Privacy Policy Last updated: 28.5.25.

1. Who We Are This Privacy Policy applies to Ponderosa Eiendom AS (org. no. 916797648) ("Ponderosa"), a Norwegian limited liability company with business address Tøttaveien 1, 8514 Narvik, Norway. We are the controller of your personal data when you interact with us through our website, when you use our digital services, or when you stay at one of our properties. Ponderosa is committed to protecting your privacy and handles your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws.

2. What This Policy Covers This policy describes: What personal data we collect and why How we use and store your data Your rights and how you can contact us This policy forms part of our broader terms, including our Reservation Terms, Website Terms, Cookie Policy, and any service-specific data policies you accept when using our services. By using our services or providing us with your personal data, you agree to the practices outlined in this policy. Where consent is required by law, we will seek it explicitly.

3. Personal Data We Collect We collect personal data only when necessary and for clear purposes. This may include: Contact details (name, email, phone, address) Identification and reservation information (IP address, payment information, travel dates, guest details) Account preferences (default language, login details) Special information you voluntarily provide (e.g. dietary needs, accessibility requirements, travel companions) Usage data and interaction history with our services We may also collect limited data from third parties when needed to confirm bookings or support our services.

4. Why We Collect Your Data We process your data to: Manage reservations and provide our services Communicate before, during, and after your stay (via email, SMS, or app) Improve our technology, services, and security Personalize your experience and present relevant offers Conduct analysis and improve operations Send marketing and service updates (only if permitted) You may opt out of marketing communication at any time by contacting us at: 📧 post@ponderosa.no

5. Legal Basis for Processing We rely on the following legal bases: Performance of a contract (e.g. booking a stay) Legal obligations (e.g. accounting) Consent (e.g. for marketing or storing optional details) Legitimate interest (e.g. to improve our services)

6. How and Where We Store Your Data We store your data securely within the EEA (European Economic Area) unless otherwise explicitly stated. If we use service providers outside the EEA, we ensure appropriate safeguards are in place. Data is only retained for as long as necessary to fulfill the purpose of collection, comply with legal requirements, or resolve disputes.

7. Sharing of Data We may share data with: Booking platforms (e.g., Airbnb, Booking.com) Service providers acting on our behalf (e.g. IT or payment providers) Legal authorities if required by law All partners and processors are contractually obligated to maintain confidentiality and protect your data.

8. Your Rights You have the right to: Access your personal data Correct inaccuracies Withdraw consent Request deletion (where legally possible) Object to processing or restrict use File a complaint with the Norwegian Data Protection Authority (Datatilsynet) To exercise your rights, contact us at: 📧 post@ponderosa.no 📍 Ponderosa Eiendom AS, Tøttaveien 1, 8514 Narvik, Norway

9. Children’s Privacy Our services are not directed to individuals under the age of 18. We do not knowingly collect data from children without appropriate consent.

10. Updates to This Policy We may update this Privacy Policy from time to time. All changes will be published on our website. We encourage you to check the policy periodically.