Skip to content
Gurman
+4793648007 book@gurman.no
Legal

Privacy Policy

Last updated: June 2026

1. Data controller

Gurman
Dronningensgate 37, 7012 Trondheim
Email: book@gurman.no
Phone: +4793648007

We are the data controller for personal data collected through this website. We collect minimal data and never sell or share your information with third parties for marketing purposes.

2. What we collect and why

Contact and booking forms

When you submit a contact or booking form, we collect your name, email address, and the content of your message. This is processed on the basis of legitimate interest (GDPR Art. 6(1)(f)) in order to respond to your enquiry. We forward the message to our email host (Domene AS, Norway) and delete or archive the content once the enquiry has been resolved, normally within 12 months.

IP address (security)

To protect our forms against abuse, we use automatic rate limiting. Your IP address is stored temporarily in a Redis database (Upstash) for a maximum of one hour, after which it is automatically deleted. Legal basis: legitimate interest in protecting the service against attacks (GDPR Art. 6(1)(f)).

Map

The website displays an interactive map via Leaflet and OpenStreetMap. Map tiles are fetched from OpenStreetMap Foundation (UK) servers, which means your IP address is sent to them as part of a normal HTTP request. We do not set any tracking cookies in connection with the map.

Images

Some images on this site — placeholder photography shown until the restaurant uploads its own — are loaded from Unsplash. When such an image loads, your IP address is sent to Unsplash as part of a normal HTTP request. We set no tracking cookies in connection with these images.

Server logs

The website is hosted on Vercel. Like all web hosts, Vercel stores standard server logs (IP address, requested URL, timestamp) for operational security and debugging. See Vercel's own privacy policy for details and retention periods.

3. Data processors

We use the following sub-processors that handle personal data on our behalf:

  • Domene AS — email hosting and delivery for contact forms (Norway)
  • Sanity — content management system for menu, images, and site content, which may include staff names and photos (Sanity AS, Norway; data hosted in EU/USA, SCCs)
  • Upstash Redis — rate limiting, stores IP for max 1 hour (USA, SCCs)
  • Vercel — web hosting and server logs (USA/EU, SCCs)
  • OpenStreetMap Foundation — map tiles, IP address when map loads (UK, adequacy decision)
  • Unsplash — placeholder/stock images, IP address when an image loads (Getty Images, USA; SCCs)

Transfers to the USA are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).

4. Your rights

You have the right to:

  • Access (Art. 15) — request a copy of the data we hold about you
  • Rectification (Art. 16) — have inaccurate data corrected
  • Erasure (Art. 17) — request that your data be deleted
  • Restriction (Art. 18) — request that processing be restricted
  • Objection (Art. 21) — object to processing based on legitimate interest
  • Portability (Art. 20) — receive your data in a machine-readable format

Send requests to book@gurman.no. We will respond within 30 days.

You may also lodge a complaint with Datatilsynet if you believe we are processing your data in breach of the GDPR.

5. Cookies

This website sets no tracking or marketing cookies. We use no analytics tools such as Google Analytics, Facebook Pixel, or similar services. No cookie consent banner is required for the functionality on this site.

6. Changes

We may update this policy as needed. The date at the top of the page shows when it was last revised. Significant changes will be announced on the website.