Privacy & Cookie Policy

Who is responsible for your data

The data controller for personal data collected through this website is:

L.K. Holding AS operates the accommodation and boat rental marketed on this site under the name Atlantic Road Seaside Housing. We are not required to appoint a Data Protection Officer; enquiries about privacy go to the address above and are handled by the host, Karl Abel Sandvik Karlsen.

What personal data we collect

We collect only what you give us and what a web server unavoidably records. There is no account, no login, and no profile built about you.

Contact form

When you send a message from the contact page we receive your first name, last name, email address, optional phone number and the content of your message. This is emailed to the host and is not stored in a database on our side.

Booking and rental enquiries

When you request a stay from the booking page, or enquire about a boat, your enquiry is sent to the host by email and includes the dates, the home or boat you selected, the number of guests and whatever contact details and message you provide. Depending on how the enquiry is sent, it goes through our booking or contact endpoint, or opens a pre-filled message in your own email program — in the latter case nothing reaches us until you press send.

When live prices are shown, requesting to book takes you to the secure payment page of our payment processor, Stripe. Your card details are entered there, on Stripe's own site, and are never received, seen or stored by us — we receive only confirmation of the reservation, the amount, and the booking details we passed along. Your card is reserved when you send the request and charged only once the host confirms the booking; if it cannot be confirmed, the reservation on your card is released.

If you complete a confirmed booking, the reservation itself is handled in our booking system (see who we share with) and through the channel you booked on.

Availability lookups

Searching for available dates sends only the dates, the property and the number of guests. It carries no information about you.

Technical data

Like every website, ours is served by a hosting provider that automatically logs the IP address, browser user agent, requested URL, referring page and timestamp of each request. These logs exist for security, abuse prevention and diagnostics. Our contact, availability and checkout endpoints also apply a short-lived, in-memory rate limit keyed on IP address, so that they cannot be used to send bulk mail or spam requests.

Legal basis for processing

• To answer your enquiry and prepare or perform a booking — Article 6(1)(b) GDPR (steps at your request prior to a contract, and performance of that contract).
• To keep the site secure and working, including server logs and rate limiting — Article 6(1)(f) GDPR (our legitimate interest in protecting the service against abuse). You may object to this at any time; see your rights.
• To measure how the site is used — Article 6(1)(a) GDPR (your consent), given through the cookie banner and withdrawable at any time.
• To meet legal obligations, such as bookkeeping and accounting duties for a completed booking — Article 6(1)(c) GDPR.

Providing your data is voluntary, but we cannot answer an enquiry or arrange a stay without at least a name and a way to reply.

Cookies and local storage

A cookie is a small file a site stores in your browser; local storage is a similar mechanism that, unlike a cookie, is never sent to a server. This site is deliberately light on both.

What is stored today

That is the complete list. At the time of writing this site sets no advertising cookies, no tracking cookies and no third-party cookies of any kind, and it loads no analytics script. Because storing a strictly necessary preference does not require consent, nothing on this site currently depends on your answer to the banner — the banner and this policy are in place so that the moment measurement is switched on, it can only run for visitors who have opted in.

Changing your mind

Withdrawing consent is as easy as giving it, and is always possible:

You can also block or delete cookies and site data in your browser settings at any time. Blocking strictly necessary storage means the cookie banner will reappear on every visit, but the rest of the site continues to work.

Analytics and measurement

No analytics service is active on this site at present. We are describing it here in advance so that the terms are clear before anything is enabled, and so you can make an informed choice in the banner.

If and when we enable measurement, it will be Google Analytics 4, provided by Google Ireland Limited, and it will load only after you have accepted it in the cookie banner. Declining, or simply not answering, means the script is never loaded and no analytics cookies are set.

Where Google Analytics is enabled and you have consented, it may process:

• Pages you view, the order you view them in and how long you stay
• Approximate location derived from your IP address (country or region level — Google Analytics 4 does not log or store the IP address itself)
• Device type, screen size, browser and operating system
• The site or search engine that referred you
• Randomly generated identifiers stored in cookies (typically _ga and _ga_<id>, up to 2 years) used to recognise a returning browser

We use this to understand which pages are useful and where visitors give up — never to identify you personally, and we do not combine it with your enquiry data. Google Signals, advertising features and data sharing with other Google products are not enabled. Where consent is refused, Google Consent Mode is set to denied for both analytics and advertising storage.

You can additionally opt out of Google Analytics in every browser with Google's own browser add-on.

Who we share your data with

We do not sell your personal data and we do not share it for advertising. It is disclosed only to the service providers we need in order to run the site and the accommodation, each acting as our data processor under a data processing agreement, and to public authorities where the law requires it.

Fonts and map software are served from our own domain, not from a third-party CDN, so no request leaves our server for them. Links to Google Maps and to Booking.com are ordinary outbound links — following one takes you to that company's site, where its own privacy policy applies.

Transfers outside the EEA

Some of the providers above are established in, or transfer data to, the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU–U.S. Data Privacy Framework, together with supplementary technical measures such as encryption in transit. You may request a copy of the relevant safeguards from the address in Contact us.

How long we keep your data

• Enquiries that do not lead to a booking — kept in the host's inbox for up to 12 months, then deleted.
• Confirmed bookings — kept for the duration of your stay and afterwards for as long as accounting law requires (5 years after the end of the financial year, Norwegian Bookkeeping Act).
• Server logs — retained by our hosting provider for a limited period, typically no more than 30 days.
• Your cookie choice — stored in your own browser until you clear it or change your answer; we never receive a copy.

How we protect your data

The whole site is served over HTTPS with HSTS. A strict Content Security Policy prevents third-party scripts from running, so nothing can silently begin collecting data on these pages. Form submissions are validated and rate limited, and messages are sent as plain text. Access keys for our providers are held only in the hosting platform's encrypted environment configuration and are never present in anything your browser downloads.

No transmission over the internet can be guaranteed completely secure, but if a breach affecting your rights occurs we will notify the Norwegian Data Protection Authority, and you, as required by Articles 33 and 34 GDPR.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy (Article 15)
• Rectify data that is inaccurate or incomplete (Article 16)
• Erasure of your data where we no longer have a valid reason to keep it (Article 17)
• Restrict processing while a dispute about accuracy or legitimate interest is resolved (Article 18)
• Data portability — receive the data you gave us in a structured, machine-readable format (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)) — see Cookies and local storage

To exercise any of these, email searest.averoy@gmail.com. We answer without undue delay and within one month. There is no charge, and we may ask you to confirm your identity before releasing data.

If you believe we are handling your data unlawfully you may complain to the Norwegian Data Protection Authority, Datatilsynet (Postboks 458 Sentrum, 0105 Oslo, postkasse@datatilsynet.no), or to the supervisory authority in your own EU or EEA country.

Children

This site is aimed at adults booking accommodation and is not directed at children. We do not knowingly collect personal data from children under 13. Children are of course welcome as guests; their details reach us only through the booking adult.

Changes to this policy

We update this policy when what we do with data changes — for example when analytics is switched on, or a provider is replaced. The date at the top of the page always shows the current version. Where a change materially affects consent, the cookie banner is shown again so you can make a fresh choice.

Contact us

Questions about this policy, or about your data:

You can also use the contact form, or read our questions and answers for anything about the stay itself.