1. Data Controller
Sámi Guide, Tromsø, Norway, is the data controller for the personal data collected through this website. Contact: booking@samiguide.no
2. What We Collect
When you send us a request, we collect:
- Contact info: Name, email, phone (optional), country you are travelling from (optional)
- Your wishes: Preferred date, number of guests, occasion (optional), and what you would like to experience (optional)
We do not ask for, and ask you not to include, health information or other sensitive personal data in the form. If your journey requires us to know about accessibility needs, we agree on that directly with you afterwards.
3. Legal Basis
We process your request data on the basis of legitimate interest (GDPR Art. 6(1)(f)) and, once you accept a proposal, to fulfil our agreement with you (Art. 6(1)(b)). We need your name, email, date and guest count to answer your enquiry at all. You can object to this processing at any time (see section 8).
4. How We Use Your Data
- To send you a confirmation email when you submit the form
- To prepare and send you a proposal, and to plan your journey with you
- To keep a simple record of requests we have received
We do not use your data for marketing, profiling, or automated decision-making.
5. Data Storage & Retention
Your request is sent to us by email and logged in a private spreadsheet that only the two of us can access.
- Requests and emails: Retained for up to 12 months after your travel date (or after your last message, if no journey takes place), then deleted.
- Cancelled journeys: Deleted within 30 days of cancellation.
6. Data Sharing & International Transfers
We share your data only with:
- Resend (email delivery, EU region) — to send confirmation and notification emails
- Vercel (hosting, US) — processes the form submission
- Google (Google Sheets, US) — stores the log of requests
- The guide or driver on your journey, when we hire one in (Norway) — they receive only what they need to run your day: your name, the date, the size of your group, pick-up point, and any dietary or accessibility needs you have told us about. Never your email address or phone number unless you ask us to pass them on.
Transfers to the US are covered by the EU–US Data Privacy Framework (DPF), under which these providers are certified, as recognised by the European Commission's adequacy decision of 10 July 2023.
We do not sell your data, and we do not share it with anyone else.
7. Analytics
We use Plausible Analytics, a privacy-friendly analytics tool that does not use cookies, does not collect personal data, and is fully GDPR-compliant. No consent banner is required.
8. Your Rights
Under GDPR, you have the right to:
- Access — obtain a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your data
- Restriction — request that we limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interest (Art. 6(1)(f))
- Complaint — lodge a complaint with Datatilsynet (Norwegian Data Protection Authority) at datatilsynet.no
To exercise any of these rights, email us at booking@samiguide.no. We will respond within 30 days.
9. Contact
For any questions about this privacy policy or your data, contact us at booking@samiguide.no.