Privacy policy
Updated: 3 August 2026
Data controller
Måløy Tours AS (org. no. 932 494 396), Gate 1 107, 6700 Måløy, Norway — contact@maloytours.no, +47 469 02 095 — is the data controller for personal data processed on this website.
Contact enquiries
When you use the contact form we process your name, email address and message in order to answer you. Legal basis: our legitimate interest in responding to enquiries (GDPR art. 6(1)(f)) — or, where your enquiry concerns a booking, steps taken at your request prior to a contract (art. 6(1)(b)). To prevent abuse of the form we also store your IP address and browser user agent; these are used only for rate limiting and are removed within 30 days. The message itself is deleted within 12 months.
Bookings
Bookings are handled by our booking provider Bokun in its own checkout. The details and payment data you enter there are processed by Bokun to fulfil your booking (art. 6(1)(b)). The booking widget is a third-party embed and only loads after you enable functional cookies.
Website statistics
We use Plausible for aggregate visitor statistics. Plausible sets no cookies and stores no personal data: your IP address and user agent are processed only momentarily, in memory, to generate an anonymous daily counter, and are never stored or used to identify you. Because no personal data is retained, no consent is required.
Guest reviews
We republish a selection of reviews that guests have posted publicly about us, for example on Google. These show the reviewer's name as published, the rating, the review text and any stated location. Source: the public review platform — we do not receive this from you directly. Legal basis: our legitimate interest in showing genuine guest feedback (art. 6(1)(f)). If you are a reviewer and do not want your review shown here, email contact@maloytours.no and we will remove it promptly.
Third-party content
Some pages embed content from others: the Bokun booking widget (loads only with your functional-cookie consent), a YouTube video (youtube-nocookie.com — loads only when you click play) and a map from OpenStreetMap on the contact page. When such content loads, your IP address is sent to that provider, who may process it under their own privacy policy.
Data processors and transfers
We use: Avent Digital (development and site operation), Bokun (tour booking and payment, Iceland/EEA), Supabase (form storage and admin login), Vercel (hosting) and Plausible (cookieless analytics, EU). They process data on our behalf under data processing agreements. Our databases and hosting are configured for the EU/EEA, but some providers are US-based companies or use sub-processors outside the EEA; where that happens the transfer relies on the EU Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.
Retention
Contact-form messages are deleted within 12 months (the IP address and user agent within 30 days). Guest reviews are shown until we or the reviewer remove them. Booking and payment records are retained by Bokun according to its policy and Norwegian accounting law (bokføringsloven, generally 5 years).
Your rights
You have the right to access, rectify, erase or restrict your personal data, to data portability, to object to processing based on legitimate interest, and to withdraw any consent at any time (cookie consent can be changed via the “Cookie settings” link in the footer). To exercise these rights, contact contact@maloytours.no.
Complaints
If you believe we process your data unlawfully, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).