1. Data controller

BILTUR DA is the data controller for personal data processed through Hjemferd.no.

Organisation number

926 953 796

Address

Nøstegaten 50B, 5011 Bergen, Norway

Email

[email protected]

Website

Hjemferd.no

If you have questions about privacy or want to exercise your rights, contact us using the email address above.

2. Personal data we process

The information we process depends on how you use Hjemferd. It may include:

• Account information: name, email address, mobile number, address, postal code/city, date of birth and account status.
• Sign-in and security: protected password information, verification codes, session information and technical security data.
• Provider information: provider type, company name, organisation number and default delivery location where provided.
• Listings and transport assignments: pickup and delivery locations, dates, vehicle information, costs, comments and other listing information.
• Booking information: cars you have requested or booked, booking status and information needed to follow up the transport assignment.
• Notification preferences: criteria and preferences you choose for alerts about new cars and assignments.
• Payment and subscription: subscription status, payment references and necessary transaction data when paid services are used. Hjemferd does not store full card or bank details.
• Communication: messages sent through the contact form, email or other contact with us.
• Technical information: IP address, timestamps, browser/device information and server logs where required for operations, security and troubleshooting.

3. Where the information comes from

Most information is provided directly by you when you register an account, edit your profile, create listings, send booking requests, choose notifications or contact us.

When a company registers as a provider, we may verify the company name and organisation number against the public Norwegian Register of Business Enterprises / Central Coordinating Register to confirm that the details belong together and refer to a registered organisation.

If you choose Vipps MobilePay for sign-in or payment, we may receive information you have approved for sharing with Hjemferd, such as name, email, phone number, address, date of birth, a technical user identifier and payment/subscription status.

4. Why we process personal data

We process personal data to:

• create, manage and secure your user account
• facilitate listings, bookings and contact between parties to a transport assignment
• verify company providers and reduce misuse and false information
• provide notifications and other functions you request
• manage subscriptions, payments and customer service
• send necessary operational, booking and service messages
• prevent misuse, investigate errors and maintain service security
• meet legal obligations, including documentation related to payments and accounting where applicable

5. Legal basis

We rely on different legal bases depending on the purpose:

• Contract (GDPR Article 6(1)(b)): when processing is necessary to create an account, provide the Hjemferd service, perform booking functions or provide a subscription you ordered.
• Legal obligation (Article 6(1)(c)): when information must be processed or retained to meet legal requirements.
• Legitimate interests (Article 6(1)(f)): when necessary for security, misuse prevention, troubleshooting, documentation and responsible operation, provided your interests do not override ours.
• Consent (Article 6(1)(a)): when we specifically ask for consent to processing that requires it. Consent can be withdrawn.

6. Sharing information

We do not sell personal data. Information is shared only when necessary to provide the service, when you request it, or when we are legally required to do so.

Recipients or categories of recipients may include:

• the other party to a transport assignment, where necessary to follow up a booking and carry out the transport
• hosting and operational providers processing data on our behalf to keep the service available and secure
• Google services, including Google Workspace for email and Google reCAPTCHA to protect the contact form from misuse
• Vipps MobilePay when you use Vipps for sign-in, payment or subscriptions
• Brønnøysund Registers when checking public company information for business verification
• public authorities where disclosure is required by law

Providers processing personal data on our behalf may only use it in accordance with our instructions and applicable privacy law.

7. Transfers outside the EU/EEA

Some technology providers may process personal data outside the EU/EEA. Where such a transfer occurs, it must have a valid transfer mechanism under privacy law, for example an adequacy decision or the EU Standard Contractual Clauses.

8. Retention and deletion

We retain personal data for as long as it is needed for the purpose for which it was collected and while we have a lawful basis for processing.

• Account and profile data is normally retained while the account is active.
• Listing, booking and communication history may be retained as needed for the service, documentation, security and handling possible disputes or claims.
• Information that must be retained under accounting, tax or other legislation is deleted only after the statutory retention period has expired.
• Technical logs and security data are not retained longer than needed for operations, security and troubleshooting.

When the data is no longer needed and there is no lawful basis for keeping it, it is deleted or anonymised.

9. Cookies and technical services

Hjemferd uses necessary cookies and session mechanisms for sign-in, security and basic functionality. External components such as reCAPTCHA and other integrated services may also process technical information such as IP address and browser information.

Where the law requires consent for cookies or similar technologies, consent is obtained before the relevant processing takes place.

10. Information security

We use technical and organisational measures to protect personal data against unauthorised access, alteration, loss and misuse. Measures include access control, encrypted connections, protected storage of sign-in information, backups and restricted system access.

11. Your rights

Subject to the applicable conditions, privacy law may give you the right to:

• receive information about and access to personal data we process about you
• have inaccurate or incomplete information corrected
• request deletion of personal data
• request restriction of processing
• object to processing based on legitimate interests
• receive data in a structured, commonly used and machine-readable format where the right to data portability applies
• withdraw consent where processing is based on consent

Requests can be sent to [email protected]. We may request information necessary to verify your identity before disclosing or changing personal data.

12. Automated decisions

Hjemferd does not use your personal data for solely automated individual decisions that produce legal effects or similarly significantly affect you.

13. Complaints to the Norwegian Data Protection Authority

If you believe Hjemferd processes personal data in breach of the rules, we invite you to contact us first. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

14. Changes to this privacy policy

We may update this privacy policy when the service or applicable rules change. We will provide appropriate notice of material changes that affect how your data is processed.