Privacy & Cookie Policy

Who is responsible for your data

The data controller for personal data collected through this website is:

L.K. Holding AS operates the accommodation and boat rental marketed on this site under the name Atlantic Road Seaside Housing. We are not required to appoint a Data Protection Officer; enquiries about privacy go to the address above and are handled by the host, Karl Abel Sandvik Karlsen.

What personal data we collect

We collect only what you give us and what a web server unavoidably records. There is no account, no login, and no profile built about you.

Contact form

When you send a message from the contact page we receive your first name, last name, email address, optional phone number and the content of your message. This is emailed to the host and is not stored in a database on our side.

Booking and rental enquiries

When you request a stay from the booking page, or enquire about a boat, your enquiry is sent to the host by email and includes the dates, the home or boat you selected, the number of guests and whatever contact details and message you provide. Depending on how the enquiry is sent, it goes through our booking or contact endpoint, or opens a pre-filled message in your own email program — in the latter case nothing reaches us until you press send.

The booking page itself shows live availability and prices; asking for them sends only the home, the dates and the number of guests to our booking system, Hospitable, and nothing about you. Pressing Book now then takes you to Hospitable's own secure checkout page, on their domain, where you enter your name, contact details and card details. Card payment there is handled by Stripe. Neither the card number nor its security code is ever received, seen or stored by us — we get the reservation, the amount and the contact details you entered. Bookings are currently taken as requests: the card is not charged until the host confirms, and if the stay cannot be confirmed nothing is taken.

If you complete a confirmed booking, the reservation itself is handled in our booking system (see who we share with) and through the channel you booked on.

Availability lookups

Searching for available dates sends only the dates, the property and the number of guests. It carries no information about you.

Technical data

Like every website, ours is served by a hosting provider that automatically logs the IP address, browser user agent, requested URL, referring page and timestamp of each request. These logs exist for security, abuse prevention and diagnostics. Our contact, availability and checkout endpoints also apply a short-lived, in-memory rate limit keyed on IP address, so that they cannot be used to send bulk mail or spam requests.

Legal basis for processing

• To answer your enquiry and prepare or perform a booking — Article 6(1)(b) GDPR (steps at your request prior to a contract, and performance of that contract).
• To keep the site secure and working, including server logs and rate limiting — Article 6(1)(f) GDPR (our legitimate interest in protecting the service against abuse). You may object to this at any time; see your rights.
• To show the map of where we are, which makes your browser fetch tiles from OpenStreetMap and so discloses your IP address to them — Article 6(1)(f) GDPR (our legitimate interest in showing visitors the location). No cookie or other storage is involved, and the map is loaded only once you scroll it into view, so a visitor who never reaches it never contacts OpenStreetMap.
• To measure how the site is used — Article 6(1)(a) GDPR and section 3-15 of the Electronic Communications Act (your consent), given through the cookie banner and withdrawable at any time with the same single click.
• To meet legal obligations, such as bookkeeping and accounting duties for a completed booking — Article 6(1)(c) GDPR.

Providing your data is voluntary, but we cannot answer an enquiry or arrange a stay without at least a name and a way to reply.

Cookies and local storage

A cookie is a small file a site stores in your browser; local storage is a similar mechanism that, unlike a cookie, is never sent to a server. This site is deliberately light on both.

Storing anything on your device, or reading anything from it, requires your consent under section 3-15 of the Norwegian Electronic Communications Act (ekomloven) and Article 6(1)(a) GDPR — unless it is strictly necessary to deliver the page you asked for. We ask for that consent in the banner, before anything non-essential is stored. Ignoring the banner counts as a refusal: nothing is loaded until you actively accept.

Stored without consent (strictly necessary)

That is the complete list of what is stored without your consent. Both entries hold a preference you expressed yourself, are never sent to our server, and identify nothing about you. No cookie at all is set on this site until you accept analytics in the banner. There are no advertising cookies, no tracking pixels and no cross-site profiling, whatever you answer.

Stored only after you accept analytics

Google Tag Manager stores nothing on your device by itself; it is a container that loads the measurement tag above. If we ever add a tag for a further purpose — advertising, for instance — that is outside both consents on this page, and we will ask you again before it runs.

Loaded only after you accept personalization

Ticking the personalization checkbox in the banner and accepting loads Google's "Preferred Sources" button script directly from news.google.com into the footer of every page. That script renders the button inside a frame served from Google's own domain, so — unlike the entries above — we cannot see or list the specific cookies or storage it sets there: what happens inside that frame is between your browser and Google, governed by Google's own privacy policy, not ours. What we can promise is when it runs: not requested at all unless you tick the box and accept; nothing loads if you leave it unticked or decline.

Changing your mind

Withdrawing consent is as easy as giving it, takes the same single click, and is always possible, for either category:

Withdrawal takes effect immediately: whichever category you withdrew is switched back to denied and the page reloads without the corresponding script. Withdrawing analytics additionally deletes the _ga cookies listed above from your browser. Withdrawing personalization removes the Preferred Sources button from the footer; we cannot delete anything Google's frame itself stored, since that lives on Google's own domain, outside our reach. Neither undoes processing that already happened before you withdrew, which remains lawful under Article 7(3) GDPR — to have that data erased as well, use the erasure right below.

We do not treat a consent as valid forever. Your answer is remembered for 12 months, after which the banner asks again. This applies to a refusal too, but a refusal is never re-asked during the same year and is never overridden — declining leaves you with nothing but the strictly necessary preference above.

You can also block or delete cookies and site data in your browser settings at any time. Blocking strictly necessary storage means the cookie banner will reappear on every visit, but the rest of the site continues to work.

Analytics and measurement

This site uses Google Analytics 4 and Google Tag Manager, both provided by Google Ireland Limited, to understand how it is used — but they load only after you have accepted analytics in the cookie banner. Declining, or simply not answering, means neither script is loaded and no analytics cookies are set. Tag Manager is a container that loads our measurement tags; it stores nothing on your device by itself, and any tag inside it is subject to the same consent.

Once you have consented, Google Analytics may process:

• Pages you view, the order you view them in and how long you stay
• Approximate location derived from your IP address (country or region level — Google Analytics 4 does not log or store the IP address itself)
• Device type, screen size, browser and operating system
• The site or search engine that referred you
• Randomly generated identifiers stored in cookies (typically _ga and _ga_<id>, up to 2 years) used to recognise a returning browser

We use this to understand which pages are useful and where visitors give up — never to identify you personally, and we do not combine it with your enquiry data. Google Signals, advertising features and data sharing with other Google products are not enabled.

Google Consent Mode is set to denied for analytics, advertising, personalisation and functionality storage for every visitor before any answer is given, and the advertising signals stay denied even after you accept — you are asked about measurement, so measurement is the only thing we switch on. Google Analytics data is processed by Google Ireland Limited and may be transferred to Google LLC in the United States; see transfers outside the EEA.

Your answer, the date you gave it and the version of the banner text you saw are recorded in your own browser (the arsh-consent entry above). That record is what we rely on to demonstrate consent under Article 7(1) GDPR: the scripts it controls run in your browser, so the same browser holds both the proof and the switch. We receive no copy of it, which also means we cannot look up or restore an answer for you — clearing your browser storage clears the consent, and the banner asks again.

You can additionally opt out of Google Analytics in every browser with Google's own browser add-on.

Personalization (Google Preferred Sources)

The footer on every page can show a small "Add as preferred source" button, provided by Google, that lets a visitor tell Google Search they want to see more from this site. It is off by default and loads only if you tick the personalization checkbox in the cookie banner and accept — declining, or accepting without ticking the box, means the button's script never loads and nothing appears in the footer. This is a separate, independent choice from the analytics category above: accepting one does not accept the other, and "personalisation storage" in the Consent Mode signals above refers to Google's own advertising-personalisation flag, which stays denied regardless of what you choose here — it is unrelated to this button.

Once loaded, the button is rendered inside a frame served directly from news.google.com — the same script family Google uses for other reader and subscription tools. We do not control, and cannot see, what that frame stores in your browser once it is running; that is governed by Google's own privacy policy, not ours. What we do control, and promise: the script is not requested until you opt in, and withdrawing consent (see Changing your mind) stops it loading again and reloads the page without it.

Who we share your data with

We do not sell your personal data and we do not share it for advertising. It is disclosed only to the service providers we need in order to run the site and the accommodation, each acting as our data processor under a data processing agreement, and to public authorities where the law requires it.

Fonts and map software are served from our own domain, not from a third-party CDN, so no request leaves our server for them. Links to Google Maps and to Booking.com are ordinary outbound links — following one takes you to that company's site, where its own privacy policy applies.

Transfers outside the EEA

Some of the providers above are established in, or transfer data to, the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–U.S. Data Privacy Framework, together with supplementary technical measures such as encryption in transit. You may request a copy of the relevant safeguards from the address in Contact us.

How long we keep your data

• Enquiries that do not lead to a booking — kept in the host's inbox for up to 12 months, then deleted.
• Confirmed bookings — kept for the duration of your stay and afterwards for as long as accounting law requires (5 years after the end of the financial year, Norwegian Bookkeeping Act).
• Server logs — retained by our hosting provider for a limited period, typically no more than 30 days.
• Your cookie choice — stored in your own browser until you clear it or change your answer; we never receive a copy.

How we protect your data

The whole site is served over HTTPS with HSTS. A strict Content Security Policy prevents third-party scripts from running, so nothing can silently begin collecting data on these pages. Form submissions are validated and rate limited, and messages are sent as plain text. Access keys for our providers are held only in the hosting platform's encrypted environment configuration and are never present in anything your browser downloads.

No transmission over the internet can be guaranteed completely secure, but if a breach affecting your rights occurs we will notify the Norwegian Data Protection Authority, and you, as required by Articles 33 and 34 GDPR.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy (Article 15)
• Rectify data that is inaccurate or incomplete (Article 16)
• Erasure of your data where we no longer have a valid reason to keep it (Article 17)
• Restrict processing while a dispute about accuracy or legitimate interest is resolved (Article 18)
• Data portability — receive the data you gave us in a structured, machine-readable format (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)) — see Cookies and local storage

To exercise any of these, email searest.averoy@gmail.com. We answer without undue delay and within one month. There is no charge, and we may ask you to confirm your identity before releasing data.

If you believe we are handling your data unlawfully you may complain to the Norwegian Data Protection Authority, Datatilsynet (Postboks 458 Sentrum, 0105 Oslo, postkasse@datatilsynet.no), or to the supervisory authority in your own EU or EEA country.

Children

This site is aimed at adults booking accommodation and is not directed at children. We do not knowingly collect personal data from children under 13. Children are of course welcome as guests; their details reach us only through the booking adult.

Changes to this policy

We update this policy when what we do with data changes — for example when analytics is switched on, or a provider is replaced. The date at the top of the page always shows the current version. Where a change materially affects consent, the cookie banner is shown again so you can make a fresh choice.

Contact us

Questions about this policy, or about your data:

You can also use the contact form, or read our questions and answers for anything about the stay itself.