Thon Group Privacy Policy

1. Our privacy principles

We greatly appreciate you as a customer and want to provide you with unique experiences and overnight stays no matter where you are. It is important to us that you are satisfied with and have confidence in all Thon Group subsidiaries.

You can be sure that we both collect and store your personal data in a lawful and secure manner.

Below is a menu with information about how our various business areas process your personal data. Under the menu, you can also find information about other processing that we carry out that does not directly fall under our primary business areas.

2. Definitions

2.1 'Personal data'

All types of information that can be traced either directly or indirectly to a single person. For example: name, address, contact details, IP address, biometrics, etc.

2.2 'Processing' of personal data

Any type of activity performed with personal data. For example: collection, storage, deletion, disclosure, rectification, etc.

3. Data controller

Thon Gruppen AS with business registration number 988,969,656 (hereinafter 'the Thon Grouop,' 'we, our" “us') is the data controller for the personal data processed in all companies in the Thon Group that are more than 50% owned by the Thon Group.

We are located at Stenersgata 2A, 0184 Oslo (Postboks 489 Centre, 0105 Oslo) and can be reached at .

4. Dittgavekort (electronic gift card)

4.1 Purchase of electronic gift card

If you purchase our electronic gift card, we process the following data in order to provide the service and to support the product after it has been delivered:

• Contact information (name, mobile number, email address and mailing address)
• Photograph (optional for the front of the gift card)
• Masked card number
• Company information (business customer)
• Billing address (business customer)

The basis for this processing of personal data is to fulfil the agreement on the delivery of Dittgavekort with you.

The data is deleted after five years in accordance with the Norwegian Bookkeeping Act.

4.2 Redemption of gift card (applies to private customers in Norway only)

When you redeem a gift card, we process the following information in the redemption form:

• Contact information (name and email address)
• Gift card number
• BankID verification

The basis for this processing of personal data is to fulfil the agreement on the redemption of the gift card with you.

The data is deleted after five years in accordance with the Norwegian Bookkeeping Act.

The actual redemption is carried out by our partner. Your bank account number will be required in order to refund the remaining amount on the gift card. See their privacy policy here.

5. Housing rentals

5.1 Application for housing (including student housing)

When you submit an application for housing to us, we process the following personal data:

• Contact details (name, phone number and email address)
• Date of birth
• Budget
• School at which you are enrolled (when applying for student housing)

The basis for this processing of personal data is to fulfil the agreement on processing of the student housing application (GDPR Article 6 (1) b).

The data is deleted after the application process has been completed.

5.2 Rental management

In order to create a rental contract and manage the rental relationship with you, we process the following personal data:

• Contact details (name, phone number and email address)
• National identification number
• Financial information (credit check)

The basis for this processing of personal data is to fulfil the housing rental agreement (GDPR Article 6 (1) b).

The data is deleted five years after the end of the contract.

6. Housing sales

6.1 Booking of private viewing

If you request a private viewing and book this via our booking calendar, we process the following personal data:

• Contact details (name, phone number and email address)
• Date and time

The basis for this processing of personal data is the fulfilment of the private viewing agreement (GDPR Article 6 (1) b).

The data is deleted after the property or project is sold.

6.2 Registration of interested parties

If you have expressed an interest in a home, we process the following personal data about you:

• Contact details (name and email address) 

The basis for this processing of personal data is the consent you gave us when registering as an interested party (GDPR Article 6 (1) a).

The data is deleted (continuously) after the property is sold.

6.3 Home sales

When you enter into or consider entering into an agreement for the purchase of a home with us, we may process the following personal data in connection with the purchase:

• Contact information (name, phone number and email address)
• BankID identification
• Financial information
• Any documents you submit, such as ID or other relevant documentation

The basis for this processing of personal data is that it is necessary to prepare and fulfil the home purchase agreement (GDPR Article 6 (1) b).

The personal data is deleted after 10 years in accordance with real estate regulations

7. Thon Flex

7.1 Use of contact form

If you use the contact form on our website to express your interest or if you have general questions, we process the following data:

• Contact details (name, phone number and email address)
• Employer

For enquiries/questions, we need to process the personal data necessary to be able to assist you. The legal basis is a legitimate interest (GDPR Article 6 (1) f).

The data is deleted after one year.

7.2 Thon Flex membership

To be able to rent an office/meeting room, a membership must be created. When registering as a Thon Flex member, we process the following personal data:

• Contact details (name, phone number and email address)
• Employer

The basis for this processing of personal data is to fulfil the office/meeting room rental agreement (GDPR Article 6 (1) b).

The rental agreement is archived at the end of the rental period. Personal data in connection with the establishment of the membership is deleted on an ongoing basis.

8. Whistleblowing

If you have used the whistleblowing channel, we process the following personal data:

• Contact information (name, mobile number and email address)
• Content of the notification

If you report anonymously, no personal data about you will be processed.

We process the personal data in order to be able to comply with requirements for reporting problematic conditions and proper follow-up of the whistleblower.

The basis for this processing of personal data is that it is necessary to fulfil a legal obligation, cf. the Working Environment Act (GDPR Article 6 (1) c).

Whistleblowing cases are stored for the duration of our lifetime.

9. Wi-Fi

If Thon Wi-Fi is provided at the property and this is used, the following personal data is processed in order to be able to offer you free Wi-Fi:

• IP address
• MAC address
• Location
• Phone number (to send one-time code)

The basis for this processing of personal data is to be able to enter into the agreement with you for the provision of free Wi-Fi.

Personal data is deleted after the session has ended. The session duration is selected by you before connecting.

10. Access control at our properties

Many of our properties require the tenant to have an access card to gain access to the building. In cases where access is managed by the Thon Group, the following personal data is processed:

• Contact information (name, mobile number and email address)
• Employee number
• Employer
• Log

The basis for this processing of personal data is our legitimate interest in ensuring that only authorised persons have access to our properties.

Personal data about staff clocking that appears in the log is deleted after 90 days. Personal data is otherwise deleted when the employee no longer has a business need for access to the property.

11. Visitor registration for tenants

At several of our properties, visitors must register before gaining access to the building. In these instances, we process the following personal data:

• name
• mobile number (optional)
• the person being visited

The purpose of the processing is to ensure building security and to notify the employee expecting the visitor that the visitor has arrived.

The legal basis for the processing is our legitimate interest in maintaining an overview of who is present in the building.

Personal data regarding visitor registrations is deleted after 30 days.

12. Camera surveillance

Certain areas of our properties may be monitored by cameras. Read more about the processing of personal data in connection with camera surveillance.

13. Who do we share your personal data with?

We share your personal data with our data processors. We enter into data processing agreements with our partners and require them to provide a guarantee that they process your data securely and for our purposes only. 

In some cases, personal data may be shared with public authorities, such as the police, emergency services or regulators, if this is necessary to safeguard life and health or if we are legally obliged to disclose information, for example in connection with an investigation or other legal requirements.

14. Where is your personal data stored?

The personal data that we process is generally stored on servers in the EU/EEA.

For certain services, such as our recruitment system, personal data may be processed by subcontractors that use service providers in countries outside the EU/EEA. Any transfers to third countries only take place if there are valid grounds for the transfer, for example by using service providers that are certified under the EU-U.S. Data Privacy Framework or equivalent mechanisms that ensure an adequate level of protection.

15. Security of processing

We have established adequate security measures to protect the integrity, confidentiality and availability of your personal data. These measures include both technical solutions, such as access control and encryption, and organisational procedures that ensure the proper processing of the data.

Access to your personal data is strictly limited to employees with a business need for such access and who are authorised to process the data in accordance with applicable guidelines.

We provide training to employees and relevant third parties to promote awareness of the Foundation’s guidelines and data protection policies and to ensure that everyone who handles personal data has sufficient competence and understanding of the applicable regulations.

All employees of the Thon Group are bound by a duty of confidentiality and we have established internal procedures to handle any violations of privacy. In the event of deviations or a suspicion of unauthorised access, we take the necessary measures to limit damage and notify the affected parties in accordance with legal requirements.

17. Contact us

If you wish to exercise your rights, you can contact the privacy department at the Thon Group using our electronic form.

If you have any questions or objections regarding the Thon Group’s processing of personal data, you can contact our data protection officer directly at .