Privacy Policy

Last updated: 25 October 2026. Norsk versjon.

1. Who is responsible

Oslo Sea Experience AS (org. no. 933 797 082) runs seaexperience.no and the Oslo tours, and is the data controller for the personal data described here. Questions and requests go to oslo@seaexperience.no or +47 917 17 154.

Tours in Kristiansand are sold by Myko Sea AS (org. no. 937 338 716). What you enter when you book a Kristiansand tour goes to Myko Sea's own booking account, and enquiries about it go to kristiansand@seaexperience.no.

2. When you book or write to us

Booking an Oslo tour. We ask for your first and last name, email address and phone number, and record the tour, date, start time, number of guests, any food add-on, promo code and special requests. We need this to make and run the booking. It goes to Bókun, our booking system, where the booking and a booking note are stored, and to Stripe for the payment.

Card payments. Your card details go straight from your browser to Stripe. They never reach our server. From Stripe we see the payment status, the card brand and the last four digits, and we send Stripe your email address and the tour details with the payment.

Our booking log. For every booking attempt our server keeps a log entry with your name, email, phone, country (a country code taken from your network connection), the tour details above, the amount, how far the booking got, where your visit came from (section 4) and the identifiers that Google Analytics and Meta keep in cookies in your browser. We use it to make sure no payment is held without a booking, to send you the right confirmation, and to follow up if a payment fails, for example by calling you. An entry is deleted 120 days after it was last changed.

Emails. After a booking you may get a welcome email from us with the practical details. If you use the contact form or the help pop-up, we receive your name, email, phone (if given) and message in our inbox. If you sign up for the newsletter, your name and email are added to our mailing list. Signing up for investor updates on our fundraising page (/fundraise) stores your name, email, phone and the choices you tick. All of these emails and lists run through Resend.

3. Measurement and advertising

Google Analytics 4 loads on every page. For visitors in the EEA, the UK and Switzerland, analytics measurement is currently on even if you decline in the cookie banner. The banner controls only the settings Google uses for advertising: storing ad cookies, using your data for ads, and personalised ads. Outside those countries all signals are on by default. Your choice is saved in your browser and applied on every page.

Meta Pixel (Facebook and Instagram) and the LinkedIn Insight Tag load on every page, even if you decline in the banner.

From our server. When a booking is confirmed in Bókun, our server reports the purchase to Meta through its Conversions API. It sends your email, phone, first name, last name and country as SHA-256 hashes (one-way scrambled values that Meta matches against its own records), the amount, and the Meta browser IDs (the _fbp and _fbc cookies) if you booked on our site. It also reports the purchase, and any later cancellation, to Google Analytics with the booking code, the amount and your Analytics browser ID, but no name, email or phone. When you send the contact form or finish a booking in your browser, our server passes that event to Meta with hashed contact details, your IP address and your browser's user agent (the text that names your browser and device). We pass these on to Meta and keep no copy of your IP address or user agent.

When you make a choice in the cookie banner, the choice itself (accepted, rejected or custom) is sent to Google Analytics under a random, one-off ID, without cookies or your IP address.

4. Where your visit came from

On every page a script saves in your browser where your first and latest visit came from: campaign tags (utm parameters), ad click IDs from Google, Meta, Microsoft, TikTok, LinkedIn and others, the referring page and the page you landed on, and how many pages you have seen. It does this even if you decline in the cookie banner, and the data stays in your browser until you clear it. When you book or contact us, a summary goes with your booking or message: into our booking log, into the booking note in Bókun and into the email we receive. If you follow a link to book one of our See Oslo land tours on book.seaexperience.no, the link carries the same information.

5. What is stored in your browser

Local storage and session storage are small amounts of data your browser keeps for this site. Session storage is cleared when you close the tab.

• ose_attr (local storage): where your visits came from, see section 4. No expiry.
• cookie-consent and cookie-consent-timestamp (local storage): your banner choice and when you made it. No expiry.
• ose-currency and ose-exchange-rates (local storage): the currency you picked and the exchange rates, refreshed after 24 hours.
• NEXT_LOCALE (cookie): your language choice, for one year.
• During card payment (session storage): your booking details, so the booking can continue after your bank's card check. Removed when the booking is done or the tab is closed.
• Cookies set by Google Analytics (_ga), Meta (_fbp, _fbc) and LinkedIn.

6. Who else processes your data

• Bókun: booking system for the tours.
• Stripe: card payments.
• Cloudflare: hosts the website, our server and the booking log. Cloudflare handles your IP address to deliver the site. Our server uses it only to limit repeated requests and does not keep it.
• Resend: sends our emails and holds the newsletter list.
• Google (Analytics), Meta (Pixel and Conversions API) and LinkedIn (Insight Tag), as described in section 3.
• Bunny.net: delivers images and video, so it receives your IP address.
• exchangerate-api.com: your browser fetches currency rates from it, so it receives your IP address.
• Open-Meteo: on the water temperature page your browser fetches the current sea temperature from Open-Meteo, so it receives your IP address.
• Google Fonts: a few pages load fonts from Google, which then receives your IP address.
• Google Workspace: our email inbox, where contact form messages and booking emails arrive.

Several of these companies are based in the United States, so your data may be processed outside the EEA.

7. How long we keep it

• Booking log entries: deleted 120 days after they were last changed.
• Bookings and payments in Bókun and Stripe that are accounting records: kept for five years, as the Norwegian Bookkeeping Act requires.
• Emails in our inbox: no automatic deletion. Ask us and we delete them.
• Newsletter and investor-update lists: until you unsubscribe or ask us to remove you.
• Data in your browser: until you clear it, except where section 5 gives a shorter time.

8. Your rights

Under the GDPR you can:

• see the personal data we hold about you;
• have wrong data corrected;
• have your data deleted;
• object to or restrict how we use it;
• get your data in a machine-readable format;
• withdraw consent where we rely on it;
• complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

Write to oslo@seaexperience.no to use any of these rights.

9. Contact

Oslo Sea Experience AS, Hagegata 46C, 0653 Oslo, Norway

Email: oslo@seaexperience.no · Phone: +47 917 17 154