Privacy policy

1. Who is responsible for your data

Gavathe Eiendom AS (org. no. 928110192, Frognerveien 1, 2016 Frogner, Norway) is the data controller for the personal data processed through Book1Room, the booking platform used to let and manage its rooms.

For any privacy question you can reach us at hei@book1room.com.

2. What data we collect

When you apply for a room and during your tenancy we collect: your name, email address, phone number, your date of move-in and a short introduction; a photo of your identity document and the name read from it by an automatic check (OCR); your Norwegian national ID or D-number where needed for the tenancy contract; and your employer if you choose to share it.

While you are a tenant we also process your invoices, payments, advance balance, electricity reconciliations, notices, check-in/out photos and the messages you exchange with us through the platform.

For security we process a 6-digit login code sent to your email and a trusted-device cookie, as well as your preferred language.

3. Why we use it and our legal basis

We use your data to assess your application, to create and manage your tenancy and to communicate with you (performance of a contract, and steps taken at your request before it).

We issue invoices and keep accounting records to comply with Norwegian law (legal obligation). We use login codes and trusted-device checks to keep your account secure (legitimate interest).

We do not use your data for advertising and we do not sell it.

4. Payments and card data

Card payments are handled by Stripe. Your full card details are entered on Stripe's secure page and are never stored by us — we only keep a payment reference and the payment status.

5. Sign in with Google (optional)

If you choose to sign in with Google, Google shares your name, email address and profile picture with us so we can create or access your account. We request only basic profile and email information. You can always use an email and password instead.

6. Who processes data on our behalf

We use carefully chosen providers who process data only on our instructions: Supabase (database, authentication and encrypted storage of your documents, hosted in the EU), Stripe (payments), Tripletex (accounting and invoicing, Norway), our email provider for transactional email, Google (only if you sign in with Google) and our hosting provider. Your ID documents are kept in a private store accessible only to authorised staff.

7. How long we keep it

We keep your tenancy data for as long as you have an active application or tenancy with us, and afterwards only as long as needed to settle the relationship. Accounting records (invoices and payments) are kept for the period required by Norwegian bookkeeping law. Identity documents are deleted once they are no longer needed for the tenancy.

8. Your rights

You have the right to access the personal data we hold about you, to correct it, to ask us to delete it, to restrict or object to its use, and to receive a copy in a portable format — within the limits of our legal obligations.

To exercise any of these, email hei@book1room.com. If you believe we handle your data incorrectly you may complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

9. Cookies

We use only the cookies needed to run the service: a session cookie that keeps you signed in and a trusted-device cookie that remembers a browser you have verified, so you are not asked for a login code every time. We do not use advertising or tracking cookies.

10. Changes

We may update this policy as the service evolves. The date below shows when it was last changed.