Privacy Policy

Badstuegruppen AS (org. no. 935 097 231), Lønningsvegen 47, 5258 Blomsterdalen, is the data controller for personal data collected through badstuegruppen.no and related contact forms. For privacy enquiries, contact us at fredrik@badstuegruppen.no.

This policy applies to use of the Badstuegruppen website and contact solutions. It does not apply to third-party websites you may be directed to, such as:

• Vestfjord Sauna (vestfjordsauna.no) for booking and membership.
• Heatbooking (heatbooking.com) for the booking platform and operator services.
• Vestfjord Rituals (vestfjordsauna.shop) for the online shop.
• The investment platform invest.badstuegruppen.no for share offerings and investment.

We only collect data that is necessary for the purposes below. Typical categories include:

• Identity and contact details: name, email address, company and the content of your enquiry.
• Enquiry type: whether you contact us as an investor, press/media or general enquiry.
• Technical data: IP address, browser type, device, visit time and page views.
• Cookies and analytics: data from necessary cookies and, where enabled, analytics and marketing tools.
• Contract and administration data: company details, correspondence and invoicing data where a partnership is established.

• Responding to and following up on enquiries via contact forms and email (legitimate interest, GDPR Art. 6(1)(f)).
• Preparing, entering and administering agreements and partnerships (necessary for contract, GDPR Art. 6(1)(b)).
• Handling investor-related and press enquiries (legitimate interest / contract, depending on context).
• Sending newsletters and marketing where you have consented, with easy unsubscribe (consent, GDPR Art. 6(1)(a)).
• Operating, securing and improving the website, including anonymised or aggregated statistics (legitimate interest, GDPR Art. 6(1)(f)).

We do not store personal data longer than necessary for the purpose for which it was collected.

• Contact form enquiries are normally deleted or anonymised within 12 months if they do not lead to further dialogue or an agreement.
• Agreement, correspondence and accounting data is stored in accordance with the Norwegian Bookkeeping Act, typically for 5 years after the end of the financial year.
• Technical logs and analytics data are stored for shorter periods depending on the tool and security requirements.

We do not sell personal data. We share data with trusted suppliers that process data on our behalf, including:

• Email provider (Resend) for sending and receiving enquiries.
• Hosting and infrastructure providers for website operation.
• Analytics and marketing tools such as Google Analytics, Google Tag Manager and Meta Pixel, where enabled.

The website uses cookies and similar technologies for basic functionality and, where enabled, statistics and marketing.

• Necessary cookies: language preference, form flow and secure operation of the website.
• Analytics: traffic, page views and usage patterns via Google Analytics and/or Google Tag Manager.
• Marketing: ad performance measurement via Meta Pixel, where enabled.

You can restrict or delete cookies in your browser settings. Note that some features may work less well if necessary cookies are disabled.

We implement technical and organisational measures to protect personal data, including access control, encryption where appropriate, and secure development practices. Only authorised personnel who need the data for their work have access.

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion where there is no longer a basis for processing.
• Request restriction of processing in certain cases.
• Object to processing based on legitimate interest.
• Request data portability where processing is automated and based on consent or contract.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no) if you believe processing is unlawful.

To exercise your rights, contact us by email below. We normally respond within 30 days.

The website is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

We only send newsletters and marketing if you have consented, or where we have another valid legal basis. You can unsubscribe at any time via the link in our emails or by contacting us.

We may update this policy when services, technology or regulations change. Material changes will be published on this page with an updated date.

Do you have questions about privacy or want to exercise your rights? Contact us using the email, org. no. and address below.