Privacy Policy | Frøhus Forest Resort & Casino

Last updated: 25 September 2026

This Privacy Policy explains how personal data is handled on the information website of Frøhus Forest Resort & Casino, on the Frøhus interest list and in any email correspondence with us. We have tried to write it plainly. If anything is unclear, write to [email protected] and a person will answer.

1. Who is responsible for your data

The controller of personal data processed through this website and the interest list is:

Nadiia Babliak
18D Lesia Kurbasa Avenue, Kyiv 03162, Ukraine

In this policy, “we”, “us” and “Frøhus” refer to the controller. Frøhus Forest Resort & Casino is a resort project in development. It is not yet an operating business with guests, staff on site or premises open to the public. For anything to do with your personal data, write to [email protected].

2. What this policy covers

This policy covers the website, the interest list and email correspondence with us. It does not cover other websites we link to, such as Hjelpelinjen or Datatilsynet, which have their own policies.

3. The short version

The website has no analytics, no advertising, no tracking pixels and no cookies.
We only receive personal data when you choose to send us an email, including the email that the interest-list form prepares for you.
We use that data to send you news about the project, if you have agreed, and to reply to you.
You can withdraw at any time by writing to [email protected].
We do not sell or rent your data, and we do not use it for profiling.

4. How the interest-list form works

The form on the Join the interest list page does not send anything by itself. When you press the button, your browser opens your own email program with a message addressed to [email protected], containing the name, email address and area of interest you entered. Nothing leaves your device until you press send in your email program. If you close the message without sending it, we receive nothing. The website itself does not store what you type into the form.

5. What personal data we process

Interest list and correspondence

your name and email address;
the area of interest you chose, for example a type of room, the Seed House, gatherings or general news;
the fact, date and wording of your consent;
anything else you decide to write to us, and our replies.

Technical data

When you visit the website, the hosting provider’s servers automatically record standard technical information in server logs: your IP address, the date and time of the request, the page or file requested, your browser’s user-agent string and the referring page. We do not combine this information with other data or use it to identify visitors. It exists so that the website can be delivered and protected.

Browser storage

On phones, the website remembers which footer sections you opened, using one entry in your browser’s local storage. It contains no personal data and never leaves your device. The Cookie Policy explains it in full.

We do not ask for, and ask you not to send, special categories of data such as health information, or any payment details.

6. Why we process it, and on what legal basis

News about the project (the interest list): Name, email address, area of interest and the record of your consent. Legal basis: your consent under Article 6(1)(a) GDPR. Because these are electronic messages, we also follow section 15 of the Norwegian Marketing Control Act (markedsføringsloven), which requires your prior consent before marketing is sent by email. We send news only to people who asked for it.
Replying to your messages: Our legitimate interest in answering people who write to us (Article 6(1)(f)); where your message concerns steps before a possible future agreement, such as planning an event after opening, Article 6(1)(b).
Operating and securing the website: Server logs, processed on the basis of our legitimate interest in keeping the website available and secure (Article 6(1)(f)).
Legal obligations: Where the law requires us to keep or disclose information (Article 6(1)(c)).

7. Withdrawing consent and leaving the list

You can withdraw your consent at any time, without giving a reason, by writing to [email protected] from the address you want removed, or by replying to any message from us and asking to be taken off the list. Addresses are removed by hand. There is currently no automatic unsubscribe link, and we do not promise one. We will confirm the removal without undue delay and in any case within one month. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

8. Who receives your data

We do not sell, rent or trade personal data. It is shared only with service providers who help us run the website and our email, and only as far as they need it:

the website hosting provider, which processes server logs;
our email provider, which stores the messages you send us and our replies;
if we later use a mailing service to send news to the interest list, that service, which will receive your name and email address.

Each provider acts on our instructions under a data processing agreement. We may also disclose data where the law requires it, for example to a court or a public authority.

9. Transfers outside the EEA

The controller is based in Ukraine, which is outside the European Economic Area and does not currently benefit from an adequacy decision of the European Commission. When personal data of people in Norway or elsewhere in the EEA is transferred to us, or accessed by us from Ukraine, we rely on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR), together with technical and organisational measures to protect the data. Some of our service providers may also process data outside the EEA; where they do, they are bound by Standard Contractual Clauses or another safeguard recognised by the GDPR. You can ask for a copy of the relevant safeguards by writing to [email protected].

10. How long we keep data

Interest list: until you withdraw your consent or the list is closed. We review the list at least once every 24 months and delete entries that are no longer needed.
Correspondence: up to 24 months after the last message in a conversation, unless the matter needs longer.
Server logs: normally no longer than 30 days, depending on the hosting provider’s settings, unless needed to investigate a security incident.
Records of consent and withdrawal: for as long as we need to be able to show that we acted lawfully, and no longer than three years after the list is closed or you leave it.

11. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

access the personal data we hold about you and receive a copy (Article 15);
have inaccurate data corrected (Article 16);
have your data erased (Article 17);
restrict processing in certain situations (Article 18);
receive the data you gave us in a structured, commonly used format, and have it passed to another controller (Article 20);
object to processing based on our legitimate interests (Article 21); and
not be subject to decisions based solely on automated processing, including profiling (Article 22). We make no such decisions.

To use any of these rights, write to [email protected]. We may ask you to confirm your identity, usually by replying from the email address concerned. We will respond without undue delay and within one month. If a request is complex, we may extend this by up to two further months and will tell you why. Exercising your rights is free of charge.

12. Complaints

If you think we have handled your data wrongly, please tell us first so that we can try to put it right. You also have the right to lodge a complaint with a supervisory authority, in particular:

in Norway: Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no);
in Ukraine: the Ukrainian Parliament Commissioner for Human Rights, who supervises the protection of personal data (ombudsman.gov.ua);
or the supervisory authority of the EEA country where you live or work, or where you believe the problem occurred.

13. Age

The website and the interest list are intended for adults aged 18 and over. They are not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.

14. Security

Access to our email accounts and the interest list is limited to the people who need it and protected with strong passwords and two-step verification. The website is served over an encrypted connection and runs no third-party scripts. No method of transmission or storage is completely secure, but we take reasonable care, and we will notify you and the relevant authority of a personal data breach where the GDPR requires it.

15. Changes to this policy

We may update this policy as the project develops, for example if we begin to use a mailing service. The date at the top of the page shows when it was last changed. If a change affects how we use data you have already given us, we will tell people on the interest list by email before it takes effect.