Privacy policy

Last updated: June 2026

1. Controller

The controller responsible for processing personal data on this website is the operator of Svalbardway. For any privacy matter, including requests to access, correct or delete your data, contact info@svalbardway.com.

2. What we process and why

Enquiries (trip planner & contact form). When you submit a form we process the data you enter: your name, email address, phone number (if given), travel preferences and your message, solely to answer your request, prepare an offer and correspond with you. Providing this data is voluntary, but without at least an email address we cannot reply.

Server logs. When you visit, our hosting provider automatically processes technical data (IP address, date and time, requested URL, referrer, user agent) to deliver the site securely and reliably. This data is not used to identify you and is kept only for a short period for security purposes.

3. Legal bases

Processing of enquiries is based on Art. 6(1)(b) GDPR (steps taken at your request prior to a contract) and Art. 6(1)(f) (our legitimate interest in answering and documenting enquiries). Hosting and security logging rely on Art. 6(1)(f). Optional cookies and any future analytics or marketing run only on your consent, Art. 6(1)(a) GDPR in conjunction with the applicable ePrivacy rules; you can withdraw consent at any time with effect for the future.

4. Cookies & consent

We use only what is necessary to run the site (e.g. hosting/CDN, bot protection, and storing your consent choice); these do not require consent. Optional categories (Functional, Statistics and Marketing) are off by default and load only after you actively allow them in our consent banner. You can review or change your choice at any time:

Open cookie settings

5. Recipients & processors

We use carefully selected service providers who process data on our behalf under data processing agreements (Art. 28 GDPR):

• Cloudflare, Inc.: website hosting, content delivery and security (server logs, bot protection).
• Brevo (Sendinblue SAS, France): sending the transactional emails triggered by your enquiry (your confirmation and our internal notification).
• Zoho Corporation (Zoho Bigin): our CRM, where your enquiry is stored so we can manage and follow up on it.
• Google Ireland Ltd. (Google Ads): measuring the effectiveness of our ads. Only with your consent (Consent Mode v2); we record the ad click identifier and campaign source of your visit to attribute enquiries. Without consent no advertising cookies are set and no personal data is sent to Google.

We do not sell your data and do not share it with third parties for their own marketing.

6. International transfers

Some processors may process data outside the EU/EEA. Where that happens, the transfer is safeguarded by an adequacy decision or the EU Standard Contractual Clauses together with appropriate additional measures. You can request a copy of the relevant safeguards from us.

7. Retention

Enquiry data is kept for as long as needed to handle your request and for any subsequent business relationship, and thereafter for the duration of statutory retention periods, after which it is deleted. Server logs are deleted or anonymised after a short period.

8. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise any right, contact info@svalbardway.com.

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence or workplace: [COMPETENT SUPERVISORY AUTHORITY].

9. Changes

We may update this policy to reflect changes to the site or legal requirements. The current version always applies and is dated above.