Privacy Policy for Nordlys Matstudio AS

This privacy policy explains how Nordlys Matstudio AS collects, uses, stores, shares, and protects personal data when you use our services, visit our premises, contact us, or otherwise interact with us. Nordlys Matstudio AS is the data controller for the processing of personal data described in this policy.

1. Introduction and company information

Nordlys Matstudio AS operates a cooking studio business and provides cooking classes, culinary events, private bookings, team-building activities, and related services. We process personal data in connection with bookings, customer communication, payments, marketing, website use, and the operation of our business.

Data controller: Nordlys Matstudio AS

Address: Torggata 15, 0181 Oslo, Norway

Email: [email protected]

Phone: +47 23 45 78 19

2. Data collection and processing

Nordlys Matstudio AS may collect and process the following categories of personal data:

• Identification and contact information: name, email address, phone number, billing address, and other contact details.
• Booking and service information: reservations, participation details, preferences, dietary requirements, allergies, event details, and communication related to classes or events.
• Payment information: payment status, transaction references, and limited payment-related information processed through payment providers. We do not store full card details unless necessary and lawfully permitted through our payment processor.
• Communication data: inquiries, feedback, complaints, and correspondence by email, phone, or contact forms.
• Website and technical data: IP address, browser type, device information, log data, cookies, and usage statistics.
• Marketing preferences: consent choices and communication preferences for newsletters or promotional messages.
• Special categories of data: in limited cases, dietary restrictions, allergies, or health-related information may be processed if you provide it to us in connection with a booking or event. We process such information only when necessary and with appropriate safeguards.

We collect personal data directly from you, from your employer or group organizer when relevant, from payment providers, booking systems, website analytics tools, and other service providers involved in delivering our services.

3. Purpose of data processing

Nordlys Matstudio AS processes personal data for the following purposes:

• to manage bookings, registrations, and participation in cooking classes and events;
• to communicate with customers, participants, and business contacts;
• to handle payments, invoicing, refunds, and accounting obligations;
• to tailor services to dietary needs, allergies, and other relevant preferences;
• to provide customer support and respond to inquiries;
• to send newsletters, offers, and marketing communications where permitted;
• to improve our services, website, and customer experience;
• to comply with legal obligations, including accounting, tax, and record-keeping requirements;
• to prevent fraud, misuse, and security incidents;
• to establish, exercise, or defend legal claims.

4. Legal basis for processing

Nordlys Matstudio AS processes personal data on the following legal bases, as applicable under Norwegian privacy law and the GDPR:

• Performance of a contract: when processing is necessary to provide booked services, manage participation, or take steps at your request before entering into a contract.
• Legal obligation: when processing is necessary to comply with accounting, tax, consumer, or other legal requirements.
• Legitimate interests: when processing is necessary for our legitimate business interests, such as service improvement, customer communication, security, and fraud prevention, provided that your interests and fundamental rights do not override those interests.
• Consent: when we rely on your consent, for example for certain marketing communications, cookies where required, or processing of sensitive dietary or health-related information in specific situations.

Where processing of special categories of personal data is necessary, we will only do so where a valid legal basis applies and appropriate safeguards are in place.

5. Data sharing and third parties

Nordlys Matstudio AS may share personal data with trusted third parties where necessary for the purposes described in this policy. These may include:

• payment service providers;
• booking and reservation system providers;
• IT, hosting, and cloud service providers;
• email and communication service providers;
• accountants, auditors, and legal advisers;
• marketing and analytics providers;
• public authorities where required by law.

We only share personal data to the extent necessary and ensure that third parties are subject to appropriate confidentiality and data processing obligations where required.

6. Data transfer to third countries

Nordlys Matstudio AS primarily processes personal data within Norway and the EEA. If personal data is transferred to a country outside the EEA, we will ensure that the transfer is carried out in accordance with applicable law and that appropriate safeguards are in place, such as an adequacy decision, standard contractual clauses, or other lawful transfer mechanism.

7. Storage duration

Nordlys Matstudio AS stores personal data only for as long as necessary for the purposes for which it was collected, or as required by law. The storage period depends on the type of data and the purpose of processing.

• Booking and customer data: retained for the duration of the customer relationship and for a reasonable period thereafter.
• Accounting and invoice data: retained for the period required by applicable accounting and tax laws.
• Marketing data: retained until you withdraw consent or object, unless we have another lawful basis to retain it.
• Communication records: retained as long as needed to handle your inquiry or for legal protection.
• Technical logs and security data: retained for a limited period necessary for security, troubleshooting, and system administration.

When personal data is no longer needed, it will be deleted or anonymized in a secure manner.

8. User rights

Subject to the conditions and limitations set out in applicable law, you have the following rights regarding your personal data processed by Nordlys Matstudio AS:

• Access: you may request confirmation of whether we process your personal data and obtain a copy of that data.
• Rectification: you may request correction of inaccurate or incomplete personal data.
• Erasure: you may request deletion of your personal data in certain circumstances.
• Restriction: you may request that processing be restricted in certain situations.
• Data portability: you may request to receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Objection: you may object to processing based on legitimate interests and to processing for direct marketing.

To exercise your rights, please contact Nordlys Matstudio AS using the contact details provided below. We may need to verify your identity before responding to your request.

9. Withdrawal of consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

If you withdraw consent, Nordlys Matstudio AS will stop the relevant processing unless there is another lawful basis for continuing it.

10. Right to complain

If you believe that Nordlys Matstudio AS has processed your personal data in violation of applicable privacy laws, you have the right to lodge a complaint with the competent supervisory authority in Norway.

You may also contact us directly so that we can address your concerns and attempt to resolve the matter.

11. Data security

Nordlys Matstudio AS takes appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction. These measures may include access controls, secure storage, encryption where appropriate, staff confidentiality obligations, and regular review of our security practices.

While we strive to protect personal data, no system can be guaranteed to be completely secure. We therefore encourage you to use caution when sharing personal information and to contact us if you suspect any misuse of your data.

12. Contact information

If you have questions about this privacy policy or the processing of your personal data, please contact:

Nordlys Matstudio AS
Torggata 15, 0181 Oslo, Norway
Email: [email protected]
Phone: +47 23 45 78 19

13. Changes to privacy policy

Nordlys Matstudio AS may update this privacy policy from time to time to reflect changes in our services, legal requirements, or processing practices. The updated version will be published when applicable, and the date of the latest revision may be indicated if used by us.

We encourage you to review this privacy policy periodically to stay informed about how Nordlys Matstudio AS processes personal data.