STAYSMART · KONGSBERG
Privacy at StaySmart.
We use personal data to respond to enquiries, provide stays and manage lettings. Here we explain what we process, why and what rights you have. Last updated: 14 October 2026.
1. Who is responsible?
STAYSMART – JONAS KVÅLSKÅS Organisation number: 936 070 949 Glitregata 31, 3612 Kongsberg, Norway Email: support@staysmart.no You can also use the contact form on our website. StaySmart is the data controller for the data we process about guests, contact persons and property owners. You can contact us about access, correction, deletion or other privacy questions.
2. Data and where it comes from
When you use the contact form, we receive your name, email address, optional phone number, message, preferred dates, number of guests and any selected property. Phone number and dates are optional; your name, email and message are necessary for us to reply. When you book, we also process your booking reference, stay and payment status, agreed price and necessary correspondence. The data comes from you, the person booking on your behalf or the booking channel you use. For property owners, we process contact details and necessary information about the property and letting agreement. When you visit, hosting providers may process your IP address, browser information, timestamps and technical logs. Do not send health information, national identity numbers or card details through the standard contact form.
3. Purposes and legal bases
Booking or letting enquiries, reservations and practical guest support are processed to take steps you request before an agreement, or to fulfil the agreement (GDPR Article 6(1)(b)). Accounting data is processed to comply with legal obligations (point (c)). Technical security logs, handling other enquiries and documenting specific claims are based on our legitimate interests in secure operations, customer service and dispute handling (point (f)), balanced against your privacy. Maps and availability calendars are displayed directly. See sections 4 and 7 for information about the providers and the technical data they receive. Processing that requires consent is based on your consent (point (a)). You can withdraw consent. Withdrawal does not make earlier lawful processing unlawful.
4. Providers and sharing
The website runs through Sites/OpenAI with Cloudflare providing the technical infrastructure. Enquiries are stored in the website’s private administration area. Smoobu is used for booking and availability calendars, and Stripe for card payments. Card details are entered with the payment provider, not in StaySmart’s contact form. Maps on property pages are displayed directly and load automatically as you approach the map area. Google then receives your IP address and browser information. Google also receives technical data when you open a Google Maps link. When you view a calendar or proceed to booking, Smoobu receives the information necessary for the service. Airbnb, Booking.com and other channels process data under their own policies when you use them. We share necessary data with people providing agreed cleaning or practical support when needed for your stay. Data may also be shared with accounting, payment or advisory services and authorities where there is a legal basis. We do not sell your contact details.
5. Processing outside the EEA
Some of our providers operate internationally and may process data outside the EEA. Their privacy information describes countries, recipients and transfer mechanisms. Transfers of data for which StaySmart is responsible must have a valid basis under the GDPR, such as an adequacy decision or standard contractual clauses with any necessary supplementary measures. Contact us if you would like more information about the providers used for your data and the applicable transfer basis.
6. How long data is stored
Enquiries are kept while the conversation is ongoing and for as long as needed for follow-up. Enquiries that do not lead to an agreement are deleted when follow-up is no longer needed, unless there is another specific basis for retention. Booking and agreement data is kept during the stay and afterwards for as long as necessary for settlement, legally required documentation or a specific claim. Accounting records are retained under bookkeeping rules; core accounting documentation must normally be kept for five years after the end of the financial year. When the basis for retention no longer applies, data must be deleted or anonymised. Providers may have different statutory retention periods.
7. Cookies and optional services
StaySmart has not added its own advertising pixels or analytics tools to the website. Technical functions for security and administration sign-in may use necessary cookies. Guests do not need to sign in to send an enquiry. Maps and availability calendars are displayed directly on the website and load automatically as you approach them. Maps are provided by Google, and availability calendars by Smoobu. The providers then receive your IP address and browser information to display the services. When you visit an external booking, payment or map service, that service’s policies and any cookie choices also apply. You can manage or delete cookies in your browser.
8. Public reviews
The website may display selected reviews from Airbnb and other public sources, with the reviewer’s displayed name, text or clearly marked excerpt, rating and any date. The source is stated. The purpose is to give guests an impression of previous stays. Processing is based on our legitimate interest in presenting guest experiences, balanced against the individual’s privacy. Contact us if a review about you should be corrected or removed, or if you wish to object to its display.
9. Your rights
You can request access and a copy, correction, deletion, restriction and, where the conditions are met, data portability. You can object to processing based on legitimate interests. We cannot always delete data that we are required to retain or that is necessary for a specific legal claim. Send your request to support@staysmart.no. We normally reply within one month. If the matter is complex and the deadline needs to be extended, we will inform you within the first month. We may request necessary information to verify your identity. You can complain to the Norwegian Data Protection Authority if you believe the processing breaches privacy rules. Contact and complaint information is available at datatilsynet.no.
10. Security and changes
Access to enquiries and administration is restricted to authorised users. The website uses HTTPS. We do not ask for card details or sensitive information in the contact form. This policy is updated when services or procedures change. Significant changes affecting the processing of your data are communicated appropriately; a new date on this page alone does not replace the necessary information to you.