Add organization

Privacy Policy | NorgeGuide

Last updated: 8 November 2026.

This policy explains how the NorgeGuide website (norgeguide.com) handles personal data. We follow the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (2018).

1. Data controller

The website is owned and run by Madloba Info Limited, registration number 2457193, Hong Kong (the "Company", "we").

Address: International Finance Centre, 8 Finance Street, Central, Hong Kong.

Email: [email protected].

2. Payment partner

All payments and payment orders for paid services go through our partner Madloba Consult LLC (29 Kote Marjanishvili St, building 2, Tbilisi, Georgia; madlobaconsult.com; email [email protected]). When you order a paid service, Madloba Consult LLC processes the data needed for the invoice and the payment: name, company details, email, bank details for the invoice and data about the payment. Payment is accepted only by invoice, in USD or EUR, by bank transfer (international SWIFT transfers are accepted). We do not accept cards, so we do not process card details.

3. What data we process

  • Account data: sign-in is only through a Google account, and from Google we receive your name and email address. We do not receive or store passwords.
  • Form submissions (for example "Add your organisation"): your name and email, phone (optional), business name and a link to its website or Google Maps, your message, the page the form was sent from, the time, and the fact that you accepted this policy.
  • Business listings: publicly available information about companies (name, address, phone, opening hours). Basis: legitimate interest, the catalogue is a reference service.
  • Reviews: display name and the text you choose to publish.
  • Cookies and technical data: IP address, device, browser, referrer URL and timestamps.

We do not collect card details or ID documents, and we process no special categories of personal data.

4. Purposes and legal bases

  • Registration and account (sign-in with a Google account): art. 6(1)(b), contract.
  • Strictly necessary cookies (site operation, security): art. 6(1)(f), legitimate interest.
  • Business catalogue (reference information about companies): art. 6(1)(f), legitimate interest.
  • Enquiries via forms (replying to your enquiry and, if you ask us to, adding the business to the catalogue): art. 6(1)(b), contract (listing); otherwise art. 6(1)(f), legitimate interest.
  • Spam protection for forms (Cloudflare Turnstile) (telling humans from bots): art. 6(1)(f), legitimate interest.
  • Page-view statistics without cookies (Cloudflare Web Analytics): art. 6(1)(f), legitimate interest.
  • Analytics (Google Analytics 4) (visit statistics): art. 6(1)(a), consent.
  • Marketing (Google Ads, the GetYourGuide widget) (ads, conversion measurement and the tours block): art. 6(1)(a), consent.
  • Paid services (invoicing and payment via Madloba Consult LLC): art. 6(1)(b), contract.

5. Cookies and analytics

By default only strictly necessary cookies are on. There are four categories: Necessary (always on), Analytics, Marketing and External content (maps, videos and widgets from other services). All except Necessary are off by default. Refusing is as easy as accepting. Maps, videos and widgets from other services belong to the separate category External content and load only after you consent to it. Google Analytics 4 and Google Ads run only with your consent. The full list is in our Cookie Policy. You can change or withdraw consent at any time with the "Cookie settings" button at the bottom of every page.

6. Who we share data with

  • Hosting: a data centre in the Netherlands (EU).
  • Cloudflare Web Analytics: page-view statistics without cookies and without identifying you (Cloudflare, Inc.).
  • Google Analytics 4: statistics (with consent).
  • Google Ads: advertising (with consent).
  • GetYourGuide (GetYourGuide Deutschland GmbH): the tours block on the home page. With marketing consent the provider receives technical data about your visit.
  • Madloba Consult LLC: invoicing and payment for paid services.
  • Google Workspace: all submissions from the forms on this website are collected by the forms, stored in a Google spreadsheet and sent by email to our editorial team. Our editorial email and documents are also kept in Google Workspace. Google Workspace data is stored in Europe. A copy of the email goes to the editorial team's Gmail inbox.

Spam protection for forms (Cloudflare Turnstile)

To protect the forms on this website from spam and automated submissions, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. When you open a page with a form, Turnstile checks in the background that the form is being used by a person. For this, Cloudflare receives technical data about your browser and connection: your IP address, browser information (User-Agent), technical connection characteristics and the page address. Cloudflare processes this data on our behalf to tell humans from bots. It also uses this data itself to improve its bot detection. The data is not used for advertising or profiling. The legal basis is our legitimate interest in protecting the website and its forms from abuse. More information: Turnstile Privacy Addendum and Cloudflare Privacy Policy.

Processors act on our instructions (art. 28 GDPR). We do not sell personal data.

7. Transfers outside the EEA

The Company is registered in Hong Kong, the payment partner is based in Georgia, and Google services and Cloudflare may process data in the USA. Some data may therefore be processed outside the EEA. For such transfers we rely on the EU Standard Contractual Clauses (SCCs) and supplementary measures. This also applies to the copy of form submissions in our editorial team's Gmail inbox. Google LLC participates in the EU-US Data Privacy Framework.

8. Retention

  • Account: while it is active; after you delete the account, we delete the data within 30 days, unless the law requires us to keep it longer.
  • Form submissions: 6 months after the enquiry is closed, then deleted.
  • Technical logs and backups: up to 30 days.
  • Google Analytics data at user and event level: 2 months.
  • Your cookie choice (ng_cookie_consent): 6 months from the day you make your choice.
  • Accounting records: as long as accounting law requires.

9. Your rights

You have the right to access, rectification, erasure (including account deletion), restriction, data portability, objection and withdrawal of consent. Write to [email protected]; we reply within 30 days. You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

10. Security

HTTPS, Google sign-in with no passwords stored on our side, Cloudflare Turnstile protection for forms, access control and regular updates.

11. Children

The site is not intended for children under 13, and we do not knowingly process their data.

12. Changes

The date at the top shows the current version. We will announce material changes on the website.

Help