Privacy policy
Min Lilla Salong is responsible for the information you provide when booking an appointment. This page explains what we store, why, for how long — and what you can require.
Who is responsible
M&W Holding AS (Min Lilla Salong), org. no. 938 170 533, Damhauggata 11, 1772 Halden · post@mwbeautycollective.no · 936 27 989
What we store, and why
| Information | Why | Legal basis |
|---|---|---|
| Name, phone and email | Carrying out the appointment, sending confirmation and reminder | Our agreement with you |
| Booking history | Being able to see what was done before, and running the salon | Our agreement with you and legitimate interest |
| Payment and refund records | Handling prepayment and refunds | Our agreement with you and accounting obligations |
| Contact and course enquiries | Answer your questions and follow up your request | Steps before a contract at your request, or a legitimate interest in responding |
| Technical logs and consent choices | Keep the website secure, troubleshoot and remember your choices | Legitimate interest in secure operation and recording consent |
We never ask for health information, and it must not be entered into any field in the solution.
How long
The booking system runs a clean-up every night. Retention periods are 36 months for inactive customer data, 36 months after an appointment for booking history, 36 months after the last change for notes, 36 months for notification logs and 36 months for consent and audit logs. Customer records with future appointments are retained. Appointments linked to payments, claims and statutory retention duties are reviewed separately. Email accounts, messaging providers and backups have separate deletion procedures; cleaning up the booking system does not delete these copies. Contact us to request access or deletion.
Who can see them
Authorised salon staff have access. Kodebruket AS may have necessary access for operation, troubleshooting and support. The server is hosted by Hetzner in Finland. Email notifications are sent through Brevo, SMS through Twilio, and the salon's email accounts are hosted by Domene AS. They act as processors for their respective tasks. When Vipps is offered, the payment service also processes information under its own legal obligations and privacy notice.
Brevo stores email data in France, Germany and Belgium. Twilio's SMS service uses the Ireland region. Support, subcontractors and telecom operators for the messaging services may involve processing outside the EEA, including the USA and India. Any transfer must have a valid basis, such as an adequacy decision or standard contractual clauses with necessary supplementary measures. Contact the salon for information about recipients and a copy of the relevant safeguards.
Your rights
- Find out what we have stored about you, and get a copy
- Have anything incorrect corrected
- Have information we no longer need deleted
- Request restriction, object to processing and request data portability where the conditions apply
- Withdraw consent without affecting the lawfulness of earlier processing
- Opt out of reminders about a new appointment
- Complain to the Norwegian Data Protection Authority if you believe we are doing something wrong
Contact the salon. You will receive a response without undue delay and normally within one month. If the law permits more time for your case, we will explain why and notify you of the extension within the first month. Access is normally free of charge.