Privacy Policy

Sailfloat (under establishment) is the data controller for personal data processed through the platform. The data controller determines the purpose of the processing and the means used.

For certain processing activities, such as identity verification and payment, we use data processors who process data on our behalf and under our instructions, governed by data processing agreements.

We process the following main categories of personal data. The table also shows the primary legal basis; a more detailed description follows in section 3.

We do not process special categories of personal data (sensitive data) as part of the service. Payment card data is not stored by us, but is handled by our payment partner.

3.1 Providing the service (contract, Art. 6(1)(b))

We process contact, booking, and payment information to create and manage your account, facilitate contact between host and renter, complete bookings, process payment and deposit, and provide customer service.

3.2 Identity verification (contract and legal obligation)

To create safety on the platform we verify identity using BankID. The legal basis is performance of a contract and, where relevant, a legal obligation, including requirements to prevent fraud and money laundering.

3.3 Consent (Art. 6(1)(a))

Browser location, email marketing, and the use of analytics and preference cookies are processed on the basis of your consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

3.4 Legitimate interest (Art. 6(1)(f))

We process usage data to secure, operate, and improve the platform, prevent abuse, and maintain information security. We have assessed that our interests outweigh the impact on you and that the processing is expected. You may object to such processing; see section 6.

We share personal data to the extent necessary with:

• Payment partner – to process payment, deposit, and disbursement.
• Insurance partner – when handling damage claims and insurance cases.
• Identity verification provider – for BankID verification.
• Host or renter – the information necessary to complete a rental, such as name and contact details upon confirmed booking.
• Operations and analytics providers – as data processors for hosting, email, and analytics.
• Public authorities – when we are legally obliged to do so.

Where data is transferred to countries outside the EU/EEA, the transfer is safeguarded by a valid transfer mechanism, such as the European Commission's Standard Contractual Clauses (SCCs).

We store personal data for as long as necessary for the purpose for which it was collected:

• Account information – for as long as you have an active account, and deleted or anonymised within 12 months of account closure.
• Booking and contract data – until any claims have become time-barred, normally up to 3 years after the rental.
• Accounting and payment data – for as long as required by the Norwegian Bookkeeping Act, normally 5 years.
• Verification result – for a limited period to document that verification was completed.
• Usage and log data – for a shorter period for security and debugging purposes.

Under the GDPR you have the following rights in relation to us:

• Access – to know what data we process about you and to receive a copy.
• Rectification – to have inaccurate or incomplete data corrected.
• Erasure – to have data deleted when it is no longer necessary (the ‘right to be forgotten’).
• Restriction – to request that processing be restricted in certain circumstances.
• Data portability – to receive data you have provided to us in a machine-readable format and to have it transferred to another controller.
• Objection – to object to processing based on legitimate interest and to direct marketing.
• Withdrawal of consent – where processing is based on consent.

You may exercise your rights by contacting us; see section 10. If you believe we are processing data in breach of applicable law, you may lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no). We appreciate you contacting us first.

We use cookies and similar technologies to make the platform work, to remember preferences, and for analytics. Which cookies we use, how long they are stored, and how to change your consent are described in our cookie policy.

We have implemented technical and organisational measures to protect personal data against unauthorised access, alteration, loss, and disclosure. Measures include, among other things, encryption of data in transit, access control on a need-to-know basis, logging, and procedures for handling security incidents.

In the event of a personal data breach that poses a risk to your rights, we will notify the Norwegian Data Protection Authority, and you, in accordance with applicable law.

We may update this statement when the service or the regulatory framework changes. In the event of material changes we will notify you in an appropriate manner. The date at the top shows when the statement was last amended.

If you have questions about privacy or wish to exercise your rights, you may contact us or our Data Protection Officer: