Privacy notice

1. Who is the data controller?

OKSANA ART SOLBERG, organisation number 938 365 547, is the controller of the personal data described in this notice. The registered business address is Ringbanen 28, 7514 Stjørdal. The studio is located at Prinsens gate 34, 7011 Trondheim.

Questions about privacy or requests for access, correction or erasure can be sent to korolevaoksana13@gmail.com or raised by telephone on +47 405 56 777.

2. What information do we process?

• Enquiries: name, telephone number, email address, selected treatment area and anything you write in your message.
• Appointments and client administration: booking, agreed treatment, time, price, gift cards, payment and necessary correspondence.
• Technical data: IP address, time, requested page and basic browser and device information may be included in security and operational logs held by the website provider.
• Information needed for a safe individual assessment may be collected separately before treatment. Do not send sensitive health information through the contact form, ordinary email or WhatsApp.

3. Purposes and legal bases

• To answer questions, provide estimates and prepare or perform an agreement, we process data because it is necessary before entering into or for the performance of a contract, under Article 6(1)(b) GDPR.
• Information in supporting documents, payments and accounts is processed to comply with legal obligations under Article 6(1)(c) GDPR.
• Technical logs may be processed for secure operation, troubleshooting and protection against misuse on the basis of our legitimate interests under Article 6(1)(f) GDPR.
• If relevant health information must be processed before a cosmetic treatment, it is collected separately on the basis of explicit, informed consent under Article 9(2)(a) GDPR, unless another lawful basis applies.

4. Who may access the data?

We share data only when necessary to deliver or secure the service, process payment, comply with legal requirements, or when you choose to use an external service.

• Vercel provides hosting and may process technical request and security data.
• Web3Forms, provided by Web3Creative, receives, validates and forwards the information you submit through the contact form. Its sub-processors may also process your IP address and email address for spam and abuse prevention.
• Google provides the email service that receives forwarded enquiries. Google Maps loads only after you choose to display the map.
• Meta processes data when you choose to contact us through WhatsApp, Instagram or Facebook.
• Vipps and any accounting or payment providers process data necessary for payment and bookkeeping.

5. Transfers outside the EEA

Some technology providers may process data in countries outside the EEA. Web3Creative states that it operates from India and uses sub-processors in several regions. According to its Data Processing Agreement, the European Commission’s standard contractual clauses apply to transfers that require such a safeguard.

6. How long do we retain data?

• Enquiries that do not result in a client relationship are normally erased no later than 12 months after the last contact.
• Web3Forms states that form submission data may have a technical maximum retention period of three years. Submissions must therefore be reviewed and deleted from the service when no longer necessary, in line with the retention period above.
• Client correspondence and agreement information are retained for as long as necessary for follow-up and possible legal claims, normally no longer than three years after the client relationship ends unless the law requires otherwise.
• Accounting records are retained for the period required by bookkeeping rules, normally five years after the end of the financial year for primary documentation.
• Any health information is erased when no longer necessary for its purpose or when consent is withdrawn, unless further retention has another lawful basis.
• Technical security logs are retained only for as long as necessary for operation and security, according to the provider’s settings and retention periods.

7. Your rights

• You may request access to the personal data we hold about you.
• You may ask for inaccurate information to be corrected or for information to be erased where the relevant conditions are met.
• In certain circumstances, you may ask for processing to be restricted, object to processing or receive data in a structured format.
• You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
• You may complain to the Norwegian Data Protection Authority (Datatilsynet) if you believe personal data is being processed unlawfully.

8. Changes

This notice is updated when our processing of personal data or our services changes. The date at the top shows when the text was last updated.