Privacy Policy for Nordlys Tegnestudio

1. Introduction and company information

This Privacy Policy explains how Nordlys Tegnestudio collects, uses, stores, shares, and protects personal data when you visit our website, contact us, book services, or otherwise interact with us in connection with our drawing-studio activities.

The data controller is:

Nordlys Tegnestudio
Tollbugata 8, 0152 Oslo, Norway
Email: [email protected]
Phone: +47 23 45 67 89

We process personal data in accordance with applicable Norwegian privacy laws and the General Data Protection Regulation (GDPR), as relevant.

2. Data collection and processing

Nordlys Tegnestudio may collect and process the following categories of personal data:

Identification and contact information: name, email address, phone number, postal address, and similar details.
Booking and service information: appointment details, course registrations, commission requests, preferences, and communication history.
Payment-related information: billing details and transaction records, where applicable. Payment card details are typically processed by our payment service providers and are not stored by us unless necessary.
Technical data: IP address, browser type, device information, log data, and cookie-related information.
Content you provide: messages, feedback, images, reference material, and other information you choose to send to us.

We collect personal data directly from you, through our website, by email, by phone, in person, and through third-party service providers acting on our behalf.

3. Purpose of data processing

Nordlys Tegnestudio processes personal data for the following purposes:

to respond to inquiries and communicate with you;
to manage bookings, classes, workshops, and studio services;
to prepare and perform contracts and commissions;
to issue invoices, process payments, and maintain accounting records;
to provide customer support and handle complaints;
to improve our services, website, and user experience;
to comply with legal obligations, including accounting and record-keeping requirements;
to protect our rights, property, and safety, and to prevent misuse or fraud;
to send marketing communications where permitted and, where required, with your consent.

4. Legal basis for processing

We process personal data only when we have a valid legal basis. Depending on the context, our processing may be based on:

Performance of a contract: where processing is necessary to provide requested services, manage bookings, or carry out a commission.
Legal obligation: where processing is required to comply with applicable laws, such as accounting, tax, or record-keeping obligations.
Legitimate interests: where processing is necessary for our legitimate business interests, such as improving services, maintaining security, handling inquiries, and preventing misuse, provided that your interests and fundamental rights do not override those interests.
Consent: where you have given us clear consent, for example for certain marketing activities or optional cookies, and you may withdraw that consent at any time.

5. Data sharing and third parties

Nordlys Tegnestudio may share personal data with third parties only when necessary and appropriate for the purposes described in this Privacy Policy. These third parties may include:

IT and hosting providers;
email and communication service providers;
payment processors and financial service providers;
accountants, auditors, and professional advisers;
booking, customer management, and website analytics providers;
public authorities, where required by law or lawful request.

We require our service providers to handle personal data securely and only in accordance with our instructions and applicable law.

6. Data transfer to third countries

In some cases, personal data may be transferred to or accessed from countries outside Norway and the European Economic Area (EEA). If such transfers occur, Nordlys Tegnestudio will ensure that appropriate safeguards are in place, such as:

an adequacy decision by the relevant authorities;
standard contractual clauses or equivalent safeguards;
additional technical and organizational measures where necessary.

Where required by law, we will inform you about relevant transfer mechanisms.

7. Storage duration

Nordlys Tegnestudio retains personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods may vary depending on the type of data and the purpose of processing.

Customer and booking records: retained for the duration of the service relationship and for a reasonable period thereafter.
Accounting and tax records: retained for the period required by applicable law.
Marketing data: retained until you withdraw consent or object, where applicable.
Technical logs: retained for a limited period for security and operational purposes.

When personal data is no longer needed, we will delete, anonymize, or securely archive it in accordance with applicable requirements.

8. User rights

Subject to applicable law, you may have the following rights regarding your personal data:

Access: you may request confirmation of whether we process your personal data and obtain a copy of that data.
Rectification: you may request correction of inaccurate or incomplete data.
Erasure: you may request deletion of your data where legal grounds for retention do not apply.
Restriction: you may request that we limit processing in certain circumstances.
Data portability: you may request to receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
Objection: you may object to processing based on legitimate interests and, where applicable, to direct marketing.

To exercise your rights, please contact us using the details below. We may need to verify your identity before responding. We will respond within the time limits required by law.

9. Withdrawal of consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You may withdraw consent by contacting Nordlys Tegnestudio at [email protected] or by using any unsubscribe or preference-management option we provide.

10. Right to complain

If you believe that Nordlys Tegnestudio has processed your personal data in violation of applicable privacy laws, you have the right to lodge a complaint with the relevant supervisory authority. In Norway, this is the Norwegian Data Protection Authority (Datatilsynet).

We encourage you to contact us first so that we can try to resolve your concern directly and promptly.

11. Data security

Nordlys Tegnestudio implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures may include access controls, secure storage, encryption where appropriate, staff confidentiality obligations, and regular review of our security practices.

While we strive to protect your personal data, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

12. Contact information

If you have questions about this Privacy Policy or our processing of personal data, please contact: