‹ SS Aurora

Privacy policy

Last updated 29 September 2026 · version 1.5

SS Aurora is hosted and organised by About Contrasts AS. This policy explains what personal data we collect when you visit ss-aurora.no, book an evening, receive our emails and use the show app at app.ss-aurora.no, why we collect it, how long we keep it and what your rights are. We collect as little as we can.

In short: we never sell your data. We use no advertising or tracking cookies and no third-party analytics. We only count your visit to the website if you tap OK. Allergy notes are deleted 30 days after your evening, and the show app asks for no real names. At the door we ask whether you agree to be photographed, and the camera at the table sees only the middle of the table and records nothing.

1. Who is responsible

The data controller is About Contrasts AS, organisation number 933576345, Tordenskiolds gate 12, 0160 Oslo, Norway, which hosts and organises SS Aurora (“About Contrasts”, “we”, “us”). For anything about your personal data, write to info@ss-aurora.no.

2. What we collect, why, and for how long

WhatWhy, and the legal basisHow long
Your booking: name, email address, mobile number, the evening, number of guests, price, booking reference, any cancellation, and the times of these steps. The version of our terms you accepted and when. For a booking made with a deposit under our earlier terms, also the deposit, whether it was paid and any refund. To handle your booking, send you messages about it, contact you if something changes, and keep accounting records; for a booking made with a deposit, also to have the Vipps request sent to your mobile number and to refund the deposit. Contract (GDPR art. 6(1)(b)); legal obligation under the Norwegian Bookkeeping Act (art. 6(1)(c)). Confirmed bookings: 6 years, to meet the 5-year bookkeeping rule. Reservations made with a deposit that was never paid: deleted 90 days after they were made.
Allergies and special notes you write when booking. To prepare your food and drinks safely. Allergies and health-related dietary needs are health data, so we only keep them with your explicit consent (art. 9(2)(a)), which you give with a separate box when booking and can withdraw by writing to us before the evening. Only the kitchen and the crew of your evening see them. Deleted 30 days after your evening.
A hold-limit code: a short code calculated from your connection’s IP address and your browser, using a secret that is replaced every day. To stop one person making more bookings than allowed. Legitimate interest in fair access to a small number of seats (art. 6(1)(f)). Stored with the booking. The daily secret is deleted, so after that day the code can no longer be linked to a connection.
Emails we send you: your confirmation, a reminder two days before your evening, and cancellation (and, for a booking made with a deposit, reservation received and deposit received). They contain your first name, booking reference, evening, number of guests, price, your mobile number, your allergy notes and private links to see or cancel your booking. To tell you about your booking. Contract (art. 6(1)(b)). We send no newsletters or marketing emails. In our email provider’s delivery logs for the period they set.
Visit statistics, only if you tap OK: the page, how far you scrolled the film, which buttons you pressed, the website or campaign you came from, your approximate country, region and city (worked out from your IP address by our hosting provider), device type and browser family, and a visitor code calculated from your IP address and browser with a secret that changes every day. We do not store your IP address or your full browser details. Our staff may get a short notification of a new visit showing the approximate city, country, device and where the visit came from. To understand how people find and use the website. Your consent (art. 6(1)(a)). You can withdraw it at any time with “Privacy choices” at the foot of every page. About 13 months (400 days), then deleted.
Staff login protection: the IP address of attempts to log in to our staff console. To stop password guessing. Legitimate interest in security (art. 6(1)(f)). Deleted within a day.
The show app on your evening: the seat code in your QR code, the crew name printed on your place card (not your real name), the profession you choose, whether you would like to be a saboteur, the role you are given, your votes, your game actions and progress, and any message you write. The app does not ask for your name, email address or phone number. To run the interactive show you booked. Contract (art. 6(1)(b)) and legitimate interest in running the evening (art. 6(1)(f)). Deleted when the show system is reset for the next evening. Messages you write are kept for your evening only. Your chronicle card is drawn on your own phone and never uploaded.
Photos at your evening, and your answer at the door: when you check in we ask whether you agree to be photographed by our photographer. We keep your name, your answer (yes or no), your signature, the evening, your seat and which version of the question you answered. If you say yes, you may appear in the pictures. To photograph only the guests who agreed, and to use the pictures on our website, on Instagram and in other promotion for SS Aurora and About Contrasts, and to share them with the guests of your evening. Your consent (art. 6(1)(a)), which you can withdraw at any time by writing to us. We keep your answer and signature to be able to show what you agreed to (art. 7(1)). Pictures: for as long as we use them in our promotion. After you withdraw, we use no pictures of you in anything new and take down what we can. Your answer and signature: 5 years after your evening, then deleted.
The camera at the table: during the show, the camera of the cockpit iPad looks at the strip down the middle of the table, so the projection can answer a hand moved over a seat. It is set up to see only that strip. To run the interactive show you booked. Legitimate interest in running the evening (art. 6(1)(f)). The picture is used on the iPad as it happens, to notice movement over each seat; no one is identified. Nothing is kept. The picture is never recorded, stored or sent anywhere.
Technical data: when you use the website or the app, our hosting provider processes your IP address, browser details and the addresses you visit. To deliver the pages and keep the service secure. Legitimate interest (art. 6(1)(f)). Kept briefly in our hosting provider’s logs.
When you write to us: your email address and message. To answer you. Legitimate interest, or contract when it is about your booking. As long as the matter needs, and no longer than 12 months after it is closed, unless it forms part of the accounting records.

What other guests can see during the show

Your crew name, your profession, your game progress, which station you are watching and the result of any vote (including if you are voted out) are visible to the other guests on their phones and on the screens in the room, and the TV may show your game screen with your crew name. Your saboteur role and your answer to the saboteur question are seen only by you and the captain. Votes are counted in secret.

3. Who sees your data, and who processes it for us

Inside About Contrasts, only the people who run SS Aurora see booking details: the crew who handle bookings, and the kitchen and crew of your evening, who see your allergy notes and seat. We never sell personal data, and we only give it to public authorities when the law requires it.

4. Transfers outside Europe

Some of these providers are based in the USA or may process data there. Such transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

5. Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting what was done before. Write to info@ss-aurora.no; we answer within one month. Some data we must keep for accounting even if you ask us to delete it.

You can also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

6. Automated decisions

We make no automated decisions with legal or similar effects about you. The saboteur roles in the game are drawn at random among guests who volunteer, as part of the game only.

7. Children

The evening is for guests aged 20 and over. We do not knowingly collect personal data about anyone under 20.

8. Security

All connections are encrypted. Your booking page and your seat in the show app open only with private codes, seat codes expire after the evening, and only our staff can reach booking details.

9. Changes

We may update this policy, and we will show the date of the latest version here. See also our cookie policy and terms and conditions.