Privacy Policy

1. Data Controller

Hobby is the data controller for personal data collected through the website hobbyoslo.no.

• Company: Hobby
• Email: hobbysvar@gmail.com
• Website: https://hobbyoslo.no

2. What Personal Data We Collect

We collect the following personal data:

• Account information: Name, email address and password (encrypted) at registration.
• Profile data: Profile picture, phone number and other information you voluntarily provide.
• Reservation data: Information related to reservations you make through the platform, including activity, date, number of participants and contact information.
• Reviews: Ratings and comments you leave on activities.
• Usage data: Information about how you use the website, including page views, clicks and searches (via analytics tools).
• Technical data: IP address, browser type, device and operating system.

3. Purpose of Processing

We process personal data for the following purposes:

• Provide and administer the service (create account, handle reservations).
• Communicate with you about reservations, changes and important updates.
• Improve and further develop the platform based on usage patterns.
• Ensure the platform's security and prevent abuse.
• Fulfil legal obligations.

4. Legal Basis

We process personal data based on the following legal bases (GDPR Article 6):

• Contract (Art. 6(1)(b)): Processing that is necessary to fulfil the agreement with you, e.g. handling reservations and account administration.
• Consent (Art. 6(1)(a)): For analytics tools and cookies that are not strictly necessary.
• Legitimate interest (Art. 6(1)(f)): To improve the service, security and prevention of abuse.

5. Cookies

We use the following types of cookies:

• Necessary: Cookies required for the website to function, including authentication and language selection.
• Analytics: We use PostHog (EU Cloud) to understand how users interact with the platform. These cookies are only set after your consent.

You can change your consent choices at any time via the consent banner at the bottom of the page.

6. Data Sharing

We never sell your personal data. We share data with the following third parties that are necessary to provide the service:

• Supabase (EU): Database and authentication. Data is stored in the EU (Frankfurt).
• Vercel: Hosting and content delivery (CDN). Processes requests globally, but does not store personal data permanently.
• PostHog (EU Cloud): Analytics tool for usage insights. Data is stored in the EU.

Hosts receive the necessary reservation information (name and email) to carry out the activity you have reserved.

7. Security Measures and Data Protection

We take the protection of your personal data seriously and have implemented technical and organisational measures to secure your data:

• Encryption in transit: All communication between your device and our servers is encrypted with TLS/HTTPS.
• Encryption at rest: Personal data is stored in encrypted databases. Passwords are never stored in plain text, but as secure one-way hashes (bcrypt).
• Access control: Access to personal data is strictly limited to authorised personnel who need access to perform their tasks. We use role-based access control (RBAC) at the database level.
• Secure authentication: We offer sign-in via Google OAuth 2.0 and email/password. Authentication data from Google (name and email address) is used only for account creation and sign-in, and is not stored beyond what is necessary to identify your account.
• Data minimisation: We only collect personal data that is necessary to provide the service. Data that is no longer necessary is deleted or anonymised.
• Third-party security: All third-party providers (Supabase, Vercel, PostHog) are chosen based on their security standards and GDPR compliance. Data is stored primarily within the EU/EEA.
• Regular review: We carry out regular assessments of our security measures to ensure they are up to date and effective.

8. Retention Period

We store personal data for as long as it is necessary for the purpose it was collected for. Account data is stored for as long as you have an active account. Reservation data is stored for up to 3 years after a completed activity for accounting and warranty purposes. Analytics data is anonymised after 26 months.

9. Your Rights

You have the following rights under the General Data Protection Regulation (GDPR):

• Access: You can request access to which personal data we hold about you.
• Rectification: You can request that incorrect information be corrected.
• Erasure: You can request that your personal data be deleted.
• Data portability: You can request to receive your data in a structured, machine-readable format.
• Restriction: You can request that the processing of your data be restricted.
• Objection: You can object to processing based on legitimate interest.

To exercise your rights, contact us at hobbysvar@gmail.com. We respond within 30 days.

10. Complaint to the Supervisory Authority

If you believe that our processing of personal data does not comply with the data protection regulations, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

• Datatilsynet
• Website: www.datatilsynet.no
• Email: postkasse@datatilsynet.no

11. Changes to the Privacy Policy

We may update this privacy policy from time to time. In the event of significant changes, we will notify you via email or a message on the platform. The latest version will always be available on this page.