Privacy - Riddergaarden

PRIVACY AND TERMS OF USE

1.1 This website is owned and operated by Riddergaarden. 1.2 These terms ("Terms of Use") apply to your use of the website. By having access to, visiting and using the website, you agree to the terms applicable at any time for the website. 1.3 Users undertake not to violate Norwegian law when using the website.

2 CHANGE OF WEBSITE AND TERMS OF USE

2.1 In order to improve your use of the website, Riddergaarden may make changes to it. 2.2 Riddergaarden reserves the right to, without prior notice, make the improvements, changes, additions or removal of information on the website that is deemed necessary. Furthermore, Riddergaarden reserves the right to make changes to the Terms of Use. By continuing to use the website after such changes have been posted, you accept the changes.

3 INTELLECTUAL RIGHTS

3.1 All content on the website is owned, unless otherwise stated, by Riddergaarden. 3.2 The website's content is in all respects protected by copyright, trademark law and other intellectual property law provisions. Users are under no circumstances granted the right to use the website's content in any other way than in accordance with the Terms of Use. 3.3 Unless otherwise stated, reproduction, publication, processing, transmission, storage or other use of the content on the website requires prior written approval from Riddergaarden. Exceptions are made for random storage of dates or printing for special personal use. 3.4 The actual use of the trademark and logotypes appearing on the website requires the prior written consent of Riddergaarden or other affected rights holders.

4 HYPERLINKS

4.1 Riddergaarden's website may contain hyperlinks to websites owned and supplied by third parties. The use of such links means that you leave Riddergaarden's website. 4.2 Riddergaarden has no control over the design of, or can influence the content of, websites provided by third parties. 4.3 That Riddergaarden offers such links does not imply that Riddergaarden stands behind the information, product or service offered via hyperlinks. 4.4 As Riddergaarden is not responsible for the handling and privacy of your personal information on these pages, Riddergaarden recommends that you read the terms and conditions that apply to your use of the website. Use of pages belonging to third parties is solely at the user's risk.

5 CONTENT ON THE WEBSITE CREATED BY THE USERS

5.1 Riddergaarden will be able to give users of the website the opportunity to publish or upload content on the website themselves. 5.2 By uploading, publishing or otherwise creating content on the website, you contribute to creating content on the website for which you bear full responsibility, and which

you as a user can be held responsible for. 5.3 Users undertake to indemnify Riddergaarden, and confirm that published content does not infringe third party rights such as copyright etc. Riddergaarden does not in any way take responsibility for content created by the website's users. 5.4 Riddergaarden reserves the unrestricted right to, at its own discretion, remove all or part of such content that has been created by the website's users, and which there is a risk of fully or partially contravening Norwegian law, or which is considered by Riddergaarden to be inconvenient, offensive , vulgar, insignificant or indecent, or which in any other way may cause damage to Riddergaarden or its partners. 5.5 Riddergaarden reserves the right to take further measures to prevent abuse and other harmful actions. 5.6 The users own the rights to the material, but give Riddergaarden a global and temporally unlimited right to freely and without costs and restrictions, use the material published on the website.

6 LIMITATION OF LIABILITY

6.1 Riddergaarden makes no guarantees regarding the website's function or availability. 6.2 Riddergaarden also does not guarantee that the information available on the website is correct or complete. This includes information about both products, services and offers as well as other information as stated on the website. 6.3 Riddergaarden is neither responsible for direct or indirect damage caused by the use of the website, nor information on the website, to the extent that such responsibility does not follow from preceptorial legislation.

7 USE AND HANDLING OF COOKIES

7.1 Riddergaarden uses "cookies" to simplify the use of its website. 7.2 A cookie is a small text-based data file that a web server can request to store on a website visitor's hard drive. The cookie helps to recognize the type of content and which pages are visited on our website. Information stored using a cookie can be how the user uses the website, what type of browser the user uses and which websites the user has visited. The cookie enables Riddergaarden to improve your visit to its website. 7.3 A permanent cookie remains on the user's computer for a specific period of time. A session cookie is randomly stored in the computer's memory while the visitor is on a website. The session cookie disappears when the user closes their browser. Riddergaarden uses both permanent cookies and session cookies. Riddergaarden may also use third-party cookies. 7.4 If the user does not want to allow cookies, the user can choose to change the settings for the user's browser so that cookies are not accepted. If the user does not accept cookies, this may affect the website's functionality.

8 HANDLING OF PERSONAL INFORMATION

8.1 Riddergaarden handles your personal data in accordance with the Norwegian Act on the processing of personal data, and safeguards personal integrity when handling your personal data. 8.2 By using Riddergaarden's website, you accept that Riddergaarden actively collects, handles, stores and uses, as well as otherwise processes your

personal information so that Riddergaarden and its partner company can offer the products and services offered via Riddergaarden's website. 8.3 For persons under the age of 18, the guardian's consent is required as a starting point for the registration and handling of personal data. By agreeing to these terms, you confirm that you are either over 18 years of age or that your guardian consents to Riddergaarden storing and handling your personal data in accordance with these terms. Riddergaarden reserves the right to have the consent verified. 8.4 Riddergaarden has the right to use your personal data to send you information about offers and products. If you do not wish to receive such information, please contact customer service which you can reach via e-mail: kontakt@riddergaarden.no 8.5 Riddergaarden may engage subcontractors to perform a number of functions such as e.g. marketing and technical services for the website. These subcontractors may, in certain cases, gain access to the user's personal data if it is necessary to carry out an assignment for Riddergaarden. Riddergaarden processes all personal data with the utmost care and subcontractors may only use the personal data to carry out assignments for Riddergaarden. The subcontractors do not have the right to store personal data and do not have the right to use it in any other way than to carry out their mission for Riddergaarden.

8.6 The user agrees that the personal information about the user is stored and used in the manner and for the purposes stated in points 8.1 – 8.4. 8.7 The user agrees that information/registration information is used to identify the user with regard to the target group for marketing purposes. The user also agrees that such information may be disclosed to third parties for marketing purposes. Such disclosure of information will always be anonymised. 8.8 The user has the right, after a written application to Riddergaarden, to obtain information about what personal data is registered about the user. The user can ask for any incorrect personal data to be corrected. The user can also apply to have the personal data deleted. Such an application is submitted to the hotel's booking department by sending an e-mail to kontakt@riddergaarden.no

9 SECURITY ON THE WEBSITE

9.1 Riddergaarden, as well as our partner companies, will use the information you provide for transactions on the website. Such information includes credit and payment card information as well as addresses for deliveries and invoices. 9.2 Riddergaarden takes all reasonable steps to protect the information you provide in this area in connection with transactions. However, Riddergaarden does not guarantee the security of the information you provide.

Privacy statement for Riddergaarden

1 Introduction

We at Riddergaarden process your personal data in various contexts, for example when you order services from us, stay overnight in our hotels, use services we provide and in certain other contexts. In our privacy policy you will find more information about our processing of personal data. Below you will also find contact information if you have questions or would like to request access.

We process your personal data in accordance with the current Norwegian Personal Data Act, including GDPR.

2. Controller of your personal data

Our company Riddertunet Lodge AS, organization no. 990 519 293, Skjenhauglie 41, 2953 Beitostølen, and Beitostølen Resort AS, organization no. 985 797 013, Bygdinvegen 3812, 2953 Beitostølen, tel. 61351000, email: kontakt@riddergaarden.no is responsible for processing personal data in our systems for booking, invoicing and hotel operations. We are also responsible for processing our marketing and sending emails from us to our customers and contacts.

3. Processing of personal data related to booking and stay

In connection with your bookings made by yourself or by others on your behalf, we process the personal data we need to be able to fulfill the agreement on booking and purchase of services. This is information you have given us directly or that you have given us via a travel agency or agent. For example, we process information about your identity, your contact details and your payment information. In some cases, we will store your passport number. In addition, we process other information you may have given us that is relevant to your stay with us. This can be information about allergies or about special wishes for your stay. We register all purchases and orders you make with us, such as spa, restaurant, etc., in order to deliver such services and so that you can pay for them.

We process this information for as long as it is necessary to fulfill the agreement on booking with you, and in addition for as long as applicable legislation or government orders require us to do so.

We log the use of key cards. We do this to prevent and solve crime, and for reasons of safety, including fire safety.

4. Processing of personal data for marketing purposes

If you sign up for our newsletter, we save and use your email address to send you news and offers from us.

We will also use your e-mail address or telephone number to send you news and offers within the rules on existing customer relationships. Our basis is marketing legislation.

We will contact you in social media after your consent or within existing customer relationships. In order to use social media as a communication channel, we must provide your email address or telephone number to the social media. Our basis for this is consent or legitimate interests.

You can withdraw the consent you have given us at any time. You can also opt out of receiving marketing in existing customer relationships. You do this by sending an email to kontakt@riddergaarden.no.

5. Processing of personal data for development, troubleshooting and security

We will process data that includes personal data to troubleshoot and correct errors, improve our services and the technology we use, and to analyze usage and user behavior. Furthermore, we will process personal data to verify your identity, including verifying identity in connection with your use of our digital services.

We anonymise data or prepare statistics as far as we can, but will also have to process personal data for development, troubleshooting, statistical and security purposes.

6. Processing of personal data in general

If you contact our customer service or otherwise contact us with enquiries, we will process the personal data you provide as far as is necessary to answer and log your inquiry. The basis for this is legitimate interests or to fulfill agreements with you or answer your inquiries.

In addition to processing described in our privacy policy or based on your consent, we will in some cases have to or be able to process personal data when applicable legislation, including the Personal Data Act and GDPR, a valid authority order or a court requires us to do so or allows us to do so.

7. Disclosure of personal data and statutory processing.

We do not release your personal data to third parties, unless you have consented to this, or unless applicable legislation, including the Personal Data Act and the GDPR, a valid authority order or a court allows or requires us to do so.

For the record, we state that our use of a data processor to process information on our behalf is not considered disclosure.

8. Your rights

You as an individual have several rights according to the personal data regulations.

You have the right to demand access, correction or deletion of the personal data we process about you. You also have the right to demand limited processing, object to the processing and demand the right to data portability.

We will ask you to confirm your identity or ask you to provide additional information before we allow you to exercise your rights with us. We have to do this to make sure that we only give access to your personal data to you - and not to someone pretending to be you.

9. Personalization of your stay with us

Riddergaarden wants to offer our customers the best possible hotel stay adapted to the individual guest's preferences and purchase history.

We will, based on legitimate interests, use information we have received from you about your preferences for rooms (for example "window facing the mountain" "want a quiet room") and information about your purchases with us ("sparkling water" rather than "still water" ») to offer you a customized stay.

This information is collected based on your purchases with us and the wishes you express to our employees.

We will also sometimes collect information about you from open sources such as the internet and social media, limited to information relevant to offering you a personalized stay with us. The basis for this is legitimate interests.

The information will not be given out to others.

You can object to our use of your information for the personalization of your stay. You can do this by sending an email to kontakt@riddergaarden.no

10. Changes in privacy policy or in processing

We are continuously working on the development and improvement of our services to our customers. This could change the way or scope of our processing of personal data. The information we provide through this privacy policy will therefore be adjusted and updated at irregular intervals. We will also change the privacy policy when new rules or official practices make it necessary.

Here you will find the terms of use for our websites. If you have any questions, please contact customer service, either by e-mail kontakt@riddergaarden.no or by phone +47 61 35 10 00. We also refer to our Privacy Policy, which you can find information about in the section above.