Last updated 8 September 2026

Privacy Policy

How Beauty Factory by Tatjana Deric collects, uses and protects personal data, in line with the GDPR as it applies in Norway.

  1. 1Who is responsible for your data

    Tatjana Deric, trading as Beauty Factory by Tatjana Deric (org. no. 915 744 117), Niels Juels gate 38, 0257 Oslo, Norway, is the data controller for personal data collected through this website. Treatments are carried out at Beth's Medispa in Frogner, Oslo; training courses are run by Tatjana Deric directly.

    For anything privacy-related, write to tatjana@phibrows.com.

  2. 2What we collect, and why

    When you buy a course: your name, email address, billing address and payment details. Payment details go directly to Stripe — we never see or store your card number. Stripe keeps your details as a customer record so that we can find your order, send your confirmation and contact you about your course. If you tick the reminder box in the cart and leave before paying, we send you one email with a link to finish; without the tick, we send nothing.

    When you email us: whatever you choose to send. The site has no contact form — the Contact page links to an ordinary email address, so nothing is collected until you write to us yourself.

    While you browse: our hosting provider, Vercel, keeps standard server logs (IP address, time of request) for a short period for security and reliability. We also use Vercel Web Analytics, which counts page views and a few interactions — for example clicking "Book this treatment" or adding a course to the cart. It sets no cookies, stores nothing on your device, does not identify you and does not follow you to other sites.

    If you accept analytics in the bar shown on your first visit, we also use Google Analytics 4. It sets cookies that recognise your browser on later visits and sends page views and the same few interactions — including a course purchase and its amount — to Google. It is off until you accept, and you can switch it off again at any time under "Analytics settings" in the footer.

    Your language choice is remembered in one small, strictly necessary cookie. Your theme preference, your cart and your analytics choice are held in your own browser's local storage and never reach our server until you check out.

  3. 3Who we share it with

    We use a small number of service providers to run the site. None of them may use your data for their own purposes.

    Beth's Medispa is not our service provider. Choosing to book a treatment takes you to their own booking system at bestille.no, which has its own privacy policy.

    • Stripe — processes payment (card, Klarna, PayPal, Link). Receives your name, email, billing address and payment details. PCI DSS Level 1 certified.
    • Resend — sends your booking confirmation and our new-booking notification. Receives your email address and order summary.
    • Vercel — hosts the site and provides cookieless visitor analytics. Standard access logs and aggregated usage only.
    • Google Maps — loads, and only then receives anything, if you click "Show map" on the Contact or Treatments pages.
    • Google Analytics — only if you accept analytics. Receives page views, a few interactions and a pseudonymous browser identifier; IP addresses are not stored. Google's own data-processing terms apply.

  4. 4Our legal basis

    We process order and payment data because we need it to perform the contract — to sell you the course you are buying. Server logs and aggregated analytics are kept under our legitimate interest in keeping the site secure and working well. The map loads only on your consent, given by the click itself. Google Analytics runs only on your consent, given in the analytics bar and withdrawable at any time under "Analytics settings" in the footer.

  5. 5Data leaving the EEA

    Stripe, Resend, Vercel and — if you accept analytics — Google may process data on servers outside the EEA, principally in the United States, under the EU–US Data Privacy Framework or Standard Contractual Clauses. Each publishes its own data-processing terms.

  6. 6How long we keep it

    Order and payment records are kept for five years, as Norway's Bookkeeping Act (bokføringsloven) requires. Emails you send us are kept as long as reasonably needed to deal with them. Server logs roll over after a short, standard period set by Vercel; Vercel analytics are held only in aggregated form. Google Analytics keeps its event data for the retention period set on the property — no longer than 14 months.

  7. 7Your rights

    Under the GDPR you can ask to see the personal data we hold about you, have it corrected or deleted, ask us to restrict or stop certain processing, receive a copy in a portable format, and object to processing based on legitimate interest. Write to tatjana@phibrows.com for any of these. You may also complain to Datatilsynet, the Norwegian Data Protection Authority, at any time.

  8. 8Cookies and local storage

    We set one cookie ourselves: your language preference (English or Norwegian). It is strictly necessary, carries no tracking value and is exempt from consent requirements under the Norwegian Electronic Communications Act.

    Google Analytics cookies (_ga and _ga_…) are set only if you accept analytics in the bar shown on your first visit. They identify your browser to Google Analytics for up to two years. "Analytics settings" in the footer lets you withdraw at any time, which also removes them. We ask again after a year.

    Your theme preference, your cart and your analytics choice are stored in local storage on your own device, not in cookies. Vercel's analytics use no cookies and no device storage. The site sets no advertising cookies.

  9. 9Age

    This site is intended for adults. We do not knowingly collect personal data from anyone under 18.

  10. 10Changes to this policy

    If this policy changes in a way that matters, we will update the date shown at the top of this page. Continuing to use the site after a change means you accept the update.