Privacy policy

Who controls your data

The controller of personal information collected through norvellos.com is Aristocrat Technologies Australia Pty Ltd, Building A, Pinnacle Office Park, 85 Epping Road, North Ryde NSW 2113, AU. Contact for privacy matters: privacy@norvellos.com.

What we collect

• Details every browser transmits: IP address, user agent (browser and device type), pages viewed and referring page.
• Approximate geolocation at city or region level, inferred from the IP address. We do not collect precise location.
• Contact-form data: the name, email address, topic and message that land in our inbox when you write.
• The cookie decision you make, which sits in browser storage on your device.

Why we use it

• Keeping norvellos online and protected (necessary).
• Analytics, with your consent: to understand in aggregate which pages are read.
• Marketing and affiliate tracking, with your consent: to let partner networks attribute a booking to a referral link.
• To answer messages you send us.

Legal bases under the GDPR: legitimate interests for security and running the site, consent for analytics and advertising/affiliate cookies, and steps at your request when replying to you.

Who receives it

Hosting and analytics vendors process data on norvellos's instructions, and referral partners and affiliate networks receive it only once you have agreed. Once you are on a hotel website, its own policy takes over. We do not sell personal information for money. Some providers may process data outside Australia or your country; where that happens we rely on contractual safeguards such as standard contractual clauses.

Retention periods

Raw server logs roll off after 90 days. Aggregated analytics reports are deleted after 26 months at most. Email threads stay open while a question is live, then up to 24 months more. Your cookie choice is kept in your browser for 12 months.

Australian Privacy Act 1988

Because the publisher is an Australian company, norvellos follows the Australian Privacy Principles (APPs) set by the Privacy Act 1988. Under those principles you can see, and have us fix, anything we keep on you. Suspect a breach of the APPs? Tell privacy@norvellos.com; a reply should follow inside 30 days. Still unhappy afterwards? Escalate to the national regulator, whose acronym OAIC stands for Office of the Australian Information Commissioner, through oaic.gov.au.

Rights under the GDPR

Readers covered by EU, EEA or UK data law can ask for access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent at any time. A data protection regulator where you live will also hear complaints.

Rights under the CCPA/CPRA

California residents can ask to know what personal information we collect and why, to delete or correct it, and to refuse the sale or sharing of their details for cross-context behavioural advertising. norvellos reads a Global Privacy Control signal as that refusal and keeps advertising/affiliate storage off. Exercising them never costs you access to any norvellos page.

Children

The guide is written for adults (18+). Should a person under 18 have emailed norvellos, a note from a parent or the young person gets that message erased.

Changes

Each revision of this policy is dated at the foot of the page. Questions: privacy@norvellos.com.