Data Protection

1. Introduction
   The protection of your personal data is important to us. This Privacy Policy explains how Heartbreak Escapes by BLACOON Retreats AS (hereinafter referred to as “we”, “us”, “our”) collects, processes and protects your data. This Privacy Policy applies to all services we provide as part of our memberships, in particular the Heartbreak Country Club.

2. Scope
   This Privacy Policy applies to all persons who use our services, including members of the Heartbreak Country Club and their guests.

3. Data Controller
   The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

   Heartbreak Escapes by
   BLACOON Retreats AS
   Erik Puzig
   Rondanevegen 518
   2670 Otta
   Norway
   Email: retreats@blacoon.com
   
   

4. Types of Data Collected
   We collect various types of personal data, including:

• Contact details (e.g. name, email address, telephone number)

• Payment information (e.g. credit card details, billing address)

• Data relating to the use of our services (e.g. booking history, stay details)

• Data relating to your preferences and interests (e.g. accommodation choices, feedback)

5. Purposes of Data Processing
   We use your personal data for the following purposes:

• Provision and management of our services (e.g. bookings, membership of the Heartbreak Country Club)

• Communication with you (e.g. to confirm bookings, respond to enquiries)

• Payment processing and invoicing

• Improvement of our services (e.g. by analysing your use of our services)

• Compliance with legal obligations

6. Legal Bases for Processing
   We process your personal data on the basis of the following legal grounds in accordance with the GDPR:

• Consent: Where you have given us your consent to process your data.

• Performance of a contract: Where processing is necessary for the performance of contracts we have entered into with you.

• Legal obligation: Where we are legally required to process your data.

• Legitimate interests: Where we have a legitimate interest in processing your data that is not overridden by your interests or fundamental rights.

7. Disclosure of Data
   We do not disclose your personal data to third parties unless this is necessary to provide our services or we are legally required to do so. In certain cases, it may be necessary to share your data with service providers (e.g. payment service providers).

8. Data Retention
   We retain your personal data only for as long as necessary for the purposes for which it was collected or as required by law. Once the applicable retention period has expired, your data will be securely deleted or anonymised.

9. Your Rights
   You have the right to contact us to exercise the following rights:

• Access to your stored personal data

• Rectification of inaccurate data

• Erasure of your data (under certain conditions)

• Restriction of the processing of your data

• Data portability

• Withdrawal of your consent to the processing of your data

To exercise these rights, please contact us using the email address provided above.

10. Security of Your Data
    We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse.

11. Changes to this Privacy Policy
    We reserve the right to amend this Privacy Policy. Any changes will be communicated to you in due time, and we will provide you with the updated version.

12. Jurisdiction and Applicable Law
    Although our registered office is located in Norway, this Privacy Policy is governed by the laws of the Federal Republic of Germany. The place of jurisdiction for all disputes arising out of or in connection with this Privacy Policy is Germany.

Last updated: 17 May 2026