Privacy Policy

Nordfjord Wild

Effective date: 9 September 2026 (last updated 15 October 2026)

This Privacy Policy explains how Hipponen Opplevingar, trading as Nordfjord Wild, handles personal information when you visit our website, contact us, book a service, participate in an activity or request a refund.

1. Who is responsible for your personal information?

The data controller responsible for the processing described in this policy is:

Hipponen Opplevingar, trading as Nordfjord Wild
Organisation number: 938 228 655
Address: Tverrgata 3, 6770 Nordfjordeid, Norway
Telephone: +47 466 84 266
Email: info@nordfjordwild.no
Website: nordfjordwild.no

References to “we”, “us” and “our” mean Hipponen Opplevingar trading as Nordfjord Wild.

2. Information we collect and where it comes from

Depending on your interaction with us, we collect information such as:

Name, email address, telephone number and billing address.
Booking details, activity dates, participant details and payment status.
Cruise-ship details relevant to a booking or refund request.
Travel preferences and information needed for a requested trip plan.
Enquiries, correspondence, complaints and refund requests.
Limited health information relevant to activity safety or an illness-refund claim.
Photographs or video where taken and used on an appropriate legal basis.
Technical information such as IP address, browser or device information, website requests and security logs.
Cookie and consent information, as explained in Section 11.

Bookings through other platforms. If you book through GetYourGuide, Viator or Airbnb, that platform collects your details and passes us the information needed to run the activity, such as your name, the number of participants, your contact details and any special requests. The platform’s own privacy policy applies to the information you give it, and we use what we receive only as described in this policy.

We receive information directly from you, from the person making a booking on your behalf, from payment and booking providers, and through your use of the website. Information relevant to an activity or incident may also be recorded by the guide.

If you book for other people, share this Privacy Policy with them and provide only information that is appropriate and necessary for the booking. A group organiser cannot give blanket consent to optional processing on behalf of other adults.

We collect only the information needed for the relevant purpose. If information necessary to arrange, provide or pay for a service is missing, we may be unable to complete the booking or provide that service.

3. Health information and illness-refund documentation

For activity safety, we may need limited information about a condition, injury, allergy, medication or mobility limitation that materially affects participation. We do not need unrelated medical history or unnecessary diagnostic details.

Contact us before sending sensitive information so that we can explain what is needed and how to provide it. We may record practical safety arrangements separately from medical details.

Where we rely on explicit consent for activity-safety health information, we will ask for that consent separately. Simply accepting booking terms or sending information does not automatically constitute explicit consent.

You may withdraw consent by contacting us. If we cannot establish safe participation without the necessary information, we will explain the practical consequences and consider whether suitable arrangements are possible.

For an illness-refund request, we may process limited evidence showing that the affected participant could not take part on the booked date. This is a separate purpose from planning a safe activity. We do not require a detailed diagnosis or unrelated medical history.

Access is restricted to people who need the information for safety, assessing the refund claim or addressing a relevant incident or dispute. The legal bases and retention rules are explained below.

4. Why we use personal information

We use personal information to:

Respond to enquiries and prepare quotations.
Arrange and administer bookings.
Provide activities and trip-planning services.
Communicate practical information and agreed changes.
Manage payments, cancellations and refunds.
Assess eligibility for contractual refund guarantees.
Plan for safe participation and respond to emergencies.
Handle complaints, incidents and legal claims.
Maintain required accounting and tax records.
Protect the website and business against fraud, misuse and security threats.
Use promotional photographs or other optional technologies where valid consent has been obtained.

5. Legal bases for processing

The legal basis depends on the information and purpose:

Enquiries, bookings, payment administration and delivery of services: GDPR Article 6(1)(b), where necessary to take steps at your request before a contract or to perform our contract with you.
Details about participants who are not themselves the contracting customer: Article 6(1)(f), for our legitimate interests in administering the group booking and delivering the activity, subject to the participants’ rights.
General correspondence, website security and fraud prevention: Article 6(1)(f), for our legitimate interests in responding to requests and protecting our customers and services.
Accounting and statutory records: Article 6(1)(c), where necessary to comply with Norwegian bookkeeping, tax or other legal obligations.
Complaints and legal claims: Article 6(1)(f), for our legitimate interests in establishing, exercising or defending rights. Where health information is necessary for such a claim, Article 9(2)(f) also applies.
Activity-safety health information processed with explicit consent: Articles 6(1)(a) and 9(2)(a).
Illness-refund evidence: Articles 6(1)(f) and 9(2)(f), only to the extent necessary to establish, assess or resolve a claim under the contractual illness-refund guarantee.
Emergency processing: Article 6(1)(d) where necessary to protect vital interests. For health information, Article 9(2)(c) applies where the person is physically or legally incapable of giving consent and its conditions are met.
Optional promotional use of identifiable photographs or video: Article 6(1)(a), based on consent.
Personal information processed through optional cookies or similar technologies: Article 6(1)(a), where consent is the required basis, together with applicable rules governing access to information on your device.

We assess legitimate interests against the rights and reasonable expectations of the people concerned. You may contact us for information about the assessment relevant to your data.

We do not rely on a contract or an ordinary legitimate interest alone to authorise the processing of health information. An applicable additional condition under Article 9 is also required.

6. Payments

Online payments are currently processed through WooPayments and its payment infrastructure, including Stripe and other partners involved in the chosen payment method.

Payment processing can involve contact and billing details, transaction amounts, order references, payment-method details and technical information used to authenticate payments or prevent fraud.

Card details entered directly into the payment provider’s payment fields are processed through that provider’s systems. We receive the transaction and payment-status information needed to administer the booking, accounting and refunds.

Payment providers, banks, card networks and digital-wallet providers may also process information for their own legal, security and fraud-prevention purposes under their own privacy notices.

7. Website, booking, hosting and email services

Our website uses WordPress, WooCommerce and booking software to manage activities, services, bookings and payments.

Website and email services are provided through OÜ Veebivalmistus, an Estonian provider. Estonia is within the European Economic Area (EEA).

Hosting, email and technical providers may process information needed to operate the website, deliver messages, maintain bookings, provide support, protect systems and manage backups.

WhatsApp. If you contact us on WhatsApp, your phone number and messages are handled by WhatsApp (Meta Platforms Ireland Limited) under WhatsApp’s own terms and privacy policy. We use WhatsApp only to answer your questions and to arrange your booking.

A provider’s establishment in the EEA does not by itself mean that every related service or subprocessor operates only within the EEA. International processing is addressed in Section 9.

8. Sharing information

We do not sell personal information.

Where necessary for the stated purposes, information may be shared with:

Guides and people helping provide the booked activity.
Website, email, booking and payment providers.
IT, security, backup and technical-support providers.
Accountants, insurers and professional advisers handling a relevant matter.
Emergency services where needed to respond to an incident.
Public authorities where disclosure is required by law.
Other parties where necessary to establish, exercise or defend a legal claim.

We limit sharing to the information needed for the purpose. Health information is shared only where an applicable Article 9 condition also permits it.

Providers processing information on our behalf must act under appropriate data-processing arrangements. Other recipients, such as certain payment providers and public authorities, may act as independent controllers for their own purposes.

9. Processing outside the EEA

Some payment, software, cloud or support providers may process personal information outside the EEA.

Where such processing involves a transfer requiring safeguards, it must be supported by a lawful transfer mechanism. Depending on the recipient and circumstances, this can be an applicable adequacy decision or the European Commission’s Standard Contractual Clauses with any necessary supplementary safeguards.

A provider’s participation in an adequacy framework is relevant only where the recipient and processing are covered by that framework.

You may contact us to obtain information about the recipients, relevant transfer arrangements and a copy or description of the safeguards applicable to your information, subject to necessary protection of confidential information.

10. How long we keep information

We retain information only for as long as needed for its purpose or a legal obligation. Our normal retention periods are:

Enquiries that do not lead to a booking: up to 12 months after the last meaningful contact.
Booking and ordinary customer-service information: up to 3 years after the activity or service, where needed for administration, complaints or possible legal claims.
Trip-planning files: up to 3 years after completion, where needed for the service or related enquiries and claims.
Core accounting documentation: normally 5 years after the end of the relevant financial year, or another period required by applicable law.
Activity-safety health information: normally deleted within 30 days after the activity.
Medical evidence for an illness-refund request: normally deleted within 30 days after the request is resolved.
Website and security logs: normally no longer than 90 days, unless needed to investigate a security, fraud or technical incident.
Accident, complaint and dispute records: for the period necessary to resolve the matter and address relevant insurance obligations or legal claims.
Consent-based promotional photographs and video: while needed for the agreed use, subject to withdrawal of consent and periodic review of whether continued retention is necessary.
Cookie and similar technology data: according to the durations and purposes described in our Cookie Policy and consent information.

Longer retention of health information requires a specific continuing need and an applicable legal basis, including an Article 9 condition. We do not retain medical evidence for five years merely because a refund is recorded in our accounts.

Where possible, the financial record is kept without the underlying medical document.

Deleted information may remain in restricted backups until those backups are overwritten or expire through the backup cycle. Backup information is not used for ordinary business purposes, and relevant deletion decisions must be reapplied if a backup is restored.

11. Cookies and similar technologies

Our website uses cookies and similar technologies for functions such as maintaining the shopping cart, managing sessions, supporting checkout and protecting the website.

Only technologies that qualify for the applicable strictly necessary exception may be used without consent.

Optional statistics, marketing or embedded-content technologies, where used, require prior consent when the law requires it. Refusing optional technologies does not prevent access to the website’s basic booking functions, although particular optional content may remain unavailable.

Website statistics. If you accept statistics cookies, we use Google Analytics 4 to understand how visitors use the website, for example which pages are visited and what type of device is used. Google Analytics does not load until you have given consent, and you can withdraw consent at any time in the cookie settings. Google Ireland Limited processes this information on our behalf, and some processing may take place in the United States under the EU–US Data Privacy Framework (see Section 9).

Our Cookie Policy and cookie settings provide information about the technologies, providers, purposes and durations.

You can accept or reject optional technologies and change or withdraw your choices through the website’s cookie settings. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Acceptance of our booking terms does not constitute consent to optional cookies or tracking.

12. Marketing and service communications

We do not currently send general promotional newsletters.

We send messages needed to answer your enquiry or administer a booking, payment, activity, refund, complaint or trip plan. These service messages do not depend on consent to marketing.

If we introduce electronic marketing, we will provide the relevant information and obtain consent where required. Marketing messages will include a way to opt out.

13. Photographs and video

We ask for consent before taking or using identifiable photographs or video of participants for our promotional purposes. The intended uses and channels must be explained when consent is requested.

You can decline promotional photography or filming without affecting your booking. Consent from other adult participants must come from those participants themselves.

For children, appropriate permission from a parent or legal guardian will be obtained, taking account of the child’s age, wishes and applicable law.

You may withdraw consent by contacting info@nordfjordwild.no. We may need reasonable information to identify the relevant image or confirm your identity.

Following withdrawal, we will stop consent-based promotional use and remove the relevant material from digital channels under our control. A restricted copy may be retained only where a separate lawful basis requires or permits it, such as evidence needed for a legal claim.

Withdrawal does not make previous lawful use unlawful. Printed material already distributed cannot necessarily be recalled. Where third parties have independently copied or shared material, we will take reasonable steps required by law, but cannot guarantee removal of copies outside our control.

14. Information about children

Bookings must be made by an adult. We collect information about children only where needed to administer the booking, apply activity requirements or address safe participation.

Parents and guardians should provide only necessary information and help children understand relevant privacy information in a way appropriate to their age.

Health information and promotional images of children receive the additional protections described in this policy.

15. Your rights

Subject to the conditions and exceptions in applicable law, you may:

Request access to your personal information.
Have inaccurate or incomplete information corrected.
Request deletion.
Request restriction of processing.
Object to processing based on legitimate interests.
Receive information covered by the right to data portability in a suitable electronic format.
Withdraw consent where processing relies on consent.
Complain to a data-protection supervisory authority.

Where we rely on legitimate interests, you may object on grounds relating to your particular situation. We must stop the processing unless an applicable legal exception allows it to continue.

If information is used for direct marketing, you may object to that use at any time.

Some information must be retained despite a deletion request, for example where required by accounting law or necessary for a legal claim. We will explain any applicable exception.

16. Exercising your rights

Contact info@nordfjordwild.no to exercise your rights or ask questions about this policy.

We may request proportionate information to verify your identity where necessary. Do not send identity documents unless we have explained why they are needed and how to provide them.

We will respond without undue delay and normally within one month. Where permitted because of the complexity or number of requests, this may be extended by up to two further months. We will explain the reason for an extension within the first month.

Requests are normally handled free of charge. Any refusal or charge must be justified under the conditions in data-protection law.

Consent can be withdrawn without charge. You can use cookie settings for cookie consent or contact us for other consent-based processing.

17. Automated decision-making

Nordfjord Wild does not itself use solely automated decision-making that produces legal or similarly significant effects on customers.

Payment providers may use automated fraud-prevention or authentication systems under their own responsibilities and privacy notices.

18. Security

We use technical and organisational measures appropriate to the information and risks involved. These include restricting access to people who need it and protecting information during storage and communication.

Health information and medical evidence require additional care. Consent does not remove our obligation to use appropriate security measures.

No system can be guaranteed completely secure. Where a personal-data breach occurs, we will assess and meet any applicable notification obligations.

19. Other websites

Our website and trip plans may link to independent websites or services. Their operators are responsible for their own processing of personal information.

Review their privacy notices before providing information or using their services.

20. Changes to this policy

We may update this policy when our services, providers, processing or legal obligations change. The current version will be published with its effective date.

Where required, we will provide additional notice before using information for a new purpose and obtain new consent if needed. Publishing an updated policy does not by itself authorise a new use of personal information.

21. Privacy complaints

You may contact us about a privacy concern so that we can investigate and respond.

You also have the right to complain directly to a supervisory authority, including the Norwegian Data Protection Authority:

Datatilsynet
Website: datatilsynet.no

Where applicable, you may also complain to the supervisory authority in the EEA country where you live or work, or where the alleged infringement occurred. You do not have to complain to us first.