Privacy Policy

1. Data controller

(“Castello”) is the data controller for the personal data processed through this website.

If you have any questions about privacy or wish to exercise your rights, please contact us using the contact details on the website.

2. What personal data we process

We only collect the data we need to respond to you and operate the website:

• Table reservations and enquiries: name, email address, telephone number and anything you enter yourself in a form or the booking system (e.g. date, number of guests, requests).
• Groups/events: in addition, the selected menu/extras and any invoicing details (organisation number, company name, reference) where applicable.
• Use of the website: anonymous, aggregated visitor statistics (page views, clicks, the page you came from and any campaign parameters). See the section on cookies below.

3. Purpose and legal basis

We process personal data for the following purposes:

• To respond to enquiries and carry out table reservations/events. The legal basis is the performance of, or steps prior to entering into, a contract with you (GDPR Article 6(1)(b)).
• To understand and improve the website through anonymised visitor statistics. The legal basis is our legitimate interest in operating and improving the website (Article 6(1)(f)). The statistics cannot be linked to you as an individual.

4. Cookies and analytics

This website does not use any cookies for tracking, marketing or analytics, and we do not share any data with advertising networks. You therefore do not need to give or refuse any cookie consent.

Visitor statistics are collected without cookies: we count visits using a technical, anonymous code that is regenerated every 24 hours and cannot be traced back to you. Your IP address is used only briefly in this calculation and is never stored.

To remember which campaign or link you may have come from, a small, anonymous marker is stored locally in your browser for up to 30 days. It contains no personal data and can be removed by clearing your browser data.

5. Who we share data with

We never sell personal data. We use certain suppliers (data processors) who process data on our behalf and under a data processing agreement:

• Our booking system for table reservations.
• Google (Google Workspace), for email when we respond to enquiries.
• Our operations and publishing platform (Mekanismer), with sub-processors for cloud hosting (Vercel and Cloudflare), technical operation of the website and receipt of forms.

Any opening hours displayed on the website are retrieved from Google, but this takes place on our server and does not set any cookies in your browser.

6. Transfers outside the EEA

Some of our suppliers may process data outside the EEA. Where this occurs, the transfer is safeguarded by a valid transfer mechanism, such as the European Commission's Standard Contractual Clauses (SCC).

7. Retention period

We retain personal data for as long as necessary for the purpose for which it was collected. Enquiries and bookings are deleted once the matter is closed, unless we are legally required to retain them longer (for example, the Norwegian Bookkeeping Act's requirements for retaining accounting records). Visitor statistics are stored in anonymised form only.

8. Your rights

Under the GDPR, you have the right of access to your personal data, the right to rectification of inaccurate data, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. To exercise your rights, please contact us. We will respond as quickly as possible, and in any event within one month.

9. Security

We have technical and organisational measures in place to protect personal data against unauthorised access, alteration and deletion.

10. Changes to this privacy policy

We may update this privacy policy as required. The current version is always available on this page.

11. Complaints to Datatilsynet

If you believe that we process personal data in breach of the regulations, you may lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority. We would appreciate it if you contact us first, so that we have the opportunity to put things right. Contact information is available at www.datatilsynet.no.