This privacy notice explains how and why The Well AS (“The Well”) collects and processes personal data.
The Well, represented by its General Manager, is the data controller for personal data collected and processed by The Well. In practice, responsibility may be delegated to another role. This privacy notice provides the information we are required to give under applicable data protection laws about how we process your personal data. The Well processes personal data in accordance with the data protection laws in force at any given time.
LEGAL BASIS FOR PROCESSING PERSONAL DATA
Personal data may only be processed when there is a valid legal basis for doing so. This may include the data subject’s consent, a contract, a legal obligation, or a legitimate interest pursued by us as the data controller that outweighs the data subject’s right to privacy.
The legal basis for processing depends on its purpose. Processing personal data related to bookings and stays is necessary to perform our contract with you. Marketing is based either on consent or, where the relevant conditions are met, on an existing customer relationship in accordance with the Norwegian Marketing Control Act. In some cases, processing may be based on legitimate interests.
HOW WE USE PERSONAL DATA
We collect and process personal data so that we can fulfil our agreements with employees, including managing employment relationships, and with guests, including managing customer relationships. This may include providing good service and informing you about our products and services through marketing activities. We use personal data for marketing based either on consent or, where the relevant conditions are met, on an existing customer relationship. You can opt out of this communication at any time.
Our facilities offer a range of modern, tailored treatments and activities. When you visit The Well, we record your visit. The same applies when you book treatments or a table at one of our restaurants.
We analyse how our facilities are used so that we can improve our offering to guests. We may also use information about purchases, stays and use of our services, in aggregate, to understand guest preferences and improve our communication and offerings. We may use data for analysis and segmentation to better understand different guest groups and tailor our offerings and communication. If you have consented to receive communication from us, this information may also be used to personalise the communication you receive. This processing is carried out on a valid legal basis and with respect for your rights.
The information we record includes your name, date of birth, telephone number, email address, postal address and purchase history. We collect this information directly from you. We use your date of birth to verify your age during your stay and, for those who have consented to receive communication from us, to send messages on occasions such as birthdays.
Digital advertising
If you have consented to digital advertising, we may use your contact details to tailor advertisements on digital platforms. This may involve matching your data with advertising platforms such as Meta, Google, Schibsted and Amedia so that we can show you relevant advertisements. We only do this with your explicit consent. You can withdraw your consent at any time.
DISCLOSURE OF PERSONAL DATA AND USE OF THIRD PARTIES
We treat personal data confidentially. Only people who need access to it for work purposes can access our personal data records. As a general rule, we do not share personal data with anyone outside The Well.
In some situations, however, we may share personal data with our partners, such as Facebook or Google. See the section on cookies. Sharing personal data with a third party is a form of processing and requires a legal basis. This will generally be your consent, so you will be informed when your data is shared. Please note that in some cases we may be legally required to disclose your personal data.
We use various system providers to manage customer relationships, communication and analysis, including a CRM system, a marketing platform and a data warehouse. These providers process data on our behalf under data processing agreements and in accordance with applicable data protection laws. Our system providers include Salesforce, Braze and Google Cloud Platform.
COOKIES AND PIXELS
We use cookies on our website. A cookie is a small text file. Our website asks your browser to store the cookie on your device so that we can remember your actions, preferences and how often you have visited our website. This helps us provide you with better access to various features. We also use cookies to collect statistics about what is ordered and how our website is used.
There are two types of cookies. First-party cookies are necessary for the website to function.
Third-party cookies are used for analytics and marketing and may involve our partners. A pixel is a piece of code on our website that allows us to track conversions from online advertisements. This helps us tailor our external advertising based on our users’ actual interests and make it more relevant to them. We currently use Google Tag Manager, Google Analytics and Hotjar for these analytics and marketing purposes.
Active consent is required for cookies that are not strictly necessary for the website to function. You can change or withdraw your consent at any time through our cookie settings. You can also choose not to accept cookies there. For information on how to manage cookies in your browser, please refer to your browser’s help page.
STORAGE AND DELETION OF PERSONAL DATA
We do not disclose your personal data to others unless there is a legal basis for doing so. This may typically be an agreement with you or a legal obligation requiring us to provide the information.
All personal data processing we carry out takes place within the EU/EEA.
How long we store personal data depends on the purpose of the processing and the applicable legal basis.
Data related to bookings and stays is stored for as long as necessary to fulfil the agreement and meet legal obligations, including accounting requirements.
Data processed on the basis of consent is stored until you withdraw your consent or the purpose for processing the data no longer applies.
Data processed on the basis of an existing customer relationship is stored for as long as further contact remains relevant. It is deleted or anonymised when the purpose for processing no longer applies.
If you withdraw your consent to the processing of personal data, we will stop processing your data on that basis. This does not affect the lawfulness of processing carried out before you withdrew your consent.
YOUR RIGHTS
You have the right to request access to, correction of and deletion of your personal data, unless we are required to retain it. You may also request restriction of processing and the transfer of your personal data to you or another organisation (data portability). In addition, you may ask us to stop processing your personal data, for example by withdrawing your consent.
If you ask to exercise one or more of these rights, we will comply within one month of receiving your request, unless we are legally required to do otherwise. You can send requests to privacy@thewell.no.
If you believe that we have breached data protection laws, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Please contact us at privacy@thewell.no if you have any comments or would like more information about how we process your personal data.
CCTV SURVEILLANCE
To maintain security, prevent crime and protect our guests, employees and property, we use CCTV surveillance in large parts of our premises. The recordings are stored for seven days and processed by a third party in accordance with applicable data protection laws.
Purpose of surveillance: CCTV surveillance is used solely for security purposes and to help ensure a safe experience for everyone on our premises.
Storage and access: Recordings are stored for seven days. Access is restricted to authorised personnel.
Your rights: You have the right to request access to recordings that include you. You may also request the correction or deletion of inaccurate information, in accordance with applicable data protection laws.
For more information about our use of CCTV surveillance, please contact us at post@thewell.no.
PROCESSING PERSONAL DATA IN BUSINESS RELATIONSHIPS (B2B)
In addition to the personal data we process about our guests and website users, we also process information about contact persons at our partners, suppliers, business customers and other organisations with which we have a relationship.
PURPOSE
We process this information to manage and follow up on business relationships, enter into and fulfil agreements, handle communication, invoicing and deliveries, and manage any press or marketing collaborations.
PERSONAL DATA WE PROCESS
We may process information such as names, job titles, email addresses, telephone numbers, employers and any correspondence or other information necessary for the collaboration.
LEGAL BASIS
Processing is based on legitimate interests under GDPR Article 6(1)(f), as it is necessary to manage ongoing business relationships and communication between the parties. In some cases, such as signing agreements, processing may also be necessary to perform a contract under Article 6(1)(b).
RETENTION PERIOD
We retain information related to business relationships for as long as the collaboration continues. We delete or anonymise it when it is no longer needed for that purpose, usually within three years after the collaboration ends, unless other laws require us to retain it for longer, for example, accounting legislation.
YOUR RIGHTS
Contact persons have the same rights as other data subjects under data protection laws, including the right to access, correct, restrict or delete their personal data and the right to object to its processing.
Last updated: 19 October 2026