Privacy notice

Who is responsible

Until a Vandrer company is registered, Mark John Puglisi, founder of the Vandrer project in Oslo, Norway, is responsible for the personal information described in this notice. Privacy enquiries and requests can be sent to privacy@flyvandrer.com. If responsibility transfers to a registered Vandrer company, this notice will be updated with the company name, organisation number and registered address, and affected people will be informed where required.

What this notice covers

This notice covers flyvandrer.com and its prelaunch forms: Route Lab, future origins, Field Notes, Founding Circle interest, company and institutional enquiries, future leadership expressions, the passenger-journey demonstration and data-rights requests.

Vandrer uses submissions for private internal planning. Individual responses and personally linked information are not made public, are not sold as personal data, and are not shared with destination partners. Vandrer may publish sufficiently aggregated trends that do not identify a person, household, company contact or candidate.

Route Lab

We collect the destination selected, your email address, language, submission and verification times, the source page, the exact consent version accepted, and optional travel period, party size and price preference if you supply them.

We use this to verify the submission, prevent duplicate counting and understand potential demand from the intended Oslo starting point. The legal basis is consent. A route submission is never added to Field Notes unless separate newsletter consent is given.

Future origins

We collect the European origin suggested, destinations wanted from it, optional travel frequency, an optional contact email, language, verification data and the consent record. This is kept separate from Oslo Route Lab submissions and does not mean Vandrer has selected or committed to another base. The legal basis is consent.

Field Notes

We collect the email address, language, confirmation history, consent version and unsubscribe history needed to operate the subscription. Field Notes uses confirmed opt-in: nothing is sent until the confirmation link is used. The legal basis is consent. Subscribing is optional and is never required to vote, contact Vandrer or express Founding Circle interest.

Passenger-journey demonstration

If you ask to receive the fictional messages of a demonstration journey by email, we collect your email address, language, the scenario and the fictional journey choices you made on the page, the source page, submission and verification times, minimised abuse-control data and the consent record. The messages are sent once, after verification. The request is never a booking and never a subscription: it does not add you to Field Notes or any marketing list. The legal basis is consent.

Founding Circle interest

We may collect your name and email, country and city, preferred departure point, the indicative amount you might consider paying in future, benefits of interest, preferred participation, an optional explanation, language, verification history and the consent record.

This is a free and non-binding expression of future interest. It is not a purchase, membership, deposit, donation, investment, ticket, booking, travel credit or reservation. No payment information is collected. The legal basis is consent, and price-band answers are never merged with unrelated records. Nobody who expresses interest is named publicly by default; any public recognition of an early supporter would require your separate, explicit permission, asked for individually.

Company and institutional enquiries

We may collect organisation information and the name, role, business contact details and message of its representative. An organisation may also send a non-binding letter of interest by email; there is no file upload on this site. We use this only to assess and respond to the enquiry, keep an appropriate business record and explore a possible future relationship.

The legal basis for personal contact information is taking steps requested by the person or organisation, together with Vandrer's legitimate interest in managing genuine business enquiries. Submitting an enquiry is not consent to receive general marketing.

Future leadership and postholder expressions

Through the Build Vandrer form we collect name, email, country and city, the role area of interest, availability, a short summary of relevant experience, optional links to professional profiles, language, verification history and the consent record. A CV or letter reaches us only if you choose to email one; there is no file upload on this site. We use this only to assess and respond to possible future professional involvement.

Submitting information does not constitute a job application to an existing airline, an offer of employment, a regulatory nomination or an appointment. The legal basis is taking steps at your request together with Vandrer's legitimate interest in assembling a future qualified team. Keeping a profile in a longer-term talent pool requires separate consent. Please do not submit passport copies, medical information, criminal records, national identity numbers or other sensitive documents.

Technical and security information

The hosting system may process IP address, request time, page, browser information and minimised abuse-control data for security, troubleshooting, verification, rate limiting and preventing duplicate or manipulated submissions. The legal basis is Vandrer's legitimate interest in a secure, reliable website.

Automated verification, deduplication and abuse controls may decide whether a signal is counted, but Vandrer does not make automated decisions producing legal or similarly significant effects about individuals, and does not build marketing profiles.

Data-rights requests

Information supplied in a privacy request is used to identify the relevant records, respond securely and demonstrate compliance. The legal basis is compliance with legal obligations. We may ask for proportionate verification, but we do not routinely request identity documents.

Providers and access

Information may be accessed only by authorised Vandrer personnel and by the providers needed to host, protect, back up and operate the site and its email. Domene AS currently provides hosting and email infrastructure in Norway. Vandrer does not sell personal information and does not give personally linked voter, subscriber, member, company or candidate information to commercial partners.

How long we keep information

We apply the following retention schedule. Withdrawal is honoured immediately, and we keep only the minimal evidence that a consent existed and was withdrawn.

• Unverified submissions and expired verification tokens: deleted after 7 days.
• Verified route, future-origin and Founding Circle signals: deleted or irreversibly aggregated after 24 months without renewed interaction, or earlier following a valid withdrawal.
• Field Notes subscription: retained while subscribed; sending stops immediately after unsubscribe.
• Closed company enquiries: normally deleted 24 months after the last substantive contact, unless an active negotiation or legal obligation requires longer.
• Future-leadership records: normally deleted after 6 months; retained up to 12 months only where separate talent-pool consent has been given.
• Ordinary server logs: normally deleted after 30 days.
• Security-incident records: retained only for the period reasonably necessary to investigate and document the incident.
• Privacy requests and minimal consent or withdrawal evidence: retained only as long as needed to demonstrate compliance and honour suppression requests.

Your rights

Depending on the circumstances, you may request:

• Access to your personal information.
• Correction of information that is wrong.
• Erasure of your information.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Withdrawal of a consent you have given.
• Data portability, where applicable.

Withdrawing consent does not make earlier lawful processing unlawful. Requests can be made through the data-request form on the contact page or to privacy@flyvandrer.com. You may also complain to Datatilsynet, the Norwegian Data Protection Authority.

Cookies and analytics

Vandrer sets no advertising cookies, no cross-site tracking and no optional analytics storage. The only thing stored in your browser is the cookie choice you make, so that you are not asked again on every page. If this ever changes, this notice will be updated first and any legally required consent mechanism implemented.

Security

Vandrer uses proportionate technical and organisational safeguards, including access controls, single-use verification tokens, rate limiting and monitoring. No internet service can promise absolute security.

Changes to this notice

Material changes are given a new effective date, shown as the last-updated date on this page. Where required, people will be notified or asked for new consent. Questions about this notice: privacy@flyvandrer.com.