Privacy policy

1. 1.Data controller

   Ushmend Beauty (Leila Ushmend), Vogts gate 30, Oslo, is the data controller for the personal data processed through ushmendbeauty.com. Questions about privacy: [email protected] or +47 408 90 792.

2. 2.What we process, why, and the legal basis

   • Contact form and enquiries: name, email, phone (optional) and your message — to answer you. Legal basis: legitimate interest (GDPR art. 6(1)(f)). • Price estimate from photos: name, contact details, information about your hair and photos of your hair — to give you an estimate. Legal basis: steps at your request before a contract (art. 6(1)(b)). Please avoid photos that show your face if you do not want to share it. • Purchases of products, gift cards and courses: name, email, phone, delivery address, what you bought, payment status and, for gift cards, the recipient's name, email and greeting if you give them — to deliver and follow up the order. Legal basis: contract (art. 6(1)(b)) and the Norwegian Bookkeeping Act (art. 6(1)(c)). • Customer account: name, email, password (stored only as an encrypted hash), phone, delivery address, your orders, gift cards and course progress — to run your account and give access to courses. Legal basis: contract (art. 6(1)(b)). • Newsletter: email, language and the time of your consent — only with your consent (art. 6(1)(a)), which you can withdraw at any time. • Operation and security of the website: IP address and technical data in server logs — to keep the site secure and stop abuse. Legal basis: legitimate interest (art. 6(1)(f)). Giving us the data needed for an order is necessary to complete it; everything else is voluntary. We do not use your data for automated decisions or profiling.

3. 3.Payment

   Payments by Vipps or card are handled by the payment provider. We never see or store card details — we only receive confirmation that the payment has gone through.

4. 4.Who receives the data

   We use these providers. They process data on our behalf under data processing agreements and only for the service they provide: • Go Daddy Netherlands B.V. — server hosting in the EU. • Cloudflare — network security and protection against attacks, forwarding of email to our inbox, and visitor statistics without cookies. • Resend — sending of emails from the website (order confirmations, links, gift cards). • Vipps MobilePay — payment. Vipps is also an independent controller for its own app. • Stripe — card payment, when this payment method is offered. • Vimeo and YouTube (privacy mode) — playback of course videos. If Google reviews are shown on the site, the reviewers' profile pictures are loaded from Google's servers, which then receive your IP address. Online booking takes place at Timma, which is responsible for the data you give there. We never sell your data or share it for marketing.

5. 5.Transfers outside the EU/EEA

   Our data is stored in the EU/EEA. Cloudflare and Resend are American companies, so data may also be processed in the USA. Such transfers are based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses (GDPR art. 45 and 46).

6. 6.How long we keep data

   • Contact form messages: deleted automatically after 12 months. • Photos and details for price estimates: deleted automatically after 12 months. • Paid orders and payment records: 5 years after the end of the financial year (Bookkeeping Act). • Orders that were never paid: deleted after 12 months. • Customer account: until you delete it. Accounts that were never confirmed and never used are deleted after 90 days. • Newsletter: until you unsubscribe. Unconfirmed sign-ups and unsubscribed addresses are deleted after 30 days. • Server logs: 14 days. Backups: at most 6 weeks.

7. 7.Cookies

   The website only uses cookies that are strictly necessary for it to work, so no consent is required (Norwegian Electronic Communications Act § 3-15): • a session cookie (cart, login, language); • a security cookie that protects forms (XSRF-TOKEN); • a login cookie, only if you tick “Remember me”; • a technical Cloudflare cookie (__cf_bm) that filters out bots. Visitor statistics (Cloudflare Web Analytics) work without cookies and without storing your IP address. Course videos are loaded only on course pages, and the Vimeo player is set not to track you.

8. 8.Your rights

   You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time. In “My account” you can edit your details, download all your data and delete your account yourself. Otherwise, email us at [email protected] — we reply within one month. You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

9. 9.Security

   The website uses encrypted connections (HTTPS). Passwords are stored only as hashes, photos for price estimates and course materials are stored privately, and only authorised staff have access to the admin.

10. 10.Changes

    We update this policy when we change how we process personal data. The date below shows the current version.

Last updated: 12.11.2026