Processing of personal data by The Well complies with prevailing data protection regulations.
LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Processing of personal data is not permitted unless there are valid legal grounds for processing. Examples of grounds for processing are when consent is provided by the data subject, a contract (signed agreement), legislation or when the data controller has a “legitimate interest” that surpasses the data subject's right to privacy.
The main grounds for processing of personal data at The Well are consent. When we start processing your personal data, we will always provide information on our grounds for processing.
OUR USE OF PERSONAL DATA
We collect and process personal data in order to fulfil our agreement with our employees (administration of employment contracts) and guests (administration of customer relationships), including, e.g., providing a good service, providing information on our products and services (marketing activities). Use of data in connection with marketing activities is based on consent. You are entitled to change your consent by contacting The Well.
As an example, our facility provides modern and functional individual and personal treatments and activities. When you visit The Well, your visit is registered. The same applies to booking treatments and tables in the restaurant.
We analyse use of our facilities so we can optimise the products and services we offer to our guests.
We register the following data: name, date of birth, telephone number, email address, postal address and purchase history. We obtain this data from the data subject him/herself.
DISTRIBUTION OF PERSONAL DATA – USE OF THIRD PARTIES
Registered personal data is processed confidentially at The Well, and access to our personal records is reserved for those who need such access for the purpose of their work. As a main rule, we therefore do not share personal data with third parties outside The Well.
However, there may be situations where we share personal data with our partners, such as Facebook or Google – ref. the section on cookies. Sharing personal data with a third party is defined as processing of personal data that requires legal grounds for processing. Such grounds for processing will, in principle, be consent from the data subject, so that our customers as data subjects will always be aware that we have distributed their data. Please note that there may be certain situations where we are legally bound to distribute your personal data.
COOKIES and pixels
There are two types of cookies: First-party cookies are necessary for the functioning of our website. Third-party cookies are used for analyses and marketing, and will also comprise use of partners.
Pixel is a code on our website that allows us to register conversions via online advertisements. The purpose of the code is to adapt our external advertising based on the actual interests of our users, so that we can remain relevant to our group of users.
Email and text message marketing will only be sent if you have specifically consented to this.
STORAGE AND ERASURE OF PERSONAL DATA
We do not distribute your personal data to others unless there are legal grounds for such distribution. Examples of such grounds will normally be an agreement with you or legal grounds obliging us to disclose the data.
All processing of personal data will take place within the EU/EEA. The Well erases your personal data without undue delay and at the latest after six months, when the data is no longer necessary for the purpose for which it was collected, if you withdraw your consent on which the data processing was based or if you object to the processing and there are no more weighty legitimate grounds on which to base processing. We have specific routines for erasure for each processing procedure.
If you withdraw your consent regarding processing of your personal data, we will stop processing your personal data. This does not, however, affect the legality of processing based on consent before the consent was withdrawn.
You have the right to request access to, rectification of and erasure of your personal data (unless we are obliged to store the data) and to limit the processing and distribution of your personal data (data portability). Moreover, you can request that we stop processing your personal data (for example, by withdrawing your consent). If you request the exercise of one or more of these rights, we will comply with the request, unless we are obliged to act otherwise, within one month from the date the request was made. Such requests can be sent to our email address email@example.com.
If you feel that we are in breach of the general data protection regulations, you can submit a complaint to the Norwegian Data Protection Authority.
Please feel free to contact us by email at firstname.lastname@example.org you have any comments or would like more information regarding processing of your personal data.
Last amendment: 21.09.2020