Privacy Policy

JVB Travel AS

Applies to www.jotunheimentravel.com and www.fjordmountainroute.com

Last updated: 11 June 2026

1. Who we are

JVB Travel AS, organisation number 921 093 527 MVA, is the controller for the processing of personal data described in this Privacy Policy.

JVB Travel AS operates several travel brands and sales channels. This Privacy Policy applies to the websites www.jotunheimentravel.com and www.fjordmountainroute.com, including subpages, forms and booking flows connected to these websites.

Jotunheimen Travel and Fjord Mountain Route are brands and sales channels used by JVB Travel AS.

Contact details

JVB Travel AS
Jernbanevegen 7
2900 Fagernes
Norway
Phone: +47 91 11 11 30
E-mail: [email protected]

For questions about privacy, access to your data, correction, deletion or other data protection matters, please contact us at [email protected].

2. Purpose of this Privacy Policy

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we may share it with, how long we keep it, and what rights you have under applicable data protection legislation, including the General Data Protection Regulation (GDPR) and Norwegian data protection law.

We process personal data only when we have a lawful basis for doing so. The most relevant legal bases for our processing are performance of a contract, pre-contractual steps, legal obligations, consent and legitimate interests.

3. Personal data we collect

The personal data we collect depends on how you use our websites and services. We may process the following categories of personal data:

Contact details, such as name, address, e-mail address, telephone number, country and language preferences.

Booking and travel information, such as chosen tour, travel dates, number of travellers, accommodation preferences, activity level, transport needs, luggage transport, rental equipment, add-ons and other information needed to deliver the booked service.

Payment and transaction information, such as booking amount, payment status, invoice information and necessary payment references. We do not normally store full payment card details ourselves.

Communication with us, such as e-mails, form submissions, requests, feedback, complaints and customer service history.

Marketing preferences, such as newsletter subscription, consent status, unsubscribe information and interest categories where relevant.

Website and technical information, such as IP address, browser type, device information, operating system, pages visited, time of visit, referrer information, cookie identifiers and analytics information.

Competition, survey and campaign information, if you choose to participate in such activities.

Information you voluntarily provide, such as dietary requirements, allergies, accessibility needs or other details relevant to your trip.

4. Special categories of personal data

Some information you provide to us may be sensitive or may reveal special categories of personal data under GDPR, for example health-related information, allergies, accessibility needs or religious dietary requirements.

We only ask for such information when it is relevant for the service you request or book. We use this information only to prepare and deliver the travel service, for example to inform accommodation providers, guides or activity providers about allergies, dietary requirements or accessibility needs. Where required, we rely on your explicit consent. You may withdraw your consent at any time, but this may affect our ability to deliver parts of the service safely or correctly.

5. Website visits, security and server logs

When you visit our websites, technical information may be collected automatically. This may include the page visited, date and time of access, amount of data transferred, browser type and version, operating system, referring page and IP address.

We use this information to operate the websites, maintain security, detect and prevent misuse, improve functionality and document potential cyber-attacks or technical incidents.

The legal basis is our legitimate interest in providing secure, stable and user-friendly websites. Server logs are normally deleted or anonymised when they are no longer needed for these purposes, unless we are legally required or have a legitimate reason to keep them longer, for example in connection with a security incident.

Our websites use encryption where appropriate. You can normally recognise encrypted connections by “https://” in the address bar. Please note that communication over the internet, including e-mail, can never be guaranteed to be completely secure.

6. Contact forms and enquiries

When you contact us through a form, by e-mail, by phone or through another channel, we process the information needed to respond to your request and follow up any related questions. This may include your name, e-mail address, telephone number, country and the content of your enquiry.

If your enquiry concerns a possible booking, we may also process information about travel dates, number of travellers, preferred tour, accommodation, activities, transport and other details you provide.

The legal basis is usually to take steps at your request before entering into a contract, or our legitimate interest in answering enquiries and providing customer service. If the enquiry results in a booking, relevant information may become part of the booking record.

7. Bookings and travel services

When you book a trip or service with us, we process the personal data necessary to administer and deliver the booking. This includes booking administration, customer service, payments, travel documents, accommodation, transport, luggage transport, rental equipment, activities, guide services and any other services included in or connected to your booking.

The legal basis is primarily performance of a contract with you or taking steps before entering into a contract. We may also process certain information to comply with legal obligations, for example accounting and tax rules, or based on legitimate interests, for example handling complaints or documenting customer communication.

Booking systems

We use external booking systems to administer bookings and related customer information. These systems process personal data on our behalf or as otherwise agreed with us.

CityBreak booking system from Visit Group.

Bilberry booking system from Bilberry Technology.

The information processed in these systems may include contact details, booking details, travel dates, payment status, customer communication, participant information and other data necessary to deliver the booked travel service.

Sharing data with suppliers

To deliver your booking, we may share necessary personal data with relevant suppliers and partners, such as accommodation providers, transport companies, guides, activity providers, luggage transport providers, rental providers, payment providers and IT suppliers.

We share only the information that is necessary for the supplier to provide the relevant service. Examples include name, travel dates, number of travellers, dietary requirements, luggage information, accommodation needs, rental equipment details and emergency-relevant information where appropriate.

We do not sell personal data to third parties.

8. Payments and accounting

When you pay for a booking, payment information is processed by our payment service provider and/or booking system. We normally receive payment status, payment reference and other information necessary to confirm and administer the booking. We do not normally store full card details ourselves.

We process invoice and transaction information to comply with accounting, tax and legal obligations. Such information is stored for the period required by applicable bookkeeping rules.

9. Newsletter

If you subscribe to our newsletter, we process your e-mail address and, where provided, your name, language preference and areas of interest. The purpose is to send you news, offers, inspiration and information about our travel products.

The legal basis is your consent. You can unsubscribe at any time by using the unsubscribe link in the newsletter or by contacting us at [email protected].

To document consent, we may store information about when and how you subscribed, including date, time, IP address and consent source. We may also use standard newsletter statistics such as opens and link clicks to improve our content, where this is permitted and in accordance with your choices and applicable rules.

10. Direct marketing to existing customers

In some cases, we may send relevant information about similar products or services to existing customers, where this is permitted by applicable marketing rules. You can opt out of such communication at any time.

The legal basis for the processing of personal data for this purpose may be our legitimate interest in informing customers about relevant services, provided that your rights and interests do not override this interest. Where consent is required, we will ask for consent before sending marketing communication.

11. Competitions, prize draws and campaigns

If you participate in a competition, prize draw or campaign, we process the personal data needed to administer the activity, contact participants, select winners and deliver prizes. This may include name, e-mail address, telephone number, address, country and other information requested in the campaign.

The legal basis may be performance of an agreement with you, legitimate interests or consent, depending on the activity. If we wish to use photos, names or testimonials for marketing purposes, we will provide specific information and, where required, ask for consent.

Information from competitions and campaigns is deleted or anonymised when it is no longer needed for the relevant purpose, unless we are required or have a legitimate reason to keep it longer, for example to document the campaign or handle potential claims.

12. Surveys and feedback

We may invite customers or website users to participate in surveys or provide feedback. Participation is voluntary. We use survey and feedback information to improve our products, websites, customer service and guest experience.

Where possible, we use anonymous or aggregated information. If the survey or feedback contains personal data, the legal basis is normally consent or our legitimate interest in improving our services and following up customer feedback.

13. Cookies and similar technologies

Our websites use cookies and similar technologies. Cookies are small files stored on your device. They may be used to make the website work, remember preferences, analyse website use, improve services and, where you consent, support marketing and advertising.

Strictly necessary cookies are used to provide basic website functions and security. Analytics, marketing and advertising cookies are used only where we have a valid legal basis, normally your consent through the cookie banner or cookie settings.

You can change or withdraw your cookie consent at any time through the cookie settings on the website, where available, or by changing your browser settings. If you block cookies, some parts of the website may not function correctly.

The exact cookies and similar technologies used may change over time. The active cookie banner or cookie settings on the website should provide an up-to-date overview of cookies, providers, purposes, categories and storage periods. We recommend keeping this overview updated whenever tools are added, removed or changed.

14. Analytics and advertising tools

We may use analytics and advertising tools to understand how our websites are used, improve our services and measure the effect of marketing activities. These tools may use cookies, pixels or similar technologies, depending on your cookie choices and the settings on the website.

Google Analytics and Google advertising services

We may use Google Analytics and other Google services to analyse website traffic, measure conversions and improve our marketing. Google may process information such as device identifiers, IP address, website behaviour and cookie identifiers. Where required, these tools are used only with your consent.

Google may process data outside Norway and the EEA. Where such transfers take place, they must be based on a valid transfer mechanism under GDPR, such as an adequacy decision, standard contractual clauses or other applicable safeguards.

Meta: Facebook and Instagram

We may use tools from Meta Platforms, including Facebook and Instagram, for social media marketing, campaign measurement, remarketing and communication with users who interact with us on these platforms.

If Meta tools such as pixels, conversion APIs or custom audiences are used on our websites, this may involve processing information about your visit, device, browser and interactions with our websites. Such tools are used in accordance with your cookie choices and applicable law.

When you visit or interact with our Facebook or Instagram pages, Meta may also process personal data as an independent controller under its own privacy terms.

TikTok

We may use TikTok tools for advertising, campaign measurement and social media communication. If TikTok tracking or advertising tools are used on our websites, this may involve cookies, pixels or similar technologies, depending on your consent and the website settings.

When you interact with our TikTok content or profile, TikTok may process personal data under its own privacy terms.

15. Social media and external platforms

We use social media and external platforms to communicate with customers, partners and followers. When you contact us through such platforms or interact with our content, we may receive information such as your name, profile, message content, comments and other information you choose to share.

The platform provider may also process personal data for its own purposes. We encourage you to read the privacy information provided by the relevant platform.

16. Website search

If our websites include a search function, search terms may be collected and used to improve website content and the search function. Where possible, such data is processed in anonymous or aggregated form. We do not use website search terms to identify individual users unless this is necessary for security, troubleshooting or another lawful purpose.

17. External links and embedded content

Our websites may contain links to external websites, booking pages, maps, videos, social media content or other embedded content. If you follow a link to a website operated by another organisation, that organisation is responsible for its own processing of personal data.

Embedded content from external providers may function as if you visited the external provider’s website directly. Such providers may collect data, use cookies or track your interaction with the embedded content, depending on your settings and the provider’s terms.

18. Data processors and service providers

We use service providers to operate our websites, booking systems, IT systems, e-mail, marketing tools, analytics, payment services and other business functions. Where a supplier processes personal data on our behalf, we require a data processing agreement in accordance with GDPR.

Important categories of service providers include:

Website operation, hosting and maintenance providers.

Booking systems, including CityBreak from Visit Group and Bilberry from Bilberry Technology.

Payment and invoicing service providers.

E-mail, newsletter and customer communication systems.

Analytics and advertising providers, such as Google, Meta and TikTok, where used.

Travel suppliers and partners needed to deliver booked services.

19. International transfers

Some of our suppliers or digital tools may process personal data outside Norway or the European Economic Area (EEA). Where this happens, we will take steps to ensure that the transfer has a valid legal basis under GDPR. This may include an adequacy decision, standard contractual clauses or other appropriate safeguards.

The exact transfer situation may depend on the tools and providers used at any given time. We aim to keep our supplier and cookie information updated when services change.

20. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

Enquiries: normally kept for up to 12 months after the enquiry has been answered, unless the enquiry becomes part of a booking or we have another legitimate reason to keep it longer.

Booking and customer information: kept for as long as necessary to deliver the trip, provide customer service, handle changes, complaints and claims, and document the customer relationship.

Accounting and transaction information: kept for the period required by applicable bookkeeping and tax rules.

Newsletter information: kept until you unsubscribe or withdraw your consent, unless we need to keep limited information to document previous consent or prevent further sending.

Competition and campaign information: kept for as long as needed to administer the activity and handle any follow-up, complaints or legal obligations.

Cookie and analytics data: kept according to the settings and retention periods of the relevant tool and your cookie choices.

When personal data is no longer needed, we will delete, anonymise or securely archive it in accordance with applicable rules.

21. Your rights

Subject to the conditions and limitations in applicable law, you have the following rights:

Right of access: you may ask for confirmation of whether we process personal data about you and request a copy of the data.

Right to rectification: you may ask us to correct inaccurate or incomplete personal data.

Right to erasure: you may ask us to delete personal data where the legal conditions for deletion are met.

Right to restriction: you may ask us to restrict the processing of your personal data in certain situations.

Right to object: you may object to processing based on legitimate interests, including certain direct marketing activities.

Right to data portability: where applicable, you may ask to receive personal data you have provided to us in a structured, commonly used and machine-readable format.

Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before consent was withdrawn.

Right to complain: you may complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe that our processing of personal data is unlawful.

To exercise your rights, please contact us at [email protected]. We may need to verify your identity before responding to certain requests.

22. Changes to this Privacy Policy

We may update this Privacy Policy when our services, websites, suppliers or legal obligations change. The latest version will be published on our websites. We recommend that you review the Privacy Policy from time to time.

23. Contact

JVB Travel AS
Organisation number: 945 968 915 MVA
Jernbanevegen 7
2900 Fagernes
Norway
Phone: +47 91 11 11 30
E-mail: [email protected]