Privacy Statement (EU)

This privacy statement was last updated on January 21st, 2026 and applies to citizens and legal permanent residents of the European Economic Area and Switzerland.

In this privacy statement, we explain what we do with the data we obtain about you via https://cityboxhotels.com. We recommend that you carefully read this statement. In our processing, we comply with the requirements of privacy legislation. That means, among other things, that:

We clearly state the purposes for which we process personal data. We do this by means of this privacy statement;
We aim to limit our collection of personal data to only the personal data required for legitimate purposes;
Where required by law, we obtain your consent before processing personal data.
We take appropriate security measures to protect your personal data and require this from parties that process personal data on our behalf;
We respect your right to access your personal data or have it corrected or deleted, at your request.

If you have any questions or want to know exactly what data we keep from you, please contact us.

We may collect or receive personal information for several purposes connected with our business operations which may include the following:

1.1 Contact – Through phone, e-mail, post and/or webforms

For this purpose, we may process the following personal data:

First and last name
Email address
Telephone number
IP Address
Approximate location data

Legal basis
Processing is based on our legitimate interest in responding to inquiries or, where applicable, on the performance of a contract or your consent.

Retention period
Personal data is retained for as long as necessary to handle the inquiry and for a reasonable period thereafter, unless a longer retention period is required by law.

1.2 Payments

For this purpose, we may process the following personal data:

First and last name
Address details
Email address
Telephone number
Payment-related information
IP address
Approximate location data

Legal basis
Processing is necessary for the performance of a contract and for compliance with legal obligations, including accounting and financial regulations.

Retention period
Payment-related data is retained for as long as required under applicable accounting and financial legislation.

1.3 Registrering an account

For this purpose, we may process the following personal data:

First and last name
Email address
Telephone number
IP address
Approximate location data

Legal basis
Processing is necessary for the performance of a contract or based on your consent, depending on how the account is used.

Retention period
Personal data is retained for as long as the account remains active and for a reasonable period thereafter, unless deletion is requested or required by law.

1.4 Newsletters

For this purpose, we may process the following personal data:

First and last name
Email address
Approximate location data

Legal basis
Processing is based on your consent.

Retention period
Personal data is retained until you withdraw your consent or unsubscribe from the newsletter.

1.5 To support services or products that a customer wants to buy or has purchased

For this purpose, we may process the following personal data:

First and last name
Email address
Telephone number
IP address
Approximate location data

Legal basis
Processing is necessary for the performance of a contract and for our legitimate interest in delivering and supporting services requested by the customer.

Retention period
Personal data is retained for as long as necessary to fulfil the service and comply with applicable legal obligations.

1.6 Identity verification during check-in

To check in to our hotels, guests are required to present a valid government-issued identity document. We may scan or record information from the document in order to verify the guest’s identity and register the stay.

For this purpose, we may process the following personal data:

First and last name
Date of birth
Nationality
ID document number
Image or scan of the ID document (where applicable)

Legal basis

Processing is necessary for the performance of a contract (the hotel stay) and for our legitimate interest in ensuring the safety and security of our guests, preventing fraud, and verifying guest identity. In some cases, processing may also be necessary to comply with legal obligations applicable to accommodation providers.

Retention period

Identity verification data, including scanned ID documents where applicable, is stored for up to three (3) months after check-out, after which it is securely deleted unless a longer retention period is required by law.

1.7 Compiling and analyzing statistics for website improvement

For this purpose, we may process the following personal data:

IP address
Information about website usage and interactions
Approximate location data

Legal basis
Processing is based on our legitimate interest in improving our website and services or, where required by law, on your consent (e.g. through cookies).

Retention period
Personal data is retained for as long as necessary for analysis and improvement purposes, in accordance with applicable retention policies.

We share personal data with service providers (data processors) that process data on our behalf, as well as with third parties that act as independent data controllers. Where required, we obtain consent before such sharing, for example through our cookie banner.

2.1 Data processors

Citybox AS uses the following data processors to deliver its services:

Name: Mews
Country: European Union
Purpose: Property management system (PMS), bookings, check-in, payments, and hotel operations

Name: Lighthouse
Country: European Union
Purpose: Booking engine and reservation management

Name: Bookboost
Country: Sweden
Purpose: Guest communication and chat services

Name: Mailchimp
Country: United States
Purpose: Email marketing and newsletters

Name: Usercentrics
Country: Germany
Purpose: Consent management (cookie banner and user consent handling)

Name: Google Tag Manager
Country: Ireland
Purpose: Management and deployment of website tags and tracking scripts

Name: Google Cloud
Country: European Union / United States
Purpose: Hosting and infrastructure services

Name: Playable
Country: Denmark / European Union
Purpose: Hosting and operation of interactive marketing campaigns (e.g., contests and gamified experiences), including the collection of user data (such as name and email) and transfer to integrated systems (e.g., Mailchimp)

2.2 Third-party marketing and analytics partners (independent data controllers)

These third parties may collect and process personal data (such as IP address, device information, and user behavior) for their own purposes, including advertising, measurement, and optimization. This processing typically takes place only with your consent.

Name: Google (Google Analytics 4 & Google Ads)
Country: Ireland / United States
Purpose: Analytics, statistics, and advertising

Name: Meta Platforms Ireland Ltd.
Country: Ireland
Purpose: Advertising and conversion tracking (Meta Pixel)

Name: TikTok Technology Limited
Country: Ireland
Purpose: Advertising and conversion tracking (TikTok Pixel)

Name: LinkedIn Ireland Unlimited Company
Country: Ireland
Purpose: Advertising and conversion tracking (LinkedIn Insight Tag)

Name: TradeTracker
Country: European Union
Purpose: Affiliate tracking, attribution, and marketing performance measurement

Name: Tradedoubler
Country: European Union
Purpose: Affiliate marketing, conversion tracking, and campaign optimization

2.3 Communication services

Name: WhatsApp Business (Meta Platforms)
Country: Ireland / United States
Purpose: Customer communication and messaging

Our website uses cookies. For more information about cookies, please refer to our Cookie Policy

We disclose personal information if we are required by law or by a court order, in response to a law enforcement agency, to the extent permitted under other provisions of law, to provide information, or for an investigation on a matter related to public safety.

If our website or organization is taken over, sold, or involved in a merger or acquisition, your details may be disclosed to our advisers and any prospective purchasers and will be passed on to the new owners.

We are committed to the security of personal data. We take appropriate security measures to limit abuse of unauthorized access to personal data. This ensures that only the necessary persons have access to your data, that access to the data is protected, and that our security measures are regularly reviewed.

This privacy statement does not apply to third-party websites connected by links to our website. We cannot guarantee that these third parties handle your personal data in a reliable or secure manner. We recommend that you read the privacy statements of these websites prior to making use of these websites.

We reserve the right to make amendments to this privacy statement. It is recommended that you consult this privacy statement regularly to be aware of any changes. In addition, we will actively inform you wherever possible.

Your rights

Under applicable data protection legislation, including the GDPR, you have the following rights in relation to your personal data:

Right of access – You have the right to request access to the personal data we process about you.
Right to rectification – You have the right to request correction of inaccurate or incomplete personal data.
Right to erasure – You have the right to request deletion of your personal data, where permitted by law.
Right to restriction of processing – You have the right to request that the processing of your personal data be restricted in certain circumstances.
Right to data portability – You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible.
Right to object – You have the right to object to processing based on legitimate interests. We will comply unless there are compelling legitimate grounds for the processing.
Right to withdraw consent – Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights or if you have any questions regarding our processing of personal data, please contact us at gdpr@cityboxhotels.com . We may request additional information to verify your identity before fulfilling your request.

If you believe that our processing of your personal data does not comply with applicable data protection legislation, you have the right to lodge a complaint with the relevant supervisory authority.

If you are not satisfied with the way in which we handle (a complaint about) the processing of your personal data, you have the right to submit a complaint to the Data Protection Authority.

Citybox AS

Nygårdsgaten 23, 5015 Bergen

Norway

Website: https://cityboxhotels.com

Email: gdpr@cityboxhotels.com

Phone number: +47 55 31 25 00