Privacy notice

1. Contact address

Address: c/o Arjeta Topallaj, Kjølberggaten 51B, 1654 Sellebakk, Norway.

2. Registration and accounts

The existing solution handles login information and a customer profile with contact details. Profiles may contain name, email, phone and an optional profile picture. Accounts do not require date of birth, home address or national identification number. Profiles and order/ticket history are separate from login accounts; closing an account does not automatically erase all history.

3. Orders, payments and tickets

When sales are later activated, the solution will process event, ticket category, quantity, price, currency, order reference and status, plus payment reference and status. The existing integration uses Vipps; this page does not open live sales. Tickets have identifiers and QR codes without directly identifying data. Admission checks record results. This history can be linked to a purchase and is not necessarily anonymous.

4. Customer service

The form processes category, name, email, message, language and optional order reference. Messages enter the existing service inbox; the form does not activate automatic email replies. Do not include passwords, QR codes, payment secrets or sensitive personal information.

5. Purposes and legal bases

Account and login data provide access to your account. Once sales open, order, payment and ticket data will fulfil purchases, deliver tickets and verify admission. Where processing is necessary for your contract or steps you request before purchase, GDPR Article 6(1)(b), contractual necessity, is relevant.

Customer service uses contact details and messages to answer enquiries and handle claims. Contractual necessity may apply to necessary contract-related enquiries. Records retained under specific legal duties require an identified legal obligation under Article 6(1)(c). Security logs and misuse prevention may be assessed under Article 6(1)(f) only where a documented balancing assessment supports processing. Mentioning these provisions does not make every activity lawful; the final basis for each purpose is not confirmed.

Marketing is separate from accounts, purchases and admission and requires its own valid basis and consent where required by law. Consent under Article 6(1)(a) must be freely given, specific and withdrawable. Accepting sales terms is not marketing consent.

6. Consents and logs

The solution records consent choices and the terms version accepted at purchase. Security and audit logs support checks and accountability. Marketing requires a separate lawful basis. A consent choice is not automatically consent to other purposes.

7. Providers and transfers

The documented solution uses Lovable Cloud for hosting, customer data, login and storage. Fonts are loaded from Google Fonts, so the browser sends IP addresses and request details to Google. Vipps is integrated as the planned payment provider and will receive necessary payment details when payments open. The provider may have its own duties and privacy terms; the role for the specific service must be clarified. Complete recipient roles, agreements, subprocessors, processing countries and any EEA transfer safeguards are not confirmed. We therefore do not guarantee that all processing takes place within the EEA.

8. Retention and deletion

Login accounts and customer/purchase history are stored separately. Closing the login account therefore does not automatically delete all customer, order, ticket or log data. No general automatic history purge is documented. Deletion requests are assessed against the data, purpose and any statutory retention duties; immediate deletion is not promised. Actual retention periods and purpose-based deletion routines are not confirmed and must be clarified before the notice is final.

9. Your rights and complaints

You may request access and correction and, where applicable, deletion, restriction or portability, or object to processing. Consent may be withdrawn without affecting earlier lawful processing. Contact info@albanights.com. My ALBANIGHTS also records access, anonymisation and account-closure requests. A recorded request is not a completed deletion. Statutory response deadlines apply. You may complain to the Norwegian Data Protection Authority.

10. Browser storage and security

The an_locale cookie stores your language for up to one year. Login uses local browser storage to maintain the session; this is not a promised retention period for customer history. Session storage an-stale-reload prevents repeated automatic page reloads after errors and lasts for the browser session. Staff tools also store local event drafts and support sidebar_state with a seven-day duration. Google Fonts entails external network requests. A complete assessment of any other tracking and consent requirements is not confirmed. Access controls and staff two-factor authentication do not guarantee protection against every security incident.