Privacy Policy

1. Who we are and how to reach us

Nordlys Editorial Media ApS ("we", "us", "our") is a private limited company registered in Denmark under company number 41920765, with its registered office at Store Kongensgade 68, 3. sal, 1264 Copenhagen K, Denmark. We publish the independent editorial website curiouslanebrowsing.lol, which documents five signature hotels in Copenhagen. For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Danish Data Protection Act, we are the data controller for personal data processed through this website.

General privacy enquiries: [email protected]. Our Data Protection Officer can be reached directly at [email protected] or by post, marked "DPO — Confidential", at the registered address above.

2. Our general approach

This is a publishing site, not a booking platform. We do not sell products, we do not take reservations, we do not operate user accounts, we do not run a newsletter, and we do not sell, rent or trade personal data to anyone under any circumstances. The volume of personal data we handle is deliberately small, and we have designed the site so that a visitor who declines all non-essential cookies can read every page in full without any functional degradation.

3. Categories of personal data we collect

3.1 Data you provide voluntarily

• Contact form submissions: your name, email address, chosen subject category, related hotel entry (if selected) and the content of your message. If you volunteer additional information inside the message body — a telephone number, a travel date, a photograph — we process that too.
• Direct email correspondence: your email address, display name, message content and any attachments, together with the technical email headers generated by your mail provider.
• Data protection requests: where you exercise a statutory right, we may need to process limited additional information in order to verify that the request comes from you.

3.2 Data collected automatically

• Server log data: truncated IP address, user agent string, requested URL, referring URL, HTTP status code, response size and timestamp. Our host records these for security, abuse prevention and diagnostics.
• Consent state: a record of whether you accepted or rejected non-essential cookies, stored in your browser's local storage under the keys cookieConsent and cookieConsentDetail. This never leaves your device.
• Analytics data (only with consent): anonymised page views, approximate country-level location derived from a truncated IP address, device category, referrer and reading depth. We do not use cross-site identifiers, advertising cookies, fingerprinting or behavioural profiling.

3.3 Data we never collect

We do not collect payment card data, passport or identity document numbers, precise geolocation, biometric data, or any special category data as defined in Article 9 of the GDPR. We do not knowingly collect personal data from children under the age of sixteen; if you believe a child has sent us personal data, contact the DPO and we will delete it.

4. Purposes and lawful bases

• Answering your correspondence — lawful basis: legitimate interests (Art. 6(1)(f)), namely responding to a communication you initiated; where you tick the consent box on the contact form, also consent (Art. 6(1)(a)).
• Publishing and maintaining the website — lawful basis: legitimate interests in operating an editorial publication.
• Security, abuse prevention and diagnostics — lawful basis: legitimate interests in keeping the service available and protected against attack.
• Audience measurement — lawful basis: consent, withdrawable at any time via the Cookie Policy page.
• Compliance with legal obligations — lawful basis: legal obligation (Art. 6(1)(c)), for example retaining correspondence relevant to a legal claim or complying with a valid order from a competent authority.

5. Cookies and similar technologies

We use a minimal set of cookies and browser storage items. Essential items are strictly necessary to deliver the site and record your consent choice; they are set without consent as permitted by the ePrivacy Directive as implemented in Denmark. Analytics and functional items are set only after you give affirmative consent through the banner. A complete table of every item, its purpose, provider, type and retention period is published in our Cookie Policy, together with browser-by-browser opt-out instructions.

6. Third-party processors and recipients

We keep the supply chain deliberately short. The categories of recipient are:

• Hosting and content delivery provider — stores the website files and serves them to your browser; processes server log data on our behalf. Data is hosted within the European Economic Area.
• Email service provider — transmits and stores correspondence sent to our @curiouslanebrowsing.lol addresses. Servers located within the EEA.
• Privacy-focused analytics provider (consent only) — processes anonymised, aggregated usage statistics. Configured without cross-site tracking and with IP truncation enabled.
• Image content delivery network — photography on this site is served from a third-party image CDN. Requesting an image necessarily discloses your IP address and user agent to that provider, in the same way as any embedded image on the web.
• Map embed provider — the map frame on our Contact page is served by a third party and loads only when that page is opened.
• Professional advisers and authorities — lawyers, accountants and auditors under duties of confidentiality, and competent public authorities where disclosure is legally required.

Every processor acts under a written data processing agreement meeting the requirements of Article 28 GDPR. Where any transfer outside the EEA is unavoidable, it is made under the European Commission's Standard Contractual Clauses together with supplementary technical measures, and we document a transfer impact assessment.

7. Data retention

• Contact form and email correspondence: retained for 24 months from the date of the last message in the thread, then deleted, unless it relates to an unresolved complaint, correction dispute or legal claim.
• Server logs: retained for a maximum of 30 days, then automatically purged.
• Consent records: retained in your browser for up to 12 months, after which the banner reappears and you are asked again.
• Aggregated analytics: retained for up to 26 months in anonymised, non-identifying form.
• Accounting and statutory records: retained for five years from the end of the relevant financial year, as required by Danish bookkeeping legislation.

8. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to: obtain confirmation of whether we process your personal data and receive a copy of it (access); have inaccurate data corrected (rectification); have data erased where one of the grounds in Article 17 applies (erasure); restrict processing in the circumstances set out in Article 18; receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller (portability); object at any time to processing based on legitimate interests, including profiling (objection); withdraw consent at any time without affecting the lawfulness of processing already carried out; and not be subject to decisions based solely on automated processing producing legal or similarly significant effects — a practice we do not engage in.

To exercise any right, email [email protected]. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority. In Denmark this is Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk. You may also complain to the authority in your own country of residence.

9. Rights for California and other US residents

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know the categories and specific pieces of personal information collected, the sources, the business purpose and the categories of third parties involved; to request deletion; to request correction; to opt out of the "sale" or "sharing" of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not process sensitive personal information for inferring characteristics. Requests may be submitted to [email protected] and will be verified by matching the request against the email address in our records. Authorised agents may submit requests with written proof of authorisation. Residents of other US states with comparable legislation may use the same channel.

10. Security measures

The site is served exclusively over HTTPS with modern TLS. Administrative access is limited to named personnel, protected by unique credentials and multi-factor authentication, and reviewed quarterly. Correspondence is stored in access-controlled mailboxes. We apply the principle of data minimisation at design stage, maintain a record of processing activities under Article 30 and operate a documented personal data breach procedure. In the event of a breach likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours and inform affected individuals without undue delay where the risk is high.

11. External links

Our hotel entries and journal articles link to third-party websites, including hotel operators, restaurant guides, transport authorities and tourism boards. We provide those links for verification and convenience. Once you follow a link, the destination site's own privacy policy governs; we have no control over and accept no responsibility for their practices.

12. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The effective date at the top of the page always reflects the current version. Where a change materially affects your rights we will place a notice on the homepage for at least thirty days. Continued use of the site after a change takes effect constitutes acknowledgement of the revised policy.