PRIVACY POLICY

Cabina AS ("Cabina", "we", "us", or "our") operates a skin clinic and online retail store at cabina.no, offering treatments, consultations and skincare products at our premises in Trondheim and online. In the course of providing these services we collect and process personal information about our clients, online customers, newsletter subscribers and website visitors. We handle all personal information in accordance with the EU General Data Protection Regulation (Regulation 2016/679, the "GDPR") as implemented in Norway by the Personal Data Act (Personopplysningsloven) and other applicable laws. This Privacy Policy explains how we collect, use, share, and protect personal information.

1. Data Controller

Name: Cabina AS Registered office: Thomas Angells gate, 7011 Trondheim, Norway Org. nr: 952 365 460

Contact: post@cabina.no

2. Who This Policy Applies To

This Privacy Policy applies to the following individuals:

  • Clients who book or receive treatments at our clinic, including skin analyses and consultations

  • Customers who purchase products through our online shop

  • Recipients and purchasers of Cabina gift cards

  • Subscribers to our newsletter and marketing communications

  • Visitors to cabina.no and users of our contact and booking forms

  • Job applicants and candidates who submit applications to us

3. Personal Information We Collect

3.1 Clinic Clients

  • Name, date of birth, address, telephone number, email address

  • Skin condition, treatment history, allergies and other information relevant to providing safe and effective treatment (this constitutes health data — see section 4.5)

  • Photographs taken for documentation of treatment results, where you have given separate written consent

  • Appointment history, no-show records, and notes from your therapist

  • Payment information processed by our payment providers (we do not store card data ourselves)

3.2 Online Shop Customers

  • Name, billing and delivery address, telephone number, email address

  • Order history, product preferences, returns and complaints

  • Payment information processed by Stripe and Vipps (we do not store card data ourselves)

  • Account credentials if you create a Cabina account

3.3 Newsletter Subscribers

  • Name and email address

  • Preferences expressed when subscribing

  • Engagement data such as which emails you have opened and links you have clicked, used to make our newsletter more relevant

3.4 Website Visitors

  • Information submitted through contact and booking forms (e.g. name, email, phone, message content)

  • Technical data collected through cookies and similar technologies, such as IP address, browser type, device type, language preference, pages visited, and time spent on the site (see section 12)

3.5 Gift Card Buyers and Recipients

  • Buyer's name, email and payment information

  • Recipient's name and email (digital cards) or postal address (physical cards)

  • Personal message you choose to attach to the gift card

4. Purposes of Use

We use personal information for the purposes set out below, on the legal bases indicated.

4.1 Providing Treatments and Clinical Services

  • Booking, confirming, rescheduling and cancelling appointments

  • Performing safe and appropriate skin treatments and consultations

  • Maintaining client records as required by law and good practice

  • Following up after treatment and arranging recurring care

Legal basis: performance of a contract (GDPR Art. 6(1)(b)), with explicit consent for health data (Art. 9(2)(a)), and compliance with legal obligations under Norwegian retention rules.

4.2 Operating Our Online Shop

  • Processing and fulfilling orders, including shipping, returns and complaints

  • Handling payments through Stripe, Vipps and other payment providers

  • Providing customer service and order updates

  • Detecting and preventing fraud

Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with bookkeeping obligations (Art. 6(1)(c)).

4.3 Marketing and Newsletter

  • Sending newsletters, treatment news, seasonal offers and product launches

  • Personalising marketing communications based on your interests and purchase history

  • Inviting you to clinic events

  • Sending birthday offers and reactivation messages

Legal basis: your consent (Art. 6(1)(a) and Marketing Control Act § 15). You may withdraw consent at any time using the unsubscribe link in every email or by contacting us.

4.4 Website Operation and Improvement

  • Operating, maintaining and securing cabina.no

  • Responding to enquiries received through our forms

  • Improving site functionality and user experience

  • Detecting and preventing unauthorised access

Legal basis: legitimate interests (Art. 6(1)(f)) in operating a functional and secure website, and consent for non-essential cookies (ePrivacy Directive and Norwegian Ekomloven).

4.5 Handling of Health Data

When you receive a treatment or consultation at Cabina, we may record information about your skin condition, medical history or other matters that are relevant to safe treatment. This is considered health data and a special category of personal data under GDPR Article 9. We process such information only with your explicit consent, and only to the extent necessary to provide and document your treatment. Access is restricted to the therapists who are directly involved in your care.

4.6 Legal and Administrative

  • Complying with applicable laws and regulations, including Norwegian tax, accounting and consumer protection laws

  • Establishing, exercising or defending legal claims

  • Protecting our rights and property

5. How We Collect Personal Information

We collect personal information through the following means:

  • Directly from you when you book an appointment, place an order, sign up for the newsletter, fill in a contact form, or visit the clinic

  • From your interactions with our website (cookies and similar technologies, where you consent)

  • From payment providers (Stripe, Vipps) when you complete a purchase

  • From our booking system (Hano) when you book online

  • From publicly available sources where strictly necessary (for example, verifying business contact details for B2B clients)

6. Sharing Personal Information with Third Parties

We do not sell your personal information. We share it only with:

  • Service providers acting on our behalf, under written data processing agreements (Databehandleravtaler). These include Squarespace (website hosting and e-commerce platform), Stripe and Vipps (payment processing), Hano (booking system), our newsletter platform, and our cloud storage and IT support providers

  • Shipping providers (Posten Norge, Bring) when we send physical orders or gift cards

  • Professional advisors, such as accountants and lawyers, where required for legal or financial reasons

  • Public authorities, where required by law (for example tax authorities or health regulators)

  • Acquirers or successors, in the event of a sale or restructuring of the business — only with appropriate confidentiality protections

We require all service providers to implement appropriate security measures and to use your information only for the purposes we have specified.

7. Cross-Border Transfers

Some of our service providers are based outside the European Economic Area (EEA), notably in the United States. Where personal information is transferred outside the EEA, we ensure an adequate level of protection through one of the following safeguards:

  • Transfer to a country recognised by the European Commission as providing an adequate level of data protection

  • Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplementary measures where appropriate

  • Other safeguards recognised under GDPR Articles 46–49

You may request a copy of the safeguards in place for a specific transfer by contacting us using the details in section 15.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods include:

  • Booking and treatment records: 5 years from the last appointment, in line with the Norwegian Bookkeeping Act and good clinical practice. Where information constitutes a patient record under the Norwegian Health Personnel Act, the longer statutory retention period applies.

  • Order and transaction records: 5 years from the end of the financial year, as required by the Bookkeeping Act

  • Newsletter subscription: until you unsubscribe, after which the email address is removed from active mailing within 30 days

  • Website analytics: anonymised after 14 months in Google Analytics 4

  • Contact form enquiries: 12 months after the enquiry is resolved

  • Job applications: 6 months after the recruitment process closes, unless you consent to a longer retention

After the relevant retention period, we securely delete or anonymise the information.

9. Security of Personal Information

We implement organisational, technical and physical measures to protect personal information against loss, unauthorised access, leakage, alteration or destruction. Measures include:

  • Access controls, two-factor authentication and role-based permissions for our staff

  • Encryption of data in transit (HTTPS/TLS) and at rest where supported by the relevant platform

  • Confidentiality obligations and privacy training for employees and contractors

  • Restricted physical access to areas where personal information is handled

  • Regular review of our suppliers and data processing agreements

  • A documented breach response procedure, including notification to Datatilsynet within 72 hours where required by law

10. Cookies and Similar Technologies

cabina.no uses cookies and similar technologies to operate the website, remember your preferences, and (where you consent) measure traffic and improve our marketing.

10.1 Categories of Cookies

  • Strictly necessary cookies — required for the site to function, such as maintaining your cart, login state and language preference. These do not require consent.

  • Statistics cookies — help us understand how visitors use the site (e.g. Google Analytics 4 with IP anonymisation). Set only with consent.

  • Marketing cookies — used by third-party platforms such as Meta and Google Ads to measure and personalise advertising. Set only with consent.

10.2 Managing Cookies

When you first visit cabina.no you are presented with a cookie banner where you can accept, decline or customise your preferences. You can change your choices at any time by clicking "Cookie settings" in the footer. You can also disable cookies directly in your browser settings, but doing so may limit functionality.

10.3 Do Not Track

We currently do not respond to "Do Not Track" signals transmitted by browsers, but our cookie banner allows you to refuse all non-essential cookies.

11. Contact and Booking Forms

When you contact us through our website forms or book an appointment online, we collect the information you provide and use it to respond to your enquiry, confirm your appointment, and follow up. The booking form is operated by Hano, which acts as our data processor. The form does not share your information with any other party.

12. Your Rights Under the GDPR

Under the GDPR and Norwegian data protection law, you have the following rights in relation to personal data we hold about you:

  • Right of access — to obtain a copy of your personal data and information about how we process it

  • Right to rectification — to have inaccurate or incomplete information corrected

  • Right to erasure ("right to be forgotten") — to have your data deleted, subject to legal retention obligations

  • Right to restriction — to limit our processing of your data in certain circumstances

  • Right to data portability — to receive your data in a structured, commonly used format and transfer it to another controller

  • Right to object — to processing based on our legitimate interests, including profiling

  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing

  • Right not to be subject to automated decision-making, including profiling, that has legal or similarly significant effects on you

To exercise any of these rights, please contact us using the details in section 15. We will respond within 30 days. We may ask you to verify your identity before processing the request.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing your personal information unlawfully — see section 15.

13. Children

cabina.no and our online shop are intended for users aged 16 and over. We do not knowingly collect personal information from children under 16 without verifiable parental consent. Ear piercings and certain treatments performed on minors at the clinic require the consent of a parent or guardian, who is responsible for providing any personal information about the child.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our services or operational practices. The current version is always available at cabina.no/personvern, and we will notify users of material changes through a notice on the website or by email where appropriate. We encourage you to review this Policy periodically.

15. Contact and Complaints

For any questions, requests or complaints regarding this Policy or our handling of personal information, please contact:

Cabina AS — Personvern Thomas Angells gate, 7011 Trondheim, Norway Email: post@cabina.no 

You also have the right to lodge a complaint with:

Datatilsynet (Norwegian Data Protection Authority) Postboks 458 Sentrum, 0105 Oslo www.datatilsynet.no

16. Effective Date

This Privacy Policy was last updated in May 2026.