Effective from 26 September 2026.
This policy explains how we process personal data when you use oksana.dk or contact us. We only process the data we need, and we never sell personal data.
1. Data controller
Beauty Academy Oksana Kolesnyk
CVR no. 43557807 (Danish company registration number)
Gyldenløvesgade 6, st. th., 1369 København K
Email: okolesnyk00@gmail.com
Phone: +45 91 95 03 92
If you have questions about how we process your data, or want to exercise your rights, write to okolesnyk00@gmail.com.
2. What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing the website (server logs, protection against attacks, spam and abuse) | IP address, browser and device type, pages visited, time, referring page | Legitimate interest, GDPR Art. 6(1)(f), and the duty to secure processing, Art. 32 | Up to 90 days; afterwards only anonymous counts |
| Answering enquiries by form, email or phone | Name, contact details and what you write to us | Art. 6(1)(b) (steps before a contract) and 6(1)(f) (being able to reply) | Up to 12 months after the last contact, unless it leads to a contract |
| Bookings and delivering services | Name, address, email, phone, order and payment details (we never see full card numbers) | Art. 6(1)(b) (performance of a contract) | For the term of the contract and up to 3 years afterwards (Danish Limitation Act) |
| Bookkeeping | Invoices and payment details | Art. 6(1)(c) and the Danish Bookkeeping Act | 5 years from the end of the financial year |
| User account and providing the service | Email, name, login details and content you create | Art. 6(1)(b) (performance of a contract) | While the account is active; deleted no later than 30 days after closure unless the law requires otherwise |
| Log of sign-ins and security events | Time, IP address, device, outcome | Art. 6(1)(f) and Art. 32 | 12 months |
| Statistics and marketing via cookies | Cookie IDs, truncated IP address, page views, clicks | Consent, Art. 6(1)(a), and the Danish Cookie Order s. 3 | See the cookie policy |
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Art. 22).
You are not obliged to give us any data. Without the data marked as required we cannot deliver the service or reply to you.
3. Who we share data with
We use suppliers (processors) who may only process the data on our instructions and under a data processing agreement:
- Contabo GmbH — hosting (Germany, EU).
- Cloudflare Turnstile (Cloudflare, Inc.) — Protecting forms against bots without tracking cookies (legitimate interest, Art. 6(1)(f)).
- Stripe Payments Europe Ltd. — Secure payment and fraud prevention.
- Google Maps (Google Ireland Ltd.) — Showing maps. Loaded only after consent. Only with your consent.
- Google Fonts (Google Ireland Ltd.) — Delivering fonts. No cookies are set; your IP address is sent to Google when they are fetched.
- Trustindex (Trustindex.io Kft., Ungarn) — Showing a feed of posts from our social media via Trustindex’s CDN. No cookies are set; your IP address is sent when it is fetched.
Beyond that we only disclose data where the law requires it (e.g. to public authorities) or where it is necessary to establish, exercise or defend legal claims.
4. Transfers outside the EU/EEA
Some of the suppliers above are, or have group companies, in the USA (Cloudflare Turnstile (Cloudflare, Inc.), Google Fonts (Google Ireland Ltd.), Google Maps (Google Ireland Ltd.), Stripe Payments Europe Ltd.). Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (for certified companies) and/or the European Commission’s Standard Contractual Clauses (Art. 46). You can get a copy of the relevant safeguards by contacting us.
5. Your rights
Under the General Data Protection Regulation you have the right to:
- access the data we process about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- erasure (“the right to be forgotten”) (Art. 17);
- restriction of processing (Art. 18);
- receive your data in a common machine-readable format (data portability, Art. 20);
- object to processing based on our legitimate interest, and always to direct marketing (Art. 21);
- withdraw consent at any time — this does not affect the lawfulness of processing before the withdrawal (Art. 7(3)).
These rights may be subject to conditions or limits; for example we may keep data we are required to keep under bookkeeping law or that is needed to defend legal claims (Art. 17(3)). We reply within one month and may ask you to confirm your identity before disclosing data.
6. Complaints
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk, or to the supervisory authority where you live. We would like to hear from you first so we can put it right.
7. Security
We protect data with technical and organisational measures: encrypted connections (HTTPS), access control, security updates, backups and access logging. No method is 100% secure; if a personal data breach occurs we handle it under Art. 33-34.
8. Changes
We may update this policy, e.g. when we start using new tools. The current version and date are always on this page. For material changes we ask for new consent where required.