Privacy Policy

Last updated:

This Privacy Policy explains how personal data is handled on the information website of Kumlegard Ryfylke Resort & Casino, a planned hotel, casino and spa resort in Ryfylke, Norway. The resort is a project in development: nothing has been built yet and no bookings are taken. The website is deliberately simple. It uses no analytics, no advertising tags, no tracking pixels and no cookies, and it loads nothing from third-party servers.

1. Who is responsible for your data

The controller responsible for personal data processed through this website is:

Pavlo Zhelezniak
23 Valeriia Lobanovskoho Avenue, Kyiv 02000, Ukraine
Email: [email protected]

In this policy, “we” and “us” refer to the controller named above. We have not appointed a data protection officer, as we are not required to. All questions about privacy can be sent to the address above.

2. What this policy covers

This policy covers visits to this website, the interest list and emails you send to us. It does not cover the future operation of the resort. When reservations open, guests will receive a separate privacy notice that explains how booking and stay information is handled.

3. What we collect and why

3.1 The interest list

The form on the contact page does not send anything to a server. When you press the button, your own email app opens with a message addressed to [email protected], filled in with what you typed. We receive personal data only if you choose to send that email. In that case we receive:

  • your name and email address;
  • the part of the resort you are interested in, as selected in the form;
  • your confirmation that you agree to this Privacy Policy;
  • the usual content and technical details of an email, such as the time it was sent and anything you add to the message.

We use this information to keep you informed about the project and to tell you when reservations open. We do not use it for anything else.

3.2 Emails you send us

If you write to any of our addresses (info, events, privacy or legal), we use your name, email address and the content of your message to reply and to deal with your question.

3.3 Technical logs

When you visit the website, the hosting server automatically records basic technical information: your IP address, the date and time of the request, the page requested, the browser and operating system reported by your device, the referring page and whether the request succeeded. This is needed to deliver the website, keep it secure and find faults. We do not use these logs to profile visitors, and we do not combine them with the interest list.

3.4 What we do not collect

The website sets no cookies and runs no analytics, advertising, social media plugins, session recording or fingerprinting. Fonts and images are served from this website itself, so your visit is not reported to font services or image networks. Our Cookie Policy describes the single setting the website can store in your browser.

  • Interest list: your consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR). Because the list is used to send you news about the project by email, your prior consent is also required under section 15 of the Norwegian Marketing Control Act (markedsføringsloven). You give that consent by sending the interest list email.
  • Replying to your emails: our legitimate interest in answering people who contact us (Article 6(1)(f) GDPR), or steps taken at your request (Article 6(1)(b)).
  • Technical logs: our legitimate interest in running a secure and working website (Article 6(1)(f)).
  • Legal obligations: where the law requires us to keep or disclose information (Article 6(1)(c)).

5. Information about dietary needs

The website mentions that we will ask about dietary needs before guests arrive. That will happen only once bookings exist, and it will be covered by a separate privacy notice. At present, the website does not collect any information about dietary needs, allergies or health, and the interest list form has no field for it. Please do not send this kind of information through the form or by email. If you do, we will delete it and will not use it.

6. How long we keep your data

  • Interest list: until you withdraw your consent, or until the list is no longer needed. At the latest, the list will be deleted 12 months after the resort opens or after the project is stopped, whichever comes first.
  • Emails: as long as needed to deal with the matter, and normally no longer than 24 months after our last exchange, unless the law requires us to keep them for longer.
  • Technical logs: for a short period set by the hosting provider, normally no more than 30 days, unless a log is needed to investigate a specific security incident.

7. Leaving the interest list

You can withdraw your consent at any time by writing to [email protected] from the address on the list, or by replying to any message from us and asking to be removed. Requests are handled by a person, not automatically. We aim to act on them promptly and in any case within one month. Withdrawing your consent does not affect the lawfulness of anything we did before you withdrew it.

8. Who receives your data

We do not pass your data to anyone for their own marketing. We share it only where this is needed to run the website and the interest list:

  • our email provider, which hosts our mailboxes and, if used, the service that sends news to the interest list;
  • our hosting provider, which stores the website and its technical logs;
  • professional advisers, such as lawyers or accountants, who are bound by confidentiality, where their help is needed;
  • public authorities or courts, where we are required by law to disclose information.

Our service providers act on our instructions under data processing agreements and may not use your data for their own purposes.

9. International transfers

The controller is established outside the European Economic Area (EEA). The European Commission has not adopted an adequacy decision for that country. When personal data is transferred to us, or to a service provider in a country without an adequacy decision, the transfer is protected by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), together with additional safeguards where needed. You can ask for a copy of the relevant safeguards by writing to [email protected].

10. Your rights

Under Articles 15 to 22 GDPR you have the right to:

  • access the personal data we hold about you and receive a copy (Article 15);
  • have inaccurate data corrected (Article 16);
  • have your data erased (Article 17);
  • have the processing restricted (Article 18), and be told who we have informed of a correction, erasure or restriction (Article 19);
  • receive the data you gave us in a structured, commonly used format and have it passed to someone else (Article 20);
  • object to processing based on our legitimate interests (Article 21);
  • not be subject to decisions based solely on automated processing (Article 22). We make no such decisions and do no profiling.

To use any of these rights, write to [email protected]. We will reply within one month. In complex cases this can be extended by two further months, and we will tell you if that happens. We may ask you to confirm your identity before acting on a request.

11. Complaints

If you think we have handled your data wrongly, you can complain to a supervisory authority:

  • in Norway, the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no;
  • the supervisory authority of the EEA country where you live or work, or where you believe the problem occurred;
  • in Ukraine, the Ukrainian Parliament Commissioner for Human Rights, who supervises the protection of personal data, ombudsman.gov.ua.

We would be grateful for the chance to put things right first, so please consider writing to us before you complain.

12. Age

This website is not intended for anyone under 18, and the interest list is open to adults only. If we learn that someone under 18 has joined the list, we will delete their details.

13. Security

The website is served over an encrypted connection and does not store form data on the web server. A strict content security policy prevents third-party scripts from running on its pages. Access to the mailboxes and to the interest list is limited to the people who need it.

14. Changes to this policy

We will update this policy when the website or the way we handle data changes, and we will change the date at the top of the page. If a change affects the interest list significantly, we will tell people on the list by email.

15. Contact

For anything to do with privacy, write to [email protected]. For other legal questions, write to [email protected].