Privacy Statement (EU)

This privacy statement was last updated on January 21st, 2026 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.

In this privacy statement, we explain what we do with the data we obtain about you via https://cityboxhotels.com. We recommend that you carefully read this statement. In our processing, we comply with the requirements of privacy legislation. That means, among other things, that:

• We clearly state the purposes for which we process personal data. We do this by means of this privacy statement;
• We aim to limit our collection of personal data to only the personal data required for legitimate purposes;
• Where required by law, we obtain your consent before processing personal data.
• We take appropriate security measures to protect your personal data and require this from parties that process personal data on our behalf;
• We respect your right to access your personal data or have it corrected or deleted, at your request.

If you have any questions or want to know exactly what data we keep from you, please contact us.

We may collect or receive personal information for several purposes connected with our business operations which may include the following:

1.1 Contact – Through phone, e-mail, post and/or webforms

For this purpose, we may process the following personal data:

• First and last name
• Email address
• Telephone number
• IP Address
• Approximate location data

Legal basis
Processing is based on our legitimate interest in responding to inquiries or, where applicable, on the performance of a contract or your consent.

Retention period
Personal data is retained for as long as necessary to handle the inquiry and for a reasonable period thereafter, unless a longer retention period is required by law.

1.2 Payments

For this purpose, we may process the following personal data:

• First and last name
• Address details
• Email address
• Telephone number
• Payment-related information
• IP address
• Approximate location data

Legal basis
Processing is necessary for the performance of a contract and for compliance with legal obligations, including accounting and financial regulations.

Retention period
Payment-related data is retained for as long as required under applicable accounting and financial legislation.

1.3 Registrering an account

For this purpose, we may process the following personal data:

• First and last name
• Email address
• Telephone number
• IP address
• Approximate location data

Legal basis
Processing is necessary for the performance of a contract or based on your consent, depending on how the account is used.

Retention period
Personal data is retained for as long as the account remains active and for a reasonable period thereafter, unless deletion is requested or required by law.

1.4 Newsletters

For this purpose, we may process the following personal data:

• First and last name
• Email address
• Approximate location data

Legal basis
Processing is based on your consent.

Retention period
Personal data is retained until you withdraw your consent or unsubscribe from the newsletter.

1.5 To support services or products that a customer wants to buy or has purchased

For this purpose, we may process the following personal data:

• First and last name
• Email address
• Telephone number
• IP address
• Approximate location data

Legal basis
Processing is necessary for the performance of a contract and for our legitimate interest in delivering and supporting services requested by the customer.

Retention period
Personal data is retained for as long as necessary to fulfil the service and comply with applicable legal obligations.

1.6 Compiling and analyzing statistics for website improvement

For this purpose, we may process the following personal data:

• IP address
• Information about website usage and interactions
• Approximate location data

Legal basis
Processing is based on our legitimate interest in improving our website and services or, where required by law, on your consent (e.g. through cookies).

Retention period
Personal data is retained for as long as necessary for analysis and improvement purposes, in accordance with applicable retention policies.

We only share personal data with data processors that process data on our behalf and with other third parties where a valid legal basis applies, including where consent is required.

Data processors

Citybox AS uses the following data processors to deliver its services:

Name: Mews
Country: European Union
Purpose: Property management system (PMS), bookings, check-in, payments, and hotel operations

Name: Lighthouse
Country: European Union
Purpose: Booking engine and reservation management

Name: Google
Country: Ireland
Purpose: Marketing, analytics, and statistics

Name: Hotjar Ltd
Country: Malta
Purpose: Analysis of website usage and user experience

Name: Meta
Country: Ireland
Purpose: Marketing and advertising

Name: Bookboost
Country: Sweden
Purpose: Guest communication and chat services

Our website uses cookies. For more information about cookies, please refer to our Cookie Policy.

We disclose personal information if we are required by law or by a court order, in response to a law enforcement agency, to the extent permitted under other provisions of law, to provide information, or for an investigation on a matter related to public safety.

If our website or organization is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

We are committed to the security of personal data. We take appropriate security measures to limit abuse of unauthorized access to personal data. This ensures that only the necessary persons have access to your data, that access to the data is protected, and that our security measures are regularly reviewed.

This privacy statement does not apply to third-party websites connected by links to our website. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We recommend that you read the privacy statements of these websites prior to making use of these websites.

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly to be aware of any changes. In addition, we will actively inform you wherever possible.

Your rights

Under applicable data protection legislation, including the GDPR, you have the following rights in relation to your personal data:

• Right of access – You have the right to request access to the personal data we process about you.
• Right to rectification – You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure – You have the right to request deletion of your personal data, where permitted by law.
• Right to restriction of processing – You have the right to request that the processing of your personal data be restricted in certain circumstances.
• Right to data portability – You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible.
• Right to object – You have the right to object to processing based on legitimate interests. We will comply unless there are compelling legitimate grounds for the processing.
• Right to withdraw consent – Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights or if you have any questions regarding our processing of personal data, please contact us at gdpr@cityboxhotels.com . We may request additional information to verify your identity before fulfilling your request.

If you believe that our processing of your personal data does not comply with applicable data protection legislation, you have the right to lodge a complaint with the relevant supervisory authority.

 

If you are not satisfied with the way in which we handle (a complaint about) the processing of your personal data, you have the right to submit a complaint to the Data Protection Authority.

Citybox AS

Nygårdsgaten 23, 5015 Bergen

Norway

Website: https://cityboxhotels.com

Email: gdpr@cityboxhotels.com

Phone number: +47 55 31 25 00