Last updated: 12 September 2026
Sandbech Holding AS, organisation number 938 462 666, Tyren 1, 2165 Hvam, Norway ("Sipio", "we" or "us") provides the Sipio service. We are the controller for personal data we process to administer our own service and customer relationship, as described below.
For privacy questions or to exercise your rights, contact us at privacy@sipio.no.
We process personal data only where it is necessary for a specific purpose and we have a lawful basis.
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and administering customer and user accounts, providing access to the service and communicating about it | name, email address, login and account information, organisation/role, and communications with us | necessary to enter into or perform a contract with the customer/user, or our legitimate interest in securely and effectively administering the service |
| Customer support, troubleshooting, and preventing misuse or security incidents | enquiries, technical logs, and information needed to investigate an issue | our legitimate interest in operating, securing, and improving the service |
| Complying with legal obligations | information necessary for the relevant obligation | legal obligation |
We may also ask for consent for a specific processing activity. Where consent is used, it may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing already carried out.
When an organisation uses Sipio to manage bookings, events, or guests, that organisation will normally be the controller for information it enters or collects through the service. Sipio then processes that information on the organisation's behalf and documented instructions as processor.
If you are a guest or booker, please contact the relevant organisation for information about why your information is processed and to exercise your rights. We assist the organisation where necessary under the data processing agreement or applicable law.
Access is limited to people who need it for the purpose and to suppliers providing necessary services for us, such as operations, authentication, payments, communications, or support. Suppliers may process data only under contract and instructions where relevant.
If personal data is transferred outside the EEA, we will use a valid transfer mechanism and appropriate safeguards. You may request further information about such transfers by contacting us.
We retain data only for as long as necessary for the purpose for which it was collected, to perform the agreement, handle claims, or meet legal obligations. When data is no longer necessary, it is deleted or anonymised in an appropriate manner. Customer-controlled booking data is deleted or returned in accordance with the agreement with the customer and the applicable data processing agreement.
Depending on the processing, you have rights of access, rectification, erasure, restriction, portability, and objection. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe the processing breaches data-protection law. More information is available at https://www.datatilsynet.no.
We may update this Privacy Notice when the service, processing, or law changes. The current version will be published on this page with an updated date.