Privacy Policy for Nordlys Kart Arena

1. Introduction and company information

This Privacy Policy explains how Nordlys Kart Arena collects, uses, stores, shares, and protects personal data when you visit our premises, use our services, contact us, book activities, participate in karting sessions, or otherwise interact with us.

Data controller: Nordlys Kart Arena

Address: Nordlys Kart Arena, Sluppenvegen 25, 7037 Trondheim, Norway

Email: [email protected]

Phone: +47 73 84 29 16

We process personal data in accordance with applicable privacy laws and principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality.

2. Data collection and processing

Nordlys Kart Arena may collect and process the following categories of personal data, depending on how you interact with us:

• Identification and contact information: name, email address, phone number, billing details, and other contact information.
• Booking and service information: reservations, participation details, event registrations, preferences, and service history.
• Payment information: payment status, transaction references, and limited payment-related data. Card payments are typically processed by our payment service providers; we do not store full card details unless necessary and permitted.
• Age and eligibility information: information needed to verify whether a participant meets safety, age, height, or other participation requirements.
• Safety and incident information: accident reports, incident logs, waiver or consent records, and information required for safety management.
• Technical data: IP address, device information, browser type, log data, cookies, and similar online identifiers when you use our website or digital services.
• Image and video data: CCTV recordings, photographs, or video recordings captured on our premises for security, safety, and operational purposes, where permitted by law.
• Communication data: correspondence with us by email, phone, contact forms, or social media.

We normally collect personal data directly from you, but we may also receive data from third parties such as booking platforms, payment providers, event partners, or public authorities where lawful and necessary.

3. Purpose of data processing

Nordlys Kart Arena processes personal data for the following purposes:

• to manage bookings, registrations, and customer accounts;
• to provide karting services, events, and related customer support;
• to verify eligibility, safety requirements, and participation conditions;
• to process payments, refunds, and accounting records;
• to communicate with customers and respond to inquiries;
• to maintain safety, security, and incident management on our premises;
• to operate and improve our website, systems, and services;
• to comply with legal obligations, including accounting, tax, consumer, and safety requirements;
• to establish, exercise, or defend legal claims;
• to send marketing communications where permitted and, where required, with your consent.

4. Legal basis for processing

We process personal data only when we have a valid legal basis. Depending on the situation, our legal bases may include:

• Performance of a contract: when processing is necessary to provide karting services, manage bookings, or fulfill related obligations.
• Legal obligation: when processing is required to comply with applicable laws, including accounting, tax, safety, and record-keeping obligations.
• Legitimate interests: when processing is necessary for our legitimate business interests, such as ensuring safety, preventing fraud, improving services, and maintaining security, provided that your interests and fundamental rights do not override those interests.
• Consent: where we rely on your consent, for example for certain marketing activities or optional cookies, you may withdraw consent at any time.
• Vital interests: in exceptional cases, where processing is necessary to protect someone’s life or physical safety.

5. Data sharing and third parties

Nordlys Kart Arena may share personal data with trusted third parties only when necessary and lawful. These may include:

• Payment service providers for processing transactions;
• IT and hosting providers for website, email, cloud, and system support;
• Booking and ticketing platforms used to manage reservations and customer communications;
• Accounting and auditing providers for financial administration;
• Insurance providers in connection with claims, incidents, or coverage;
• Safety and security providers such as CCTV, access control, or alarm service providers;
• Public authorities where disclosure is required by law or necessary to protect rights, safety, or legal interests.

We require third parties that process personal data on our behalf to protect it appropriately and to use it only for the agreed purposes.

6. Data transfer to third countries

Some of our service providers may be located outside Norway or the European Economic Area (EEA). If personal data is transferred to a country outside the EEA, Nordlys Kart Arena will ensure that appropriate safeguards are in place, such as:

• an adequacy decision by the relevant authorities;
• standard contractual clauses or equivalent transfer mechanisms;
• additional technical and organisational measures where necessary.

Where required by law, you may request more information about such transfers and the safeguards used.

7. Storage duration

Nordlys Kart Arena retains personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods may vary depending on the type of data and the purpose of processing.

• Booking and customer records: retained for the period necessary to manage the service relationship and handle follow-up matters.
• Accounting and tax records: retained for the period required by applicable law.
• Safety and incident records: retained for as long as necessary for safety, insurance, and legal purposes.
• Marketing data: retained until you withdraw consent or object, or until the data is no longer needed.
• CCTV and security recordings: retained for a limited period unless needed for investigation, legal claims, or security incidents.

When personal data is no longer needed, we delete, anonymise, or securely archive it in accordance with applicable requirements.

8. User rights

Subject to applicable law, you may have the following rights regarding your personal data:

• Access: to request confirmation of whether we process your personal data and to obtain a copy of that data.
• Rectification: to request correction of inaccurate or incomplete data.
• Erasure: to request deletion of your data in certain circumstances.
• Restriction: to request that we limit processing in certain situations.
• Data portability: to receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Objection: to object to processing based on legitimate interests and to object at any time to direct marketing.

To exercise your rights, please contact us using the details below. We may need to verify your identity before responding. We will respond within the time limits required by applicable law.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

If you withdraw consent, we will stop the relevant processing unless we have another lawful basis for continuing it.

10. Right to complain

If you believe that Nordlys Kart Arena has processed your personal data unlawfully or not in accordance with applicable privacy laws, you have the right to lodge a complaint with the relevant supervisory authority.

In Norway, this is typically the Norwegian Data Protection Authority (Datatilsynet). We encourage you to contact us first so that we can try to resolve your concern directly.

11. Data security

Nordlys Kart Arena takes appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:

• access controls and role-based permissions;
• secure storage and encryption where appropriate;
• regular updates and security monitoring;
• staff confidentiality obligations and training;
• incident response and backup procedures;
• physical security measures at our premises.

While we work to protect your information, no system can be guaranteed to be completely secure.

12. Contact information

If you have questions about this Privacy Policy or our processing of personal data, or if you wish to exercise your rights, please contact:

Nordlys Kart Arena
Nordlys Kart Arena, Sluppenvegen 25, 7037 Trondheim, Norway
Email: [email protected]
Phone: +47 73 84 29 16

13. Changes to privacy policy

Nordlys Kart Arena may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or operational needs. The updated version will be published when appropriate, and the date of the latest revision may be indicated if used by us.

We encourage you to review this Privacy Policy periodically to stay informed about how we process personal data.