Privacy Policy
v1.2 · Last updated: 21 October 2026
Version 1.2 adds how reviews and the guide’s QR email sign-up are handled (Section 3). Updated 21 Oct 2026: how we count visits without cookies. Current version (v1.3) · Previous version (v1.1)
1. Controller
Panion Norge AS, org. no. 937 759 614, with its registered business address at Tønsnesvegen 14, 9020 Tromsdalen, Norway, is the data controller for the personal data processed via panion.travel. Contact: hello@panion.travel.
In this Privacy Policy, “Panion”(or “we”, “us”, “our”) refers to Panion Norge AS. “Panions” refers to the individual travel guides and local experts who promote and sell activities through the panion.travel platform.
Our use of cookies and similar technologies is described in our Cookie Policy.
We count visits to our sites without cookies for every visitor. If you are in the EU/EEA, UK or Switzerland and have not accepted cookies, nothing is stored on your device. Instead we create a temporary code from your IP address, browser type and the site, mixed with a random value that changes and is deleted every day, so we cannot recognise you on another day. We never store your IP address. With this we record pages viewed, steps in the booking process, bookings, your country and region, and your device type. Google Analytics and Google Ads receive cookieless signals without identifiers until you accept. Meta, Microsoft Clarity and chat tools only run after you accept. You can change your choice at any time with “Cookie settings” in the footer. Outside Europe, analytics and advertising are on by default. US visitors can use “Do not share my data”, and we honour Global Privacy Control everywhere.
På norsk: Vi teller besøk på nettstedene våre uten informasjonskapsler for alle besøkende. Hvis du er i EU/EØS, Storbritannia eller Sveits og ikke har godtatt informasjonskapsler, lagres ingenting på enheten din. I stedet lager vi en midlertidig kode av IP-adressen din, nettlesertypen og nettstedet, blandet med en tilfeldig verdi som byttes ut og slettes hver dag, slik at vi ikke kan kjenne deg igjen en annen dag. Vi lagrer aldri IP-adressen din. Slik registrerer vi hvilke sider som vises, steg i bestillingsprosessen, bestillinger, land og region og hvilken type enhet du bruker. Google Analytics og Google Ads mottar signaler uten informasjonskapsler og uten identifikatorer til du godtar. Meta, Microsoft Clarity og chatverktøy kjører først etter at du har godtatt. Du kan endre valget ditt når som helst med «Cookie settings» nederst på siden. Utenfor Europa er analyse og annonsering slått på som standard. Besøkende i USA kan bruke «Do not share my data», og vi respekterer Global Privacy Control overalt.
We take your privacy seriously and have taken several steps to ensure that we give you clear information about how we process your data and what rights you have. If you feel that something is unclear or missing, please do not hesitate to contact us at hello@panion.travel.
2. What personal data we process and why
We process personal data for the following purposes, on the following legal bases:
| Category of data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone | Process and confirm bookings; send booking-related communication | Art. 6(1)(b) - performance of contract |
| Payment information (handled by SagaPay, our payment service provider; we receive limited transaction data) | Process payment | Art. 6(1)(b) |
| Account/login data for Panions and Activity Providers | Provide platform accounts | Art. 6(1)(b) |
| Bank account details (Panions/Providers) | Pay out commission/settlement | Art. 6(1)(b) and (c) - contract and legal obligations (bookkeeping) |
| IP address, device, usage data | Security, analytics, fraud prevention | Art. 6(1)(f) - legitimate interest |
| Referral identifier (which Panion's link/QR you arrived through), processed via Bókun | Attribute commission to the correct Panion; report sales to Panions | Art. 6(1)(a) - consent (cookie); Art. 6(1)(b)/(f) - performance of contract with the Panion / our legitimate interest in correct commission settlement |
| Approximate location | Show relevant activities | Art. 6(1)(a) - consent |
| Guide's QR email sign-up: name, email address, the departure you chose and your marketing choice | Match you to your booking so your guide knows who you are; let your guide or the tour operator send you photos and practical information from the tour; ask for a review after the tour; with your consent, travel tips and offers from the tour operator | Art. 6(1)(f) - legitimate interest; Art. 6(1)(a) - consent for travel tips and offers |
| Reviews: first name, rating, review text, the email address the review request was sent to, the tour and date | Ask for, publish and check reviews; tell you when the tour operator replies | Art. 6(1)(f) - legitimate interest |
| Marketing communications (if any) | Send offers and newsletters | Art. 6(1)(a) - consent (cf. markedsføringsloven § 15) |
| Account, transaction and payout data for Providers and Panions | Verify identity, prevent fraud, assess compliance with our Terms, decide on suspension or termination of accounts, and manage withholding or release of funds | Art. 6(1)(b) - performance of contract; Art. 6(1)(c) - legal obligations (anti-money laundering, tax, accounting); Art. 6(1)(f) - legitimate interest in protecting the Platform, Customers and Panion Norge AS from fraud and misuse |
| Accounting records | Comply with bookkeeping legislation | Art. 6(1)(c) - bokføringsloven |
Providing certain personal data (such as name, contact details and payment information) is necessary to enter into and perform the booking contract with you; if you do not provide it, we may be unable to process your booking or provide an account. Where we rely on legitimate interests (Art. 6(1)(f)), we have carried out a balancing assessment, and you may object to such processing (see Section 8).
3. Reviews and the guide's QR email sign-up
The guide’s QR email sign-up. On some tours your guide shows a QR code. If you scan it, you can give us your name and email address and choose the departure you are on. You can also tick a box to receive travel tips and offers from the tour operator; it is never ticked for you, and each person signs up for themselves. We use your name and email address to match you to the booking on that departure so your guide knows who you are, so your guide or the tour operator can send you photos and practical information from the tour, and to ask for a review after the tour. Your guide and the tour operator can see your name and email address, and the tour operator can copy or download the list of email addresses collected on its tours. The tour operator is an independent controller of any copy it takes, and keeps it under its own privacy policy. If you ticked the box, it is the tour operator that sends you travel tips and offers.
Review requests. After a tour, we email the guest who booked it through Panion, and each guest who signed up with the guide’s QR code, to ask how it went. If you do not reply, we send one reminder about a week later. These emails contain no marketing, and you are free to ignore them.
What we collect when you leave a review. Your first name, your rating, your review text, the email address the review request was sent to, and the tour and date you are reviewing. If you booked through a Panion, you can also rate the Panion who recommended the tour.
Where your review is shown.Your first name, rating, review text and the date of the review are shown on the tour’s page on panion.travel, with the country recorded on your booking, if there is one. The tour operator sees your review in Oracle (its Panion dashboard), may show it on its own websites, and can reply to it publicly. When the operator replies, we email you at the address the review request was sent to. We never publish your email address. A review of 1 or 2 stars is checked before it is published, and we may remove a review on the grounds set out in How reviews work. We use an AI service provider (Anthropic) to write a short summary of a tour’s published reviews; it receives the ratings and review texts only, not your name or email address.
Legal basis.We ask for a review after your own booking or sign-up, and publish the review you choose to write, on the basis of our legitimate interest in helping travellers choose tours and helping operators improve them (Art. 6(1)(f)). The sign-up itself is processed on the same basis. If you ticked the box for travel tips and offers, that is based on your consent (Art. 6(1)(a)). You can withdraw it at any time by using the unsubscribe link in the tour operator’s emails, by contacting the tour operator, or by writing to hello@panion.travel.
How long we keep it. We delete your sign-up 60 days after the tour, and the review link in our emails stops working then. Some data is kept longer. If you leave a review, we keep it, with your first name, the tour and date and the email address the review request was sent to, for as long as the review is published: we need the email address to tell you when the operator replies and to check that a request about the review comes from you. When you ask us to remove your review, we delete it, including your email address. If we take a review down on one of the grounds in How reviews work, we keep it as a record of that decision for no longer than we keep booking and customer service data (see Section 7). If you ticked the box for travel tips and offers, we keep your name and email address, with a record of your consent, as marketing data (see Section 7).
Changing or removing your review. To have your review corrected or removed, write to hello@panion.travel, if possible from the email address the review request was sent to. You can also use the rights described in Section 8.
4. Sources of data
We collect personal data directly from you when you use the Platform, make a booking, or create an account. If you sign up with a guide’s QR code or write a review, we collect the data you give us there. We may also receive data from SagaPay (payment processing), Bókun (booking and referral tracking), and referring Panions (referral identifiers linked to their unique links or QR codes).
5. Recipients and processors
To operate the platform efficiently and securely, we share personal data with the following categories of recipients where necessary:
- SagaPay (payment processing)
- Bókun ehf.(a TripAdvisor company) – booking management and referral/affiliate tracking. Established in Iceland (EEA); may use sub-processors within the TripAdvisor group, including in the United States.
- Google Analytics and Google Ads(statistics and ad measurement) – cookieless signals without identifiers until you accept, the rest subject to consent (see Section 1)
- Meta Pixel(marketing measurement) – subject to consent
- Cloud hosting providers (e.g. AWS / Vercel / Google Cloud)
- Email service providers (e.g. Mailchimp / SendGrid)
- Customer support / chatbot tools
- AI service provider(Anthropic) – summaries of published reviews (ratings and review texts only)
- Activity Providers– we share only the data necessary to perform the booking (typically name, email, phone, booking details), the reviews of their tours, and the name and email address you give through the guide’s QR sign-up
- Panions– aggregated/non-identifying booking information and commission reports (generated by Bókun)
- Public authorities where required by law
Where required under GDPR Article 28, we enter into data processing agreements with recipients acting as our processors.
Not all recipients act as our processors. For data collected via the Meta Pixel, Panionand Meta Platforms Ireland Ltd. act as joint controllers under GDPR Article 26. Bókun ehf. (a TripAdvisor company) may act as an independent controller for processing carried out for its own and the TripAdvisor group’s purposes. Activity Providers act as independent controllers for the customer data they receive to deliver the activity.
6. Transfers outside the EEA
Some of our processors are located outside the EEA (typically in the United States). Such transfers are based on the EU Commission’s Standard Contractual Clauses and, where applicable, certification under the EU-US Data Privacy Framework. You may request a copy of relevant safeguards by contacting hello@panion.travel.
7. Storage periods
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable law. Our standard retention periods are as follows:
- Booking and customer service data: kept for as long as necessary to process bookings and handle complaints, typically up to 3 years after the activity.
- Accounting records: 5 years after the end of the financial year (cf. bokføringsloven § 13).
- Marketing data: until you withdraw consent or object.
- Account data for Panions/Providers: until the account is closed, plus a reasonable retention period.
- Documentation related to suspension, termination or withholding decisions: typically 3–5 years, in line with applicable limitation periods.
- Analytics data: anonymised or deleted within 14 months.
- Guide’s QR email sign-up: deleted 60 days after the tour. If you leave a review or ticked the box for travel tips and offers, the data described in Section 3 is kept longer.
- Reviews, including the email address the review request was sent to: for as long as the review is published, or until you ask us to remove it (see Section 3).
8. Your rights (GDPR Art. 15–22)
Under GDPR Articles 15–22, you have the following rights in relation to your personal data:
- Access– you may request a copy of the personal data we hold about you.
- Rectification– you may ask us to correct inaccurate or incomplete data.
- Erasure– in certain circumstances you may ask us to delete your personal data.
- Restriction– you may ask us to restrict the processing of your data in certain circumstances.
- Objection– where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing; we will then assess your objection and respond promptly.
- Portability– where processing is based on consent or contract, you may ask us to transfer your data to you or to another controller in a structured, commonly used and machine-readable format.
- Withdraw consent– where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at hello@panion.travel. We will respond within 30 days.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with Datatilsynet (www.datatilsynet.no) or the supervisory authority in your country of residence within the EEA. We hope, however, that you will contact us first so that we can try to resolve the matter for you.
9. Automated decision-making
We may use automated tools to help detect fraud, misuse and breaches of our Terms (for example, in connection with account suspension or the withholding of funds). Decisions that produce legal effects concerning you or similarly significantly affect you are not based solely on automated processing; they are subject to human review before they take effect. You have the right to obtain human intervention, to express your point of view, and to contest such a decision by contacting hello@panion.travel.
10. Security
We apply industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include encryption of data in transit, strict access controls, and regular security reviews. We require all processors and other recipients who handle personal data on our behalf to maintain equivalent standards of data security.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The latest version is always available on panion.travel. We encourage you to review this page periodically.