Privacy Policy

1. Who is responsible

The data controller for the personal data described in this policy is Kodnet AS (organisation number 924712368), Markensgate 31, 4611 Kristiansand, Norway, which operates hatakoca.com and Hata Koca Vocal Atelier ("we", "us"). For any question about privacy, or to use your rights, email training@hatakoca.com.

2. What we collect and why

• Your account: name, email address and password (stored only as a secure hash). Used to run your account and show your lessons. Legal basis: our agreement with you.
• Bookings: contact name, email address and phone number; if you book for someone else, the student's name and age; the lesson type, date, time, format and price; your preferred payment method and the payment status; and any message you add. Used to plan and give your lessons and keep our records. Legal basis: our agreement with you and, once payments are recorded, our legal duty to keep accounts.
• Event tickets: the buyer's name, email address and phone number if given; each attendee's name; the event, the number of tickets, the price and the payment status; and the optional "Message to Hata" if you write one. The message is stored with your order, shown only to Hata (in her order list and in the email she gets about your order), and erased together with the rest of the order's personal data — when you ask us to erase your data, and otherwise automatically one year after the event. Legal basis: our agreement with you and, for paid tickets, our legal duty to keep accounts.
• Messages from our forms (lesson requests, Sing Like a Pro applications, event inquiries and registrations, free course sign-ups): the details you enter, such as your name, email address, phone number if given, your choices and your message, plus the page and time of sending. They are sent as an email to Hata's inbox and not stored anywhere else on the website. You also get a short automatic confirmation at the email address you gave, with a summary of your choices (never your message). Legal basis: answering your request before an agreement, and our legitimate interest in replying to messages.
• News about lessons and events: if you tick the box on the free course form, we record your consent together with your sign-up. We do not send newsletters at the moment; you can withdraw your consent at any time.
• Emails you send us: whatever you choose to include.
• Testimonials: your name as you want it shown, a short description, your words and any video, only with your permission.
• Security: your IP address is kept for about a day with a counter, to limit repeated sign-in, sign-up, booking and form attempts. Our hosting provider also keeps short-lived technical logs. Legal basis: our legitimate interest in keeping the website secure.
• Health information: if you choose to tell Hata about your health (for example voice problems), it is used only to adapt your lessons and is not shared.
• How the website is used (only with your consent): if you accept analytics cookies, Hotjar records how you use our public pages, such as page views, clicks, mouse movements and scrolling, but never what you type in forms. Used to understand how the website is used and to improve it. Legal basis: your consent. See section 4.
• Website statistics: anonymous daily counters for everyone, and — only if you accept analytics — the steps of your visit with an anonymous visit id (see section 5).

Card details are entered in Stripe's secure payment form and go straight to Stripe — we never receive or store them — and we do not sell personal data.

3. Cookies and storage on your device

• Sign-in cookies from our login system keep you signed in and protect forms against misuse. They are necessary for your account and are removed when you log out or when they expire.
• Language cookie ("hk-locale") remembers whether you chose English or Norwegian, for up to one year.
• Analytics choice cookie ("hk-analytics-consent") remembers whether you accepted or declined analytics cookies, for about 6 months; after that we ask again. It is only read by this website.
• Visit id (only with your consent): an anonymous random id for our own statistics, kept in your browser's session storage until you close the tab (see section 5).
• Browser storage: the booking steps keep your choices in your browser tab until the booking is finished, and the site remembers for 90 days if you dismissed the "Install app" message (it also counts your visits on this device to decide when to show that message). If you install the website as an app, public pages are stored on your device so they also open offline.

We do not use advertising cookies. Analytics cookies from Hotjar are only set if you accept them (see section 4). Video providers can only set cookies after you press play (see section 6).

4. Analytics with Hotjar (only with your consent)

To understand how visitors use the website, so that we can improve it, we use Hotjar, an analytics service developed by Hotjar Ltd (Malta), which merged into the Contentsquare group in July 2025. Hotjar only runs if you press "Accept analytics" in the cookie banner. If you decline, or make no choice, Hotjar is never loaded.

• What is recorded: how you use our public pages — page views, clicks and taps, mouse movements and scrolling — together with technical information about your browser and device (for example device type, screen size, browser and country). Like any online service, Hotjar receives your IP address when your browser connects to it.
• What is not recorded: what you type in forms (the content of form fields is masked) and payment details. Hotjar never runs on the sign-in and account pages, the booking and checkout steps or the payment pages. On event pages the ticket form is masked too, and card details are only ever typed into Stripe's own secure card fields, which come from Stripe and cannot be read by Hotjar.

Hotjar sets first-party cookies whose names start with _hj. As described by Hotjar ({site_id} is our Hotjar site number):

• _hjSessionUser_{site_id} keeps a random Hotjar user ID for this website, so that later visits are counted as the same visitor. Hotjar does not follow you across other websites. 365 days.
• _hjSession_{site_id} holds the current visit, so that the pages you view belong to the same session. 30 minutes, extended while you are active.
• _hjHasCachedUserAttributes (until the end of the session) and _hjUserAttributesHash (2 minutes, renewed every 30 seconds) belong to Hotjar's user attributes feature. We do not send Hotjar any user attributes.
• _hjCookieTest, _hjLocalStorageTest, _hjSessionStorageTest and _hjTLDTest check whether cookies and browser storage work and which domain to use. They are deleted straight after the check.

Hotjar also keeps a few items in your browser's storage during the visit (such as hjViewportId and hjActiveViewportIds, about the size of your screen and window), which are removed when you close the page or tab. Hotjar's own, up-to-date description of these cookies: Cookies set by the Hotjar tracking code. How Hotjar handles personal data: Hotjar's privacy policy.

Hotjar keeps the data for a limited time and then deletes it automatically; Hotjar's documentation currently states 365 days from collection.

Legal basis: your consent (GDPR Article 6(1)(a)). Storing and reading these cookies on your device also requires your consent under section 3-15 of the Norwegian Electronic Communications Act (ekomloven). You can change your choice at any time under Cookie settings at the bottom of the page. If you withdraw your consent, Hotjar is switched off and the website deletes the _hj cookies from your browser. This does not affect data collected before you withdrew it.

5. Our own website statistics

To see which pages, lessons, events and videos interest visitors, the website counts what happens on its public pages itself (first-party: no outside analytics company). We never collect your IP address, your browser's user agent, your name, your email address or your phone number for this.

• Without your consent: only anonymous counters per day, for example "the lessons page was viewed 40 times today" or "the hero video was started 12 times". Nothing is stored about you or your device, no cookie is set and nothing connects one page view to another.
• With your consent ("Accept analytics" in the cookie banner): the website also records the steps of your visit — pages viewed, clicks on lessons, packages and events, video plays and how far a video was watched, and the booking steps — together with an anonymous random visit id. That id is created only after you accept, is kept in your browser's session storage (not a cookie) and disappears when you close the tab. We also store the campaign tags of the link you arrived from (utm_source, utm_medium, utm_campaign), the name of the website that referred you (only the host, e.g. google.com), whether you use a phone, tablet or computer (from the screen width) and the page language. If you then book or buy, the visit id and campaign tags are saved with the booking, so we can see which campaigns lead to bookings.
• Retention: the consented visit records are deleted automatically after 14 months. The anonymous daily counters contain no personal data and are kept.

Legal basis: your consent (GDPR Article 6(1)(a)) for the consented records. One choice in the cookie banner covers these statistics and Hotjar (section 4). You can change it at any time under Cookie settings; if you decline or withdraw, the visit id is deleted from your browser and nothing more is recorded about your visit. The anonymous daily counters do not identify anyone.

6. Videos (YouTube, Vimeo and Bunny Stream)

Videos on the website are hosted by YouTube (Google), Vimeo or Bunny Stream (BunnyWay d.o.o., Slovenia). Nothing is loaded from these services until you press "Watch the Video" or a play button. When you do, the video is streamed by that provider, which receives your IP address and technical information about your browser and device, and may set its own cookies and collect viewing data under its own privacy policy. YouTube videos use YouTube's privacy-enhanced mode, and Vimeo videos are loaded with "do not track".

Bunny Stream also stores the videos we upload, such as testimonial videos, which may show the people in them. We only upload such videos with the person's permission.

7. Who we share data with

We use trusted providers who process data on our behalf. Growhubs (growhubs.com) is our data processor, and our data processing agreements are made through Growhubs. The providers are:

• Growhubs, our booking partner and data processor, for bookings and, if agreed, payments.
• Vercel (website hosting and photo storage) and Neon (database).
• Resend (sends form messages to Hata and the confirmation to you) and Google (the Gmail inbox where Hata receives them), together with the email provider of our hatakoca.com inbox.
• Bunny Stream (video hosting and streaming).
• Google Calendar: Hata connects her own Google Calendar to the website. The website uses only Google's calendar.events permission (plus her account's email address, to show which calendar is connected) to create, update and delete the calendar entries — and Google Meet links for online lessons and events — of lessons and events booked on this site. A lesson's entry contains the lesson type, the student's name (and the name of the person who booked, if they booked for someone else), the booking code, the time and the place or Meet link; no email address or phone number is added. The data is not shared with anyone else through the calendar and is not used for advertising.

If you accept analytics cookies, Hotjar also receives data about how you use our public pages (see section 4).

Payment providers (Stripe for card payments, and Vipps where it is offered) process payment information as independent controllers under their own privacy policies. We do not share your data with anyone else unless the law requires it.

Google Calendar and Google user data. Hata connects her own Google Calendar to the website herself, in the website's settings. For calendar access the website uses only Google's calendar.events scope, together with the basic sign-in scopes openid and email, which only show which Google account is connected. With that access the website creates, updates and deletes the calendar entries — and the Google Meet links — for the lessons and events booked on this site; it does not read or change anything else in her Google account. Data received from Google (the connected account's email address and the calendar entries and Meet links the website creates) is used only for this purpose: it is not shared with third parties, not used for advertising and not used to train generalized AI models.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Hata can disconnect Google Calendar at any time in the website's admin under Settings → Google Calendar → Disconnect: the website then revokes its access at Google and deletes the stored access, and no new calendar entries or Meet links are created (entries already in her calendar stay there until she deletes them). Access can also be revoked directly in the Google Account at myaccount.google.com/permissions.

8. Transfers outside Norway and the EU/EEA

Some providers (for example Vercel, Neon, Resend and Google) may process data in the United States. Where they do, the transfer is protected by safeguards approved under the GDPR, such as the EU standard contractual clauses or the EU–US Data Privacy Framework.

9. How long we keep data

• Account: until you delete it or ask us to delete it.
• Bookings: as long as needed for your lessons, and up to 5 years after the end of the accounting year where Norwegian bookkeeping rules require it for payments.
• Form messages: in Hata's inbox as long as needed to answer and follow up, normally no longer than 12 months unless they lead to a booking or agreement.
• Consent to news: until you withdraw it.
• Testimonials: until you withdraw your permission or we remove them.
• Security counters (IP addresses): about one day.
• Analytics (Hotjar): for a limited time, then deleted automatically by Hotjar (see section 4). Your analytics choice is remembered for about 6 months.
• Event tickets: the buyer's name, email address and phone number, the "Message to Hata" and the names on the tickets are erased automatically one year after the date of the event. Payment records, invoices and credit notes for the order are kept as required by Norwegian bookkeeping rules.
• Website statistics: visit records made with your consent are deleted automatically after 14 months (see section 5); the anonymous daily counters contain no personal data.

10. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted, unless we must keep it by law;
• restrict or object to our use of your data;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier use.

Email training@hatakoca.com. We answer within one month and may ask you to confirm your identity first.

11. Children

Students under 18 are booked by a parent or guardian, who also receives the messages about the lessons. We do not knowingly create accounts for children under 13.

12. Security

We protect your data with encrypted connections (HTTPS), securely hashed passwords, limited access to personal data, and rate limiting against repeated sign-in and form attempts.

13. Complaints

If you think we handle your personal data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). We would appreciate the chance to sort it out with you first.

14. Changes

If the way we use personal data changes, we update this policy and the date at the top, and tell account holders about important changes.

15. Contact

Privacy questions and requests: training@hatakoca.com, or by post to Kodnet AS, Markensgate 31, 4611 Kristiansand, Norway.