Privacy policy
This page explains what information we collect when you use the website and book an appointment, why we collect it, who receives it, how long we keep it, and what your rights are.
Last updated 6 November 2026.
Who is responsible
Nirvana Thai Massasje, Klostergata 8A, 1532 Moss, Norway, is the data controller for personal data collected on nirvanamassasje.no.
Send questions about privacy to postnirvana@nirvana.no or call +47 406 27 684. You can also use the form for access and deletion.
We never sell personal data, and we do not use it for automated decisions, profiling or marketing.
Data and purposes
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Booking and e-mail confirmation | Name, phone, e-mail, treatment, time, therapist and any comment | Contract (Art. 6(1)(b)) | Name, phone, e-mail and comment are removed 24 months after the appointment |
| Replying to the contact form | Name, e-mail, phone, subject and message | Legitimate interest in replying to you (Art. 6(1)(f)) | Deleted after 12 months |
| Business agreements, invoiced gift cards and massage at the workplace | Company name, organisation number, contact person, e-mail, phone and the order | Contract (Art. 6(1)(b)) | Deleted after 36 months |
| Requests for access, correction and deletion | Name, e-mail, phone and what the request is about | Legal obligation (Art. 6(1)(c)) | Deleted 36 months after the case is closed |
| Operation and security | IP address and time in the web host's server logs | Legitimate interest in a secure website (Art. 6(1)(f)) | A short time, according to the web host's routines |
| Statistics on how the website is used (only if you accept) | Which pages you view, approximate location (country/city), language, device, browser, where you came from, and which treatments you view or book. The IP address is not stored. | Consent (Art. 6(1)(a)) | 14 months at Google |
Health information: The comment field in the booking is optional. If you write something about your health, for example an injury or that you are pregnant, we only use it to adapt the massage. This is based on your explicit consent (Art. 9(2)(a)), which you can withdraw at any time. Do not write more than the therapist needs to know.
Payment is made at the clinic with Vipps, card or gift card. Receipts are kept in the till system for 5 years because the Norwegian Bookkeeping Act requires it. Vipps and the card companies process the payment as separate data controllers.
Who receives the data
- The therapist who will treat you sees your booking.
- Simply.com (Denmark) runs the web hosting, database and e-mail sending for us. They are our data processor and may only use the data according to our instructions.
- Brønnøysund Register Centre: If you use the company search on the business page, our server sends what you type to the open service of the Norwegian business register. Your IP address is not sent.
- Public authorities, only when required by law.
Google Analytics receives statistics about your visit if you have accepted it. Google is our data processor.
The weather under “Contact” is fetched by our server from the Norwegian Meteorological Institute using the clinic's location. No information about you is sent.
Transfers outside the EEA
What we store ourselves is kept by Simply.com in Denmark, inside the EU/EEA.
Google Analytics is only used if you accept statistics. Google Ireland Ltd. then processes the data, and it may be transferred to Google LLC in the USA. The transfer is based on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. We have switched off Google's advertising features and data sharing.
The fonts are on our own server. The “Open in maps” link takes you to Google Maps. Google's privacy rules only apply once you click it.
Cookies
Some cookies are needed for the site to work. If you accept statistics, we also use Google Analytics. You choose in the notice shown on your first visit, and you can change your mind at any time.
| Name | Purpose | Duration |
|---|---|---|
nvsessCookie · Necessary | Keeps the forms secure (protects against forged submissions) and keeps admin logged in. | Until the browser is closed |
nv_langCookie · Necessary | Remembers the language you chose. Only set when you change language. | 1 year |
nv_cookiesBrowser storage · Necessary | Remembers your cookie choice, so the notice is not shown again. | 12 months |
nv_textsizeBrowser storage · Necessary | Remembers the text size you chose with A− / A+. | Until you delete it in the browser |
_gaCookie from Google Analytics · Statistics | Tells visitors apart so we can count visits. Only set if you accept statistics. | 2 years |
_ga_2BXMJG1PNLCookie from Google Analytics · Statistics | Remembers your session so page views are counted correctly. Only set if you accept statistics. | 2 years |
Storage and deletion
We only keep data for as long as we need it. Old data is deleted automatically according to the periods in the table above:
- Bookings: name, phone, e-mail and comment are removed 24 months after the appointment. The appointment itself remains without personal data, so the schedule and statistics stay correct.
- Messages from the contact form are deleted after 12 months.
- Business requests are deleted after 36 months.
- Closed privacy requests are deleted after 36 months.
E-mails you send us, or that we send you, are also kept in the clinic's mailbox. We clear it out regularly.
Security
The website uses an encrypted connection (HTTPS), the forms are protected against misuse, and passwords are stored encrypted. Only clinic staff can see bookings, using personal logins. Read more about security, data flow and storage.
Your rights
You have the right to:
- know what information we hold about you and get a copy (access)
- have incorrect information corrected
- have the information deleted
- ask us to restrict processing, or object to it
- receive the information in a machine-readable format (data portability)
- withdraw your consent
Use the form for access and deletion, or e-mail postnirvana@nirvana.no. We reply within 30 days. We send the reply from the clinic's e-mail to the address you have used with us, so nobody else can get hold of your information.
If you think we are handling your data incorrectly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the data protection authority in your own country. We would appreciate it if you contact us first, so we can put things right.