Last updated: 11 November 2026

This Privacy Policy explains how Otta Management AS ("we", "us", "our") collects, uses, stores, and protects personal data when you visit our booking website, submit a booking form, or otherwise interact with our booking service.

Who is responsible? We (Otta Management AS) are the data controller for the personal data described in this Policy. We decide why and how your booking data is used for our services.

Booking platform (Klarte). Our booking website is operated using Klarte.no ("Klarte"). Klarte provides the technical booking platform and acts as our data processor under Article 28 GDPR. Klarte processes personal data only on our instructions to deliver hosting, booking infrastructure, confirmation emails, consent records, and related technical functions. Klarte does not use your data for its own marketing or advertising, does not sell your data, and does not decide how we run our business or communicate with you. Klarte is a separate legal entity from Otta Management AS.

Questions or requests about your data? Contact us first at henrik.hoias@gmail.com. If you use our self-service privacy link from a confirmation email, you are still exercising your rights in relation to our business — Klarte assists us with the technology.

1. Information we collect

1.1 Information you provide (booking data)

When you submit a booking, we collect what is needed to deliver the appointment, for example:

Name
Email address
Phone number (if you provide it or we ask for it)
Selected service and appointment date/time
Notes you choose to add
Records of when a booking is created, changed, or cancelled

1.2 Technical processing without marketing consent

Like most websites, our booking page requires basic technical processing to function (for example encrypted connection, security, and operation of the form). We use aggregated statistics that do not identify you individually where possible. We do not store detailed, identity-linked journey analytics unless you opt in under section 1.3.

1.3 Optional marketing consent

If you tick the separate, optional marketing checkbox on our booking form, we may also process limited usage information linked to your booking to measure marketing performance and, where we offer it, send you marketing. This may include device type, how you found us (referrer or campaign tags), visit type, time spent on the form and its steps, and use of "Back" in the form. This is stored with your booking only if you opt in. You may leave the box unticked and still complete your booking.

2. Legal bases for processing

Activity	Legal basis	Notes
Delivering your booking (contact details, time, service)	Art. 6(1)(b) GDPR — contract	Required for the appointment you request
Providing this Privacy Policy (required acknowledgment on the form)	Art. 6(1)(c) GDPR — legal obligation / transparency (Art. 13)	Not optional marketing consent
Security, fraud prevention, service reliability	Art. 6(1)(f) GDPR — legitimate interests	Balanced against your rights; minimal data
Brief retention of contact details after a late cancellation linked to a deletion request	Art. 6(1)(f) GDPR — legitimate interests; Art. 17(3)(e) where relevant	Only within our published notice window, until the scheduled appointment end (see section 8)
Aggregated statistics (non-identifying)	Art. 6(1)(f) GDPR — legitimate interests	Does not rely on marketing consent
Marketing and identity-linked journey analytics (section 1.3)	Art. 6(1)(a) GDPR — consent	Separate unticked checkbox; withdraw anytime

The required privacy acknowledgment on our booking form confirms that you have been able to read this Policy. It is not consent to marketing. Marketing is always optional.

3. How we use information

Confirm, manage, and deliver your booking
Send booking-related emails (confirmations, changes, cancellations)
Operate, secure, and improve our booking service
Meet legal, tax, or accounting obligations
Detect abuse or security incidents
Where a booking is cancelled late within our notice window, follow up on late cancellation or no-show matters under our terms
Only with marketing consent: measure marketing performance and send marketing we offer

4. Roles, responsibilities, and how to contact us

Otta Management AS (we) are responsible for:

Deciding whether to offer marketing and any optional fields on our form
Responding to your privacy requests (access, deletion, correction, objections)
Any additional privacy information we publish under "Additional information" below
Ensuring our use of the booking service complies with applicable law

Klarte.no is responsible for:

Providing the booking platform securely and only processing data on our instructions
Assisting us with technical measures described in our data processing agreement with Klarte
Notifying us of security incidents affecting the platform as required by that agreement

Please contact us at henrik.hoias@gmail.com for any question about this Policy or your personal data. Do not rely on Klarte's general platform contact for requests about your booking with us — we remain your point of contact as data controller.

5. Sharing and processors

We do not sell personal data. We share data only as needed to run our service:

Klarte.no — data processor (Article 28 GDPR) for the booking platform
Infrastructure and email providers engaged by Klarte or us under data processing terms — for hosting, delivery of transactional emails, and backups
Authorities — when required by law or valid legal process

Klarte may use sub-processors (such as hosting, email, and SMS delivery providers) subject to Article 28 GDPR and our agreement with Klarte. Klarte publishes its current sub-processor list (purposes, locations, and transfer safeguards) at klartebooking.com/legal/sub_processors.php.

6. International transfers

We aim to store and process booking data within the European Economic Area (EEA). If any provider processes data outside the EEA, appropriate safeguards (such as EU Standard Contractual Clauses and supplementary measures where required) are used under Article 46 GDPR.

7. Retention

Data	Retention
Booking contact details and appointment data	As long as needed to provide the service and meet legal obligations, then anonymized where possible. Special rules apply after a deletion request within our cancellation notice window (section 8).
Accounting and mandatory records	As required by applicable law
Marketing consent and related analytics (section 1.3)	Until you withdraw consent or we no longer need it for the stated purpose
Technical security logs (processor level)	Short, limited retention for security and troubleshooting

8. Your rights and complaints

Depending on applicable law (including GDPR), you may have the right to access, rectify, erase, restrict, port, or object to processing, and to withdraw consent where processing is based on consent.

Active booking vs deletion. We must keep contact details and appointment information while a future booking is active so we can deliver the service. You may cancel via the link in your confirmation email. Marketing consent and related analytics can be withdrawn without cancelling, using the privacy link in your confirmation email.

Deletion requests and our cancellation notice window. We set a cancellation/change notice period before each appointment. Our current setting is 24 hours. If you request deletion of your personal data and that cancels a future booking within that notice window, we will:

Clear free-text answers, selected service choices stored with your answers, and other non-contact form answers from the booking record without undue delay; and
Keep only contact details (name, email, and phone if provided) until the scheduled appointment end time has passed — so we can contact you about a late cancellation or no-show where our terms allow.

After that end time, those contact details are deleted or anonymized as well, unless a separate legal retention duty applies (for example accounting). If your deletion request is made outside the notice window — or if the notice period is set to no deadline — we anonymize contact details when the booking is cancelled, without waiting for the appointment time. Immediately means every cancellation is inside the window. A cancelled appointment slot (date/time and late-cancellation flag, without your contact details after anonymization) may remain for our calendar and operations.

Account closure by the business. If the business that operates this booking service closes its Klarte account, booker data stored for that business may be permanently deleted as part of that process, in line with the business's obligations as data controller.

How to exercise rights: email henrik.hoias@gmail.com or use the self-service privacy portal linked from your booking confirmation.

Complaints. You may lodge a complaint with a supervisory authority. In Norway, this is Datatilsynet (www.datatilsynet.no). We encourage you to contact us first so we can try to resolve your concern.

9. Security

We and Klarte implement appropriate technical and organizational measures (such as HTTPS/TLS encryption in transit and access controls). No method of transmission or storage is completely secure; we work to protect your data in line with industry practice and applicable law.

10. Personal data breaches

If we become aware of a personal data breach affecting your booking data, we will assess it and, where required by law, notify you and/or the relevant supervisory authority. Klarte, as our processor, will notify us without undue delay if a breach affects the booking platform processing your data on our behalf, so that we can meet our obligations as controller.

11. Children and automated decisions

Our booking service is intended for adults booking appointments. We do not knowingly collect personal data from children under 16. If you believe a child has provided data to us, contact henrik.hoias@gmail.com.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

12. Changes to this Policy

We may update this Policy to reflect changes to our services or law. Material changes will be communicated where required. The "Last updated" date above shows when this Policy was last revised. Klarte may update the standard platform sections of this Policy; we remain responsible for informing you of material changes affecting our use of your data.

13. Contact your data controller

The organisation responsible for your booking data is Otta Management AS — the business you are booking with. This is not Klarte.no.

Email: henrik.hoias@gmail.com

Gavekort

Når du kjøper eller får et gavekort, behandler vi navn og e-post til kjøper og mottaker, en eventuell hilsen, beløpet og når kortet blir brukt. Formålet er å levere og innløse gavekortet, og grunnlaget er avtalen med deg (art. 6 nr. 1 bokstav b GDPR). Betalingen behandles av Stripe. Vi får ikke kortnummeret ditt.

Navn, e-post og hilsen slettes 24 måneder etter at gavekortet er brukt opp, utløpt eller kansellert. Koden, beløpet og datoene beholdes for regnskapet.

Forhåndsbetaling

Bestillingsbekreftelse