Privacy Policy

Canal Boats Telemark is the data controller for personal data processed in this service. Contact: post@canalboats.no.

• Account: name, email, role, language preference.
• Customers: booking details (dates, guest count, optional notes).
• Staff: completed checklists with who did what and when.
• Defects/reports: description, photos, status and history entries.
• Technical: encrypted httpOnly login cookies (strictly necessary).

• Providing the booking and portal service (contract, GDPR art. 6(1)(b)).
• Fleet operations, safety and improvement (legitimate interest, art. 6(1)(f)).
• Statutory operational/accounting records (art. 6(1)(c)).

Account data and operational logs are kept while your account is active and up to 12 months after the customer relationship ends. Defect logs are retained for up to 5 years for safety and insurance reasons. Photos are deleted once the related defect is closed and statutory limits expire.

We do not share personal data with third parties beyond:

• Cloud hosting provider (servers within the EEA).
• Object storage for photos (within the EEA, encrypted at rest and in transit).

• Access & portability: Download all your data from "My profile".
• Rectification: Edit your account info or contact us.
• Erasure: Delete your account yourself from "My profile" – audit logs are anonymised.
• Complaint: You may complain to the Norwegian Data Protection Authority (datatilsynet.no).

We only use strictly necessary cookies for authentication (access_token and refresh_token). They are HttpOnly, Secure, and removed on logout. We use no analytics, tracking or marketing cookies.