com. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority:
Datatilsynet Postboks 458 Sentrum, 0105 Oslo datatilsynet.no
8. Security
Your enquiry is transmitted over an encrypted connection (HTTPS) and stored on servers within the EU. Access is limited to the people at Bonatt who need it to handle your request.
9. Changes to this policy
We will update this page when our processing changes, and revise the date at the top. Material changes affecting people already on our waitlist will be notified by email.