Last updated: 17 September 2026<\/strong><\/p>\n\n\n\n Bonatt AS (“Bonatt”, “we”, “us”) is the data controller for the personal data described below. This policy explains what we collect, why, how long we keep it, and what rights you have.<\/p>\n\n\n\n Bonatt AS<\/strong> Organisation number: 937 717 067 Registered address: [STREET ADDRESS], Bekkestua, Norway Email: contact@bonatt.com<\/p>\n\n\n\n For any question about this policy or your personal data, email contact@bonatt.com<\/strong>.<\/p>\n\n\n\n We collect the information you enter in the form:<\/p>\n\n\n\n We use this to understand your requirement, source suitable hotels and venues, negotiate rates, and come back to you with options. To do that we share the relevant parts of your enquiry with hotels and venues, and with our accommodation suppliers.<\/p>\n\n\n\n Legal basis:<\/strong> performance of a contract, or steps taken at your request prior to entering one (GDPR Article 6(1)(b)).<\/p>\n\n\n\n We collect your email address only. We use it to notify you once individual booking goes live.<\/p>\n\n\n\n Legal basis:<\/strong> your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by emailing us, and we will delete your address.<\/p>\n\n\n\n We process the contents of your message and your contact details in order to reply.<\/p>\n\n\n\n Legal basis:<\/strong> legitimate interests in responding to enquiries (GDPR Article 6(1)(f)), or contract where relevant.<\/p>\n\n\n\n Our web host records standard server log data, including IP address, browser type and pages requested, for security and to keep the site running.<\/p>\n\n\n\n Legal basis:<\/strong> legitimate interests in operating and securing the site (GDPR Article 6(1)(f)).<\/p>\n\n\n\n We use the following service providers, who process personal data on our behalf under a data processing agreement:<\/p>\n\n\n\n In addition, we pass the relevant parts of your enquiry to hotels, venues and accommodation suppliers<\/strong> in order to source your booking. Those parties act as independent controllers for the data they receive and apply their own privacy policies.<\/p>\n\n\n\n Where any provider transfers personal data outside the EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses or another valid transfer mechanism.<\/p>\n\n\n\n We delete or anonymise data once these periods expire.<\/p>\n\n\n\n This website does not use analytics, advertising or tracking cookies. It sets only the cookies WordPress requires to function \u2014 for example to keep an administrator logged in. These are strictly necessary and do not require your consent.<\/p>\n\n\n\n If we add analytics or any other non-essential cookie in future, we will ask for your consent first and update this policy.<\/p>\n\n\n\n Under GDPR you have the right to:<\/p>\n\n\n\n To exercise any of these, email contact@bonatt.com<\/strong>. We will respond within one month.<\/p>\n\n\n\n If you are unhappy with how we handle your data, you can complain to the Norwegian Data Protection Authority:<\/p>\n\n\n\n Datatilsynet<\/strong> Postboks 458 Sentrum, 0105 Oslo datatilsynet.no<\/p>\n\n\n\n Your enquiry is transmitted over an encrypted connection (HTTPS) and stored on servers within the EU. Access is limited to the people at Bonatt who need it to handle your request.<\/p>\n\n\n\n We will update this page when our processing changes, and revise the date at the top. Material changes affecting people already on our waitlist will be notified by email.<\/p>\n","protected":false},"excerpt":{"rendered":" Privacy Policy Last updated: 17 September 2026 Bonatt AS (“Bonatt”, “we”, “us”) is the data controller for the personal data described below. This policy explains what we collect, why, how long we keep it, and what rights you have. 1. Who we are Bonatt AS Organisation number: 937 717 067 Registered address: [STREET ADDRESS], Bekkestua, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-57","page","type-page","status-publish","hentry"],"yoast_head":"\n1. Who we are<\/h2>\n\n\n\n
2. What we collect, and why<\/h2>\n\n\n\n
When you submit a Groups & Events enquiry<\/h3>\n\n\n\n
\n
When you join the individual-booking waitlist<\/h3>\n\n\n\n
When you email us<\/h3>\n\n\n\n
Technical data<\/h3>\n\n\n\n
3. What we do not do<\/h2>\n\n\n\n
\n
4. Who we share it with<\/h2>\n\n\n\n
Provider<\/th> Purpose<\/th> Location<\/th><\/tr><\/thead> Hostinger<\/td> Website hosting and server logs<\/td> EU<\/td><\/tr> Brevo<\/td> Sending notification email from the website<\/td> EU (France)<\/td><\/tr> Microsoft (Microsoft 365)<\/td> Our own email mailboxes<\/td> EU<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n 5. How long we keep it<\/h2>\n\n\n\n
Data<\/th> Retention<\/th><\/tr><\/thead> Enquiries that did not lead to a booking<\/td> 24 months from last contact<\/td><\/tr> Enquiries that led to a booking<\/td> 5 years from the end of the accounting year, as required by the Norwegian Bookkeeping Act (bokf\u00f8ringsloven)<\/td><\/tr> Waitlist email addresses<\/td> Until individual booking launches, or until you withdraw consent<\/td><\/tr> General correspondence<\/td> 24 months<\/td><\/tr> Server logs<\/td> As retained by our host, typically up to 12 months<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n 6. Cookies<\/h2>\n\n\n\n
7. Your rights<\/h2>\n\n\n\n
\n
8. Security<\/h2>\n\n\n\n
9. Changes to this policy<\/h2>\n\n\n\n