Privacy policy

2. Purposes and legal basis

We process personal data for the following purposes:

Necessary

Purpose: Running the website, storing consent choices, session handling.

Legal basis: GDPR Art. 6(1)(f) (legitimate interest) — the site requires a minimum of technical functionality to run.

Statistics

Purpose: Understanding how the website is used via Google Analytics 4 (aggregated visits, page views, clicks).

Legal basis: GDPR Art. 6(1)(a) (consent, collected via the cookie banner).

Marketing

Purpose: Measuring ad performance and building audiences via Google Ads and Meta Pixel.

Legal basis: GDPR Art. 6(1)(a) (consent, collected via the cookie banner).

3. Data processors

We share personal data with the following processors under data processing agreements (GDPR Art. 28):

Google LLC (Google Analytics 4, Google Ads)

Purpose: Website analytics and ad conversion.

Data processing agreement: Data processing agreement (Google Ads Data Processing Terms) signed: {{TODO: owner to fill — date or “in progress”}}.

Transfer basis: Transfer to the USA under the EU-US Data Privacy Framework (Google is certified).

Meta Platforms Ireland Ltd. (Meta Pixel)

Purpose: Ad-performance measurement and remarketing.

Data processing agreement: Data processing agreement (Meta Data Processing Agreement) + EU-US DPF addendum signed: {{TODO: owner to fill — date or “in progress”}}.

Transfer basis: Transfer to the USA under the EU-US Data Privacy Framework (Meta is certified) and the EU Standard Contractual Clauses.

Froyd AS (booking system)

Purpose: Handling appointment bookings on froyd.no.

Data processing agreement: Data processing agreement: {{TODO: owner to fill — status}}.

Transfer basis: Processed within the EEA.

4. Transfers outside the EEA

Google and Meta process personal data in the USA. The transfers are based on the European Commission's adequacy decision under the EU-US Data Privacy Framework (DPF), together with the EU Standard Contractual Clauses (SCC) as a supplementary safeguard. You can request a copy of the transfer mechanism by contacting us.

5. Retention

Consent

Stored in the “mbs_consent” cookie for 180 days, or until you withdraw or change your choice.

Google Analytics 4

2 months (the minimum GA4 setting).

Meta Pixel

Meta's default retention ({{TODO: owner to fill — Meta states 90 days for event data, confirm in Events Manager}}).

Google Ads conversion

Google's default retention ({{TODO: owner to fill — typically 13 months for conversion data}}).

Booking data at Froyd

Processed in line with the Norwegian Bookkeeping Act — typically 5 years.

6. Your rights

You have the right to:

1. Access the personal data we hold about you (GDPR Art. 15).
2. Rectification of inaccurate data (Art. 16).
3. Erasure of your data where the conditions are met (Art. 17).
4. Restriction of processing (Art. 18).
5. Data portability where processing is based on consent or contract (Art. 20).
6. Object to the processing (Art. 21).
7. Not to be subject to automated decisions (Art. 22) — we do not use these.

Contact us at marika@mbrowstylist.com to exercise these rights. We respond within 30 days.

7. Complaint to the Data Protection Authority

If you believe we process your personal data in breach of data-protection law, you can lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

See how to complain to Datatilsynet →

8. Changes and version

We update this policy when there are material changes. Latest update: August 2026 — the site is now a portfolio; the online-shop sections (payments and the 14-day right of withdrawal) were removed. If a change affects the basis for consent, you'll be asked to confirm your choice again.