Privacy Policy

We at Son Spa process your personal data in various contexts, for example when you book services with us, stay at our hotels, use our services, and in certain other situations. In our privacy policy, you will find more information about how we process personal data. Below you will also find our contact information if you have any questions or wish to request access. We process your personal data in accordance with the current Norwegian Personal Data Act, including the GDPR.

Data Controller for Your Personal Data

Our company, Norwegian Hospitality Group (NHR), org. no. 989 467 395, Strandveien 50, 1366 Lysaker, tel. +47 67 10 20 11, is the data controller for the processing of personal data in our systems for booking, invoicing, and hotel operations. We are also the data controller for our marketing and the sending of emails from us to our customers and contacts.

Processing of Personal Data Related to Booking and Stay

In connection with your bookings, whether made by you or by someone on your behalf, we process the personal data necessary to fulfill the agreement regarding booking and purchase of services. This includes information you have given us directly or via a travel agency or agent. For example, we process information about your identity, your contact details, and your payment information. In some cases, we may store your passport number. Additionally, we process other information you may have provided that is relevant to your stay with us, such as allergies or special requests. We register all purchases and bookings you make with us (e.g., spa, restaurant, room service) to deliver these services and ensure you can pay for them.

We retain this data for as long as necessary to fulfill the booking agreement with you, and additionally for as long as required by applicable legislation or regulatory obligations.

We log key card usage at our hotel for the purpose of crime prevention and resolution, and for safety reasons, including fire safety. Logs are stored for 21 days.

Processing of Personal Data for Marketing Purposes

If you subscribe to our newsletters, we store and use your email address to send you news and offers from us.

We may also use your email address or phone number to send you news and offers under the regulations for existing customer relationships. Our basis for this is marketing legislation.

We may contact you via social media with your consent or within the context of an existing customer relationship. To use social media as a communication channel, we must share your email address or phone number with the platform. Our basis for this is either consent or legitimate interest.

You may withdraw any consents you have given us at any time. You may also opt out of marketing in the context of an existing customer relationship. This can be done by emailing us at stay@sonspa.no.

Processing of Personal Data for Development, Troubleshooting, and Security

We will process data, including personal data, for troubleshooting and error correction, improving our services and technologies, and analyzing usage and user behavior. Furthermore, we will process personal data to verify your identity, including during your use of our digital services.

We anonymize data or prepare statistics where possible, but we may also need to process personal data for development, troubleshooting, statistics, and security purposes.

Processing of Personal Data in Other Contexts

If you contact our customer service or reach out to us with inquiries, we will process the personal data you provide to the extent necessary to respond to and log your inquiry. The basis for this is legitimate interest or to fulfill agreements with you or respond to your inquiry.

Beyond the processing described in our privacy policy or based on your consent, we may process personal data when applicable legislation, including the Personal Data Act and GDPR, valid regulatory orders, or court decisions require or allow us to do so.

AI ChatBot

Son Spa uses an AI chatbot to provide quick and easy access to information about our hotel. The chatbot collects information about your interactions, including questions and answers. This information is used to improve the chatbot’s performance and to provide you with a more personalized experience. You can choose not to interact with the chatbot at any time.

Disclosure of Personal Data and Legally Required Processing

We do not disclose your personal data to third parties unless you have consented or unless required or permitted by applicable laws, including the Personal Data Act and GDPR, valid regulatory orders, or court decisions.

For clarity, our use of data processors to process data on our behalf is not considered disclosure.

Your Rights

As a data subject, you have several rights under data protection laws.

You have the right to request access to, correction, or deletion of your personal data that we process. You also have the right to request restriction of processing, object to processing, and request data portability.

To exercise your rights, please visit: https://www.nordicchoicehotels.no/generelle-betingelser/generelle-betingelser/innsynsforesporsel/. We will respond as soon as possible, and no later than 30 days.

We may ask you to confirm your identity or provide additional information before allowing you to exercise your rights with us. This ensures we only provide your data to you—and not to someone pretending to be you.

Data Protection Officer

We are part of Strawberry. Strawberry has its own Data Protection Officer (DPO), who also serves as DPO for all Strawberry-affiliated hotels, including us.

The DPO is our contact point for the Norwegian Data Protection Authority (Datatilsynet).

The DPO advises all Strawberry hotels, our data processors, and our employees on the processing of personal data and relevant regulations. The DPO also monitors our compliance with data protection laws and our internal policies.

The DPO can help you exercise your rights or answer questions about how we handle your personal data.

You can contact the DPO at: DPO@choice.no

If you believe our processing of your personal data does not comply with this policy or otherwise violates data protection laws, you may also lodge a complaint with the Norwegian Data Protection Authority or the supervisory authority in the country where you are staying. You can find contact information on the Norwegian Data Protection Authority’s website: www.datatilsynet.no.

Cookies

We use cookies to improve your experience on our website.

A cookie is a small text-based data file placed on your device (smartphone, computer, tablet, etc.). Cookies help recognize what content and pages are visited on our site. Stored information may include how you use the site, what type of browser you use, and which pages you’ve visited.

A persistent cookie remains on your device for a set period. A session cookie is stored temporarily in your device’s memory while you’re on our website and disappears once you close your browser. We use both types. Nordic Choice may also use third-party cookies.

If you do not want our website to place cookies on your device, you can disable cookies in your browser. Disabling cookies may reduce the functionality of our website.

Personalization of Your Stay

Son Spa aims to offer our guests the best possible stay, tailored to individual preferences and purchase history.

Based on legitimate interest, we use information you have provided (e.g., “sea-facing room,” “quiet room”) and past purchases (e.g., “sparkling water” instead of “still water”) to offer a personalized stay.

This information is collected based on your preferences and communication with our staff.

We may occasionally collect publicly available information about you (e.g., from social media), limited to what’s relevant to offering a personalized stay. This is also based on legitimate interest.

This information will not be shared with others.

You may opt out of personalization by emailing us at: booking@sonspa.no.

Changes to the Privacy Policy or Data Processing

We continuously work on developing and improving our services. This may affect how we process personal data. Therefore, the information in this privacy policy will be updated from time to time. We will also update the privacy policy as needed to reflect changes in laws or regulatory practices.