Goto Norway AS (org. no. 925 038 555) (“GOTO”) wants to make natural attractions, trips and experiences available in an easy and responsible way. GOTO is the licensee of a digital market Platform (the “GOTO Platform"). The activity providers (the “Activity Provider”) are suppliers of activities, tours and experiences (the "Product") that offer their Product for sale on the GOTO Platform to customers (the "Customer"). People who use the GOTO Platform, whether an Activity Provider, Customer or otherwise, are referred to in the following as “Users”.
GOTO values your privacy rights and has taken reasonable steps to protect your privacy, including by implementation of physical, technical and organizational measures, to prevent loss, alterations, theft and unauthorized access to information stored and otherwise processed.
2 ROLES IN THE PROCESSING OF PERSONAL DATA
The data controller is the one who determines the purpose and means for the processing of personal data. A data processor is someone who processes personal data on behalf of the data controller.
GOTO is the data controller for the processing of personal data when GOTO determines the purpose of the processing and which funds to use. GOTO is the data controller for the processing of personal data about Users of the GOTO Platform for the purpose of being able to respond to inquiries from Users, enter into agreements with Activity Providers regarding the advertising of the Product on the GOTO Platform. GOTO is also the data controller for the processing of personal data about Customers for the purpose of managing the sale and payment of the Product and associated administration, including the registration and communication with customers.
GOTO and the Activity Provider have a separate processing responsibility for the processing of personal data because GOTO determines for itself the purpose of the processing of the Users of the GOTO Platform and the Activity Provider decides for itself the purpose of the processing of personal data for its Customers.
GOTO will not be a data processor in its processing of personal data because GOTO itself determines the purpose of the personal data and does not collect information on behalf of the Activity Provider that GOTO does not itself need in order to provide the GOTO Platform to the Activity Provider and the Customer.
1.2 GOTO as data controller
GOTO processes personal data in connection with you as a User registering as a user on the GOTO Platform, sending us an inquiry via the GOTO Platform or otherwise contacting us, entering into an agreement with us about advertising, or if you as a Customer make a purchase and payment of a Product on the GOTO Platform, as well as by other follow-up of the Activity Provider, the Customer or the User.
This means that GOTO is the data controller for the processing of personal data about:
- GOTO Platform Users
- The Customer Purchasing Product via the GOTO Platform
- Persons who contact GOTO, e.g. by sending an inquiry via our website
- Visitors to GOTO's website
- Contact persons of customers, suppliers and other partners
- Signed up for GOTO's newsletter
3 PERSONAL DATA PROCESSED, PURPOSE AND LEGAL BASIS
As data controller, GOTO collects your personal data in various ways, such as when you register as a User or purchase a Product, as well as by your other use of our website or by phone/email or other contact.
GOTO may process your personal data in connection with the following processing activities:
- To provide our service and manage you as a User or Customer, including registering you as a User, where your name and contact information are processed, and conducting a sale to you as a Customer where your name, contact information and your card and payment information are processed. We may also process personal data to provide user support. The processing takes place on the basis that it is necessary to process your personal data in order to fulfil an agreement entered into with you when you registered as a User or Customer.
- To allow you to use the Product you have purchased from the Activity Provider, where we process your name and contact information, as well as practical information related to your participation in the trip/experience such as name, contact information , age, health/allergy information and any other accessibility requirements that you have asked for. We will also share this personal data with the Activity Provider. The purpose of the information is to provide information to the participants, manage and facilitate the trip and/or experience and prepare participant lists. The processing is based on a balancing of interests, where our legitimate interest is to allow the Activity Provider to provide you with the Product in a good way.
- For security purposes, including for the implementation or maintenance of security measures on the GOTO Platform or handling of any security breaches. In connection with such activities, we may process personal data about Users and the Customer. The processing is based on a balancing of interests, where our legitimate interest is to ensure and safeguard a suitable level of safety for the GOTO Platform.
- Respond to inquiries we receive from you, where we process your name, phone number, email address and any personal data that may result from the inquiry. The processing is based on a balancing of interests, where our legitimate interest is to follow up your inquiry.
- Send out newsletters via the GOTO Platform to you as a User or Customer if you have consented to this, where we process your name, phone number and email address. You can manage your consents on your profile page.
- Administration of supplier, customer and other partners, where the name and contact information of our contact persons of suppliers, customers and other partners are processed, in addition to personal data contained in contracts, ongoing correspondence, meeting minutes, etc. The processing is based on a balancing of interests, where our legitimate interest is to manage the supplier, customer or partner relationship, including communicating with our contact persons.
- Compliance with statutory requirements and legal obligations, to comply with statutory requirements, such as accounting obligations, and to comply with other orders of public authorities.
- Safeguard the rights of GOTOs or third parties to establish, enforce and defend legal claims that we believe to have, or are directed at us by customers, suppliers, partners, other third parties or public authorities.
- In connection with a merger, share sale or transfer of all or part of the business, GOTO may process personal data and disclose personal data to a prospective buyer, for example as part of a company review (due diligence process). This will be based on a balancing of interests, where our legitimate interest is to prepare and carry out such transactions if we deem it appropriate for our business. GOTO will never disclose personal data in such cases without entering into a confidentiality agreement that ensures the confidentiality and protection of your personal data, and will as far as possible anonymize the personal data prior to disclosure.
The age limit for Users or Customers is 18 years.
We do not knowingly process personal data of minors under the age of 15.
3 RETENTION PERIOD
GOTO will not store your personal data for longer than is necessary to achieve the purposes for which the personal data was collected. If the processing relies on consent, the processing will cease when you withdraw your consent. You can withdraw your consent at any time.
As a general rule, GOTO will delete personal data about Users who have created user profiles when the user profile is deleted on the GOTO-Platform.
The personal data will nevertheless be retained for as long as is necessary for GOTO to fulfil statutory and legal obligations, including requirements for continued storage under accounting legislation, as well as to the extent necessary to safeguard GOTO's rights.
4 DISCLOSURE TO THIRD PARTIES
GOTO will only disclose personal data to third parties to the extent we have a legal basis for this.
GOTO may use data processors to collect, store or otherwise process personal data on our behalf. The relationship with such data processors will be regulated through a data processing agreement, which ensures, among other things, confidentiality and safeguarding information security at all levels. Your personal data may be subject to processing or storage outside the EU/EEA. GOTO will ensure that your personal data is subject to adequate security guarantees, including through the use of the EU Standard Terms and Conditions for such transfer or when transferring to countries pre-approved by the European Commission. Please contact us if you would like more information about this.
GOTO may in some cases disclose personal data to public authorities in order to comply with statutory requirements or comply with government orders, for example to comply with obligations under accounting or tax legislation. Public authorities will be the data controller for any personal data we disclosed by us in such cases.
5 LINKS TO OTHER WEBSITES AND SOCIAL MEDIA
6 YOUR RIGHTS
As a data subject, you are entitled to request access to the personal data we process about you, request that GOTO updates or corrects your personal data and/or withdraw any consent to processing. In some circumstances, you are also entitled to request that your personal data is erased, request restriction of processing or object to processing and/or request data portability (the right to have personal data disclosed or transferred in an appropriate format). If the processing is based on your consent, you can withdraw it at any time.
If you wish to exercise your rights, you can contact us using the contact details provided above in section 1. You also have the opportunity to correct your contact information in the GOTO Platform if you have registered as a User.
You have the right to complain about our processing of your personal data to the Norwegian Data Protection Authority. We encourage you to raise any objections to GOTO's processing of personal data with us first.
6 CHANGES TO THE PRIVACY STATEMENT
If we make changes to the processing of personal data that requires your consent, we will obtain your consent before we initiate such a change in processing.
Last updated: 2021-11-01