Privacy policy

Last updated: 13 October 2026

Your privacy matters. When you visit Lost in Norvana, get in touch with me, request travel advice or book a trip, you sometimes share personal data with me. I handle that data with care and only use it when necessary.

In this privacy policy I explain which personal data Lost in Norvana collects, why I use that data, who it may be shared with and what rights you have.

Lost in Norvana is the controller responsible for processing personal data as described in this privacy policy.

Lost in Norvana
Chamber of Commerce (KvK) number: 69951853
Email: michelle@lostinnorvana.nl

Do you have questions about your privacy or about how I handle your data? Then you can contact me at the email address above.

Which data I process depends on how you use Lost in Norvana.

When you visit the website, the following data may be processed, among other things:

• IP address;
• type of device, browser and operating system;
• pages visited;
• date and time of your visit;
• referring website or traffic source;
• cookie data and similar technical information.

This data is used, among other things, to make the website work properly, to analyse how the website is used and to improve the website.

If you contact me by email, through a contact form, on social media or in any other way, I may process, among other things:

• your name;
• email address;
• phone number;
• the content of your message;
• any other information you provide yourself.

I use this data to answer your question and to stay in touch with you.

If you request a personal travel plan, a tailor-made trip or another travel service, I need more information to properly assess your wishes.

For example:

• name and contact details;
• place of residence;
• preferred travel period;
• composition of your travel party;
• ages of the travellers;
• travel preferences;
• budget;
• interests and preferred activities;
• information about transport and accommodation;
• previous travel experience;
• information about fitness or mobility where this is relevant to certain activities;
• other information you share with me during a request, intake or conversation.

I only ask for data that is necessary or useful for putting together or carrying out your trip.

When you actually book a trip through Lost in Norvana, additional data may be needed, such as:

• full names as shown on travel documents;
• dates of birth;
• address details;
• phone number and email address;
• nationality, where this is necessary for a booking;
• details needed for flights, ferries, hire cars, accommodation or activities;
• booking and reservation details;
• invoicing and payment details;
• details of fellow travellers.

For some parts of a trip, a supplier may need additional data. I only ask for this when it is necessary to make or carry out the booking in question.

For a trip, it can sometimes be important for me to know about, for example:

• allergies;
• dietary requirements related to your health;
• medical conditions;
• mobility impairments;
• other health information relevant to the trip or an activity.

Health data is a special category of personal data, so I handle it with extra care.

I only process such information when this is necessary and a valid legal exception applies, for example when you have given your explicit consent.

Where necessary, I share relevant information with an accommodation, activity provider or other travel partner. I never share more information than necessary.

You can withdraw your consent at any time. Please bear in mind that some parts of a trip may then not be able to be carried out safely or correctly without the necessary information.

I may use personal data for the following purposes:

• to answer your questions;
• to hold an introductory call or intake;
• to give personal travel advice;
• to put together a travel proposal or travel plan;
• to prepare and perform an agreement with you;
• to book accommodation, transport, activities and other parts of the trip;
• to communicate with you before, during and after the trip;
• to process payments and invoices;
• to comply with legal and administrative obligations;
• to keep the website secure and working properly;
• to gain insight into the use and performance of the website;
• to improve my services and website;
• to send newsletters or other marketing communications, if you have given your consent.

I do not simply use personal data for purposes other than those for which it was collected.

Under the GDPR, every processing of personal data must have a valid legal basis.

Depending on the situation, I process your personal data because:

It is necessary for the performance of an agreement
For example, when you book a trip or personal travel advice with Lost in Norvana.

It is necessary to take steps at your request before entering into an agreement
For example, when you submit a travel request and I put together a proposal for you based on it.

I have to comply with a legal obligation
For example, for my financial records and tax obligations.

You have given your consent
For example, for certain cookies, marketing communications or, where required, the processing of special categories of personal data.

Lost in Norvana has a legitimate interest
For example, to improve my services, prevent fraud or misuse and secure the website, insofar as your privacy interests do not outweigh this.

Where processing is based on consent, you can withdraw that consent at any time.

To organise a trip, I work with other organisations. This may make it necessary to share certain personal data with them.

For example:

• accommodation providers;
• airlines;
• ferry companies;
• transport providers;
• car hire companies;
• activity and excursion providers;
• local travel partners;
• payment providers;
• insurance and guarantee schemes, where necessary;
• accounting or administrative service providers;
• hosting, email and IT service providers;
• other parties needed to carry out your trip.

I only share personal data that is necessary for the service in question.

Where a party processes personal data solely on behalf of Lost in Norvana, I make agreements where necessary about the processing and security of that data.

I do not sell your personal data to other parties.

A trip may include services from parties based outside the Netherlands. Norway is part of the European Economic Area (EEA), so the same European data protection rules apply there.

Some digital service providers or other partners may process personal data outside the EEA.

When personal data is processed outside the EEA, I ensure where necessary that there is a valid legal basis and appropriate safeguards in place, for example an adequacy decision by the European Commission or standard contractual clauses approved by the European Commission.

I do not keep personal data for longer than necessary for the purpose for which it was collected, unless I am legally required to keep it for longer.

The exact retention period may therefore differ per type of data.

In many cases, I have to keep data that forms part of my financial records for 7 years because of tax obligations.

I keep correspondence, requests and travel details for as long as is reasonably necessary for providing my services, record-keeping, any aftercare and handling possible questions or disputes. After that, the data is deleted or anonymised once there is no longer a valid reason to keep it.

Data processed solely on the basis of your consent is deleted when you withdraw your consent, unless there is another legal basis for keeping it.

Lost in Norvana uses cookies and similar technologies.

Some cookies are necessary for the website to work properly. Cookies may also be used to gain insight into how the website is used or for marketing purposes.

Where consent is required for cookies, they are only placed after you have given your consent.

You can view or change your preferences via the cookie settings on the website.

You can find more information about the cookies used, the parties involved and retention periods in the Lost in Norvana cookie policy.

If you sign up for a newsletter or other commercial emails from Lost in Norvana, I use your email address to send you these messages.

I only do this when there is a valid legal basis for it.

You can unsubscribe at any time via the unsubscribe link at the bottom of the email in question or by contacting me.

I take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse or unwanted disclosure.

In doing so, I take into account the type of data being processed and the associated risks.

No website or digital system is completely risk-free. Should a security incident occur despite the measures taken, I will handle it in accordance with the applicable legal obligations.

You have several rights regarding your personal data.

Among other things, you can submit a request to:

• access the personal data I process about you;
• have inaccurate data corrected;
• have personal data deleted;
• restrict the processing of your data;
• object to certain processing;
• have your personal data transferred where the right to data portability applies;
• withdraw consent you gave earlier.

Not every right applies without limits in every situation. Sometimes I must or may keep certain data, for example because the law requires it.

Would you like to exercise one of these rights? Then send a request to michelle@lostinnorvana.nl.

To prevent personal data from ending up with the wrong person, I may ask you to provide additional information so that I can verify your identity.

Are you booking or organising a trip for several people? Then you may also pass on personal data of your travel companions to me.

I assume that you will let them know that you are providing their data to Lost in Norvana and that they can read this privacy policy.

Only pass on other people’s data when this is necessary for the request or booking.

For family trips, personal data of minors who are travelling may be needed, for example for transport, accommodation or activities.

This data is only processed insofar as necessary for preparing or carrying out the trip, and is handled with extra care.

Where consent is legally required for processing a minor’s personal data, it is requested from the person authorised to give it.

Lost in Norvana does not make decisions with significant consequences for you that are based solely on automated processing of personal data without human involvement.

Travel proposals, advice and itineraries are assessed and put together personally.

Lostinnorvana.nl contains links to websites of other organisations, for example accommodation providers, activity providers, booking platforms or other travel-related websites.

Lost in Norvana is not responsible for how these external organisations handle personal data.

So please also read the privacy policy of the website in question when you visit it.

Some links on Lost in Norvana may be affiliate links. If you make a purchase or booking via such a link, Lost in Norvana may receive a commission. The external party concerned and its partners may use cookies or similar technologies for this. You can find more information about this in the cookie policy.

Do you have questions, or are you unhappy with how I handle your personal data? Please feel free to contact me first at michelle@lostinnorvana.nl. I’m happy to try to resolve it together with you.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), the Dutch supervisory authority for privacy.

Lost in Norvana may update this privacy policy when its services, website, systems used or laws and regulations change.

The date on which the privacy policy was last updated is always shown at the top of this page.

I therefore recommend checking this page again from time to time.