Privacy Policy

Data Controller

Alexandra Medema, trading as Medema Studios
Akersgata 1, 5, 0158 Oslo, Norway
Email: post@medemastudios.com

What data we collect

We only collect personal data necessary to provide our services:

• Booking data — name, email address and phone number when booking an appointment via the bestille.no booking system.
• Server logs — IP addresses and browser information are temporarily stored by our hosting provider Cloudflare as part of normal operations and security.

Legal basis

Booking data is processed on the basis of contract (GDPR Art. 6(1)(b)) — to perform the service you book. Server logs are processed on the basis of legitimate interest (GDPR Art. 6(1)(f)) — to ensure the website's security and protect against misuse.

Third parties and data processors

• bestille.no (Appointway AS) — Booking system that processes name, email and phone on our behalf. Data is stored on servers within the EEA. See their privacy policy at bestille.no.
• Cloudflare Inc. — Hosting, CDN and security services. Necessarily processes IP addresses as part of service delivery. Cloudflare is certified under the EU–US Data Privacy Framework. See cloudflare.com/privacypolicy.

We do not use analytics trackers, advertising networks or social media plugins that set cookies.

Cookies

This website only sets technically necessary cookies from Cloudflare (__cf_bm, __cfruid) for security and DDoS protection. These do not require consent as they are strictly necessary for the website to function.

The booking page (bestille.no) may set its own cookies, activated only if you choose to proceed to the booking page.

Retention

Booking data is retained for the period necessary to complete and document the service, and deleted in accordance with bestille.no's policies. Server logs are deleted on an ongoing basis per Cloudflare's default settings (typically within 30 days).

Your rights

Under GDPR you have the right to:

• Request access to data we hold about you
• Request correction of inaccurate data
• Request erasure of your data
• Object to processing
• Request restriction of processing
• Lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet — datatilsynet.no)

Send requests to post@medemastudios.com. We respond within 30 days.

Contact

Privacy questions: post@medemastudios.com