Privacy Policy

Last update: 08.08.2026

This Privacy Policy explains how Tromsø Guideforening (TGF) collects, uses, stores and  shares personal data through its website, course and membership services. 

The data controller 

Tromsø Guideforening (TGF) is the data controller for the personal data described in this  Privacy Policy. 

Organisation number: 994 058 371  

Address: Samuel Arnesens Gate 10, 9008 Tromsø, Norway 

Email: info@tromsoguideforening.com  

Phone: + 47 458 87 054 

Personal data we collect 

TGF collects only the personal data necessary to operate the website, process course  enrolments, administer memberships, respond to enquiries and keep the website secure. 

Depending on how you use the website, we may collect the following categories of personal  data: 

• contact details, including name, email address and phone number; 
• course enrolment information and membership information; 
• payment confirmation data from payment providers, such as confirmation that payment  has been completed, transaction status and payment reference details necessary to  administer the order; 
• technical information necessary for website security and basic website functionality; • cookie and analytics information, but only where this is permitted under applicable law  and, where required, based on your consent; and 
• information you choose to send to us through a contact form or by email. TGF does not store full payment card details. Card and payment details are processed by the  relevant payment provider. 

Why we use personal data 

TGF uses personal data for the following purposes: 

• to process course enrolments and membership registrations; 
• to grant access to course content and generate membership cards;
• to send order confirmations, membership confirmations and service-related messages; • to respond to enquiries sent through contact forms or by email; 
• to administer payments, refunds, complaints and accounting records; • to prevent misuse of the website and keep the website secure and functioning correctly;  and 
• to understand how the website is used through analytics cookies, but only if the visitor  has given the required consent. 

TGF will not use personal data for purposes that are incompatible with the purposes described  in this Privacy Policy unless there is a valid legal basis for doing so. 

Legal basis for processing 

TGF processes personal data only where there is a legal basis under the GDPR and the  Norwegian Personal Data Act (personopplysningsloven). 

The relevant legal bases are: 

• performance of a contract, where processing is necessary to process a course purchase,  grant course access, administer a membership or provide related services; • legal obligation, where processing is necessary to comply with accounting, tax or other  mandatory legal obligations; 
• legitimate interests, where processing is necessary for website security, administration,  responding to ordinary enquiries and preventing misuse, provided that TGF’s interests are  not overridden by the individual’s rights and freedoms; and 
• consent, where required, including for non-essential analytics cookies and any optional  communications that require consent. 

Where processing is based on consent, you may withdraw your consent at any time.  Withdrawal of consent does not affect the lawfulness of processing carried out before the  consent was withdrawn. 

Cookies and analytics 

The website may use cookies and similar technologies for basic website functionality, security  and analytics. 

Strictly necessary cookies may be used where they are required for the website to function,  for example to maintain website security, enable checkout or remember privacy choices. 

Analytics cookies are non-essential cookies. TGF will not set analytics cookies on a visitor’s  device unless the visitor has actively accepted them through the cookie consent banner.  Visitors who decline analytics cookies will still be able to use the website. 

The cookie consent banner will identify the cookies used, their provider, purpose and  duration. TGF will keep that information updated so that visitors can make an informed  choice before consenting.

Who we share personal data with 

TGF shares personal data only where this is necessary for the purposes described in this  Privacy Policy or where required by law. 

TGF may share personal data with the following service providers: 

• Vipps and Stripe, Woo Commerce Payments for payment processing; 
• WP Forms and Contact 7 form for membership forms and communication;
• Tutor LMS Pro, for course access; 
• Hostinger, for website hosting; and 
• technical service providers used to operate, maintain or secure the website, provided that  they process personal data only for TGF’s documented purposes. 

These providers receive only the personal data necessary to perform their function. TGF does  not sell personal data to third parties. 

Where a service provider processes personal data on TGF’s behalf, TGF will ensure that  appropriate data processing terms are in place. If personal data is transferred outside the EEA,  TGF will ensure that the transfer is based on a valid transfer mechanism under applicable data  protection law. 

How long we keep personal data 

TGF keeps personal data only for as long as necessary for the purposes described in this  Privacy Policy, unless a longer retention period is required or permitted by law. 

The following retention periods apply unless TGF has a lawful reason to keep the data for a  longer or shorter period: 

• course and membership records are kept for as long as necessary to administer the course  access or membership and for up three years after the relationship ends, where this is  necessary to handle questions, complaints or documentation needs; 
• contact form and email enquiries are normally kept for up to 12 months after the enquiry  has been answered, unless the enquiry results in an ongoing customer, member or  contractual relationship; 
• payment and accounting documentation is kept for as long as required under applicable  Norwegian accounting and bookkeeping rules; 
• cookie consent records are kept for as long as necessary to document the visitor’s cookie  choices and manage consent; and 
• technical security logs are kept only for as long as necessary for security, troubleshooting  and misuse prevention. 

When personal data is no longer needed, TGF will delete or anonymise it.

Your rights

Under the GDPR and the Norwegian Personal Data Act (personopplysningsloven), you may  have the right to: 

• access the personal data TGF holds about you; 
• ask TGF to correct inaccurate or incomplete personal data; 
• ask TGF to delete personal data, where the conditions for deletion are met; • ask TGF to restrict the processing of personal data; 
• object to processing based on legitimate interests; 
• request a copy of personal data in a portable format, where the conditions for data  portability are met; and 
• withdraw consent at any time, where processing is based on consent. 

To exercise your rights, contact TGF at info@tromsoguideforening.com. 

TGF may need to verify your identity before responding to a rights request. TGF will respond  to requests within the time limits required by applicable data protection law. 

You also have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection  Authority: https://www.datatilsynet.no. 

Data security 

TGF uses appropriate technical and organisational measures to protect personal data against  unauthorised access, loss, misuse, alteration and disclosure. 

Measures include limiting access to personal data to persons who need it for the purposes  described in this Privacy Policy, using service providers with appropriate security measures,  and maintaining reasonable website and account security routines. 

Changes to this Privacy Policy 

TGF may update this Privacy Policy from time to time. The updated version will be published  on the website. Where required by law, TGF will provide additional notice or request renewed  consent before making changes that materially affect how personal data is processed.