Privacy Policy

Last updated: April 2026

Data Controller

Alexandra Medema, trading as Medema Studios. Akersgata 1, 5, 0158 Oslo, Norway. Email: post@alexandramedema.com.

What data we collect

We only collect personal data necessary to provide our services: booking data (name, email address and phone number when booking an appointment via the bestille.no booking system), and server logs (IP addresses and browser information are temporarily stored by our hosting provider Cloudflare as part of normal operations and security).

Legal basis

Booking data is processed on the basis of contract (GDPR Art. 6(1)(b)) — to perform the service you book. Server logs are processed on the basis of legitimate interest (GDPR Art. 6(1)(f)) — to ensure the website's security and protect against misuse.

Third parties and data processors

bestille.no (Appointway AS) — Booking system that processes name, email and phone on our behalf. Data is stored on servers within the EEA.

Cloudflare Inc. — Hosting, CDN and security services. Necessarily processes IP addresses as part of service delivery. Cloudflare is certified under the EU–US Data Privacy Framework.

Google Analytics (GA4) — only activated if you give consent via the cookie banner. Enables anonymised usage statistics.

Cookies

This website only sets technically necessary cookies from Cloudflare (__cf_bm, __cfruid) for security and DDoS protection. These do not require consent as they are strictly necessary for the website to function. Analytics cookies from Google Analytics are activated only if you accept via the cookie consent banner.

Retention

Booking data is retained for the period necessary to complete and document the service, and deleted in accordance with bestille.no's policies. Server logs are deleted on an ongoing basis per Cloudflare's default settings (typically within 30 days).

Your rights

You have the right to access, correction, erasure, restriction of processing, objection and data portability. Send requests to post@alexandramedema.com — we respond within 30 days. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet — datatilsynet.no).

Contact

Privacy questions: post@alexandramedema.com.