Privacy Notice

Havila Voyages, October 2023

HAVILA KYSTRUTEN OPERATIONS AS (‘Havila/we/us/our’) and our group respect your right to data privacy and are committed to protecting and preserving the confidentiality of the information you share with us whether on-board or while interacting with us digitally, verbally, in writing or via our website. This notice tells you what personal data we use, how we collect it, why and who we process it with and how long we hold on to it. We have provided detail of your legal rights regarding your data below, but briefly, we wish to assure you of our commitments to:

Using your personal data only in accordance with your expectations in providing services to you.
Never renting, selling or sharing your data with other organisations or third parties without your prior knowledge.
Never save your personal data longer than what is necessary for the purpose they are collected for.

When we collect your personal data, we are acting as a data controller.

If you wish to contact us, you can email: [email protected] or write to us at:

Havila Kystruten

Box 215

6099 Fosnavåg

Norway

What is Personal Data and How do we collect it?

We process your personal data to satisfy your requests for information and make your travel bookings. This happens when you decide to interact with us in providing :

Travel booking information - Including direct identifiers (your name, address, telephone number, email address, passport information, next of kin), identity data (date of birth, gender and nationality), and health data (including dietary requirements), in which case your explicit consent will be requested.
Digital Information - We may correspond through social media, our website, newsletters, surveys or online chat. In which case, in addition to your name, we may record your questions, requests, comments, reviews, and digital data (including your IP address, browser data and geo-location). For more information, please see our Cookies Policy
Personal data- collected when you use our services in addition to the above, which may include CCTV on our vessels. As well as a picture taken at check-in to identify you on our on board system, that will be deleted after 40 days .
Information collected from other sources, including marketing information.

Your transaction data (credit card information and purchase history) to fulfil your booking will be collected by our payment services provider – details are below.

How we process data for profiling

We want to send you direct marketing communications that we think you’ll find interesting. To achieve this, we use profiling to help us tailor the information we send to you.As part of this process, we and our third-party suppliers look at how you’ve interacted with us in the past, for example, requesting a brochure, purchase history or web browsing alongside geographical, demographic and publicly available information about you, such as your age or perceived economic status.

We rely on the Legitimate Interests legal basis to conduct profiling which means that you have the right to object to being profiled by us. You can opt-out by emailing [email protected].

How we process data for direct marketing by post

We keep in touch with our customers by post to ensure that you receive the latest news and offers about Havila Voyages. When we process your personal data this way, we do so under the lawful basis of legitimate interests. You can opt-out of receiving communications by post at any time by emailing [email protected].

Why do we process your data, and who do we share it with?

We use your personal data to:

Fulfil your request to travel and meet our contractual obligation to providing services to you.
Keep you updated with relevant information regarding your booking.
Provide you with offers and additional services.
Ensure you and fellow passengers travel safely on-board our vessels.

We may process and disclose your personal data to:

Any member of our group of companies (this means our subsidiaries, our ultimate holding company and all its subsidiaries) insofar as reasonably necessary to arrange your travel booking.
Our booking agents, expedition partners, insurers and/or professional advisers insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.
Financial transactions relating to our website and services are handled by Fexco Payment Gateway, our payment services providers. We will share transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds. You can find information about the payment services providers' privacy policies and practices at https://fexco.com/

In addition to the specific disclosures above, we may also disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

How long do we hold your data?

Personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

We will retain and delete your personal data as follows:

Travel booking data – will be retained for 5 years after the completion of your voyage.
Digital Information – may be held for up to 2 years following your interaction with us.
CCTV – is held for 48 hours, unless required for investigation, in which case we will adhere to the requirements of local law enforcement.
Enquiry data from other sources – is held to fulfil your enquiry, but no longer than six months.
Financial transaction data will be retained to comply with accounting standards and tax law, no longer than 10 years.

Notwithstanding the other provisions stated above, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.

Amendments

We may update this policy from time to time by publishing a new version on our website.

You should check this page occasionally to ensure you are happy with any changes to this policy.

We may notify you of changes to this policy by email.

Your rights

We have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included here – please see the link to the Datatilsynet below.

Your principal rights under data protection law and our timescales for responding are:

Full details of your rights are available from the norwegian Data Protection Authority .

You may also have the right to complain about our use of your information via their website (link above) or by contacting them at:

Datatilsynet

Tollbugata 3

0152 Oslo

Tel +47 22 39 69 00

email: [email protected]