Privacy Policy

1. Who is responsible

The data controller for the personal data described in this policy is Kodnet AS (organisation number 924712368), Markensgate 31, 4611 Kristiansand, Norway, which operates hatakoca.com and Hata Koca Vocal Atelier ("we", "us"). For any question about privacy, or to use your rights, email training@hatakoca.com.

2. What we collect and why

• Your account: name, email address and password (stored only as a secure hash). Used to run your account and show your lessons. Legal basis: our agreement with you.
• Bookings: contact name, email address and phone number; if you book for someone else, the student's name and age; the lesson type, date, time, format and price; your preferred payment method and the payment status; and any message you add. Used to plan and give your lessons and keep our records. Legal basis: our agreement with you and, once payments are recorded, our legal duty to keep accounts.
• Messages from our forms (lesson requests, Sing Like a Pro applications, event inquiries and registrations, free course sign-ups): the details you enter, such as your name, email address, phone number if given, your choices and your message, plus the page and time of sending. They are sent as an email to Hata's inbox and not stored anywhere else on the website. You also get a short automatic confirmation at the email address you gave, with a summary of your choices (never your message). Legal basis: answering your request before an agreement, and our legitimate interest in replying to messages.
• News about lessons and events: if you tick the box on the free course form, we record your consent together with your sign-up. We do not send newsletters at the moment; you can withdraw your consent at any time.
• Emails you send us: whatever you choose to include.
• Testimonials: your name as you want it shown, a short description, your words and any video, only with your permission.
• Security: your IP address is kept for about a day with a counter, to limit repeated sign-in, sign-up, booking and form attempts. Our hosting provider also keeps short-lived technical logs. Legal basis: our legitimate interest in keeping the website secure.
• Health information: if you choose to tell Hata about your health (for example voice problems), it is used only to adapt your lessons and is not shared.

Card details are entered in Stripe's secure payment form and go straight to Stripe — we never receive or store them — and we do not sell personal data.

3. Cookies and storage on your device

• Sign-in cookies from our login system keep you signed in and protect forms against misuse. They are necessary for your account and are removed when you log out or when they expire.
• Language cookie ("hk-locale") remembers whether you chose English or Norwegian, for up to one year.
• Browser storage: the booking steps keep your choices in your browser tab until the booking is finished, and the site remembers for 30 days if you dismissed the "Install app" message. If you install the website as an app, public pages are stored on your device so they also open offline.

We do not use advertising or analytics cookies. Video providers can only set cookies after you press play (see below).

4. Videos (YouTube, Vimeo and Bunny Stream)

Videos on the website are hosted by YouTube (Google), Vimeo or Bunny Stream (BunnyWay d.o.o., Slovenia). Nothing is loaded from these services until you press "Watch the Video" or a play button. When you do, the video is streamed by that provider, which receives your IP address and technical information about your browser and device, and may set its own cookies and collect viewing data under its own privacy policy. YouTube videos use YouTube's privacy-enhanced mode, and Vimeo videos are loaded with "do not track".

Bunny Stream also stores the videos we upload, such as testimonial videos, which may show the people in them. We only upload such videos with the person's permission.

5. Who we share data with

We use trusted providers who process data on our behalf. Growhubs (growhubs.com) is our data processor, and our data processing agreements are made through Growhubs. The providers are:

• Growhubs, our booking partner and data processor, for bookings and, if agreed, payments.
• Vercel (website hosting and photo storage) and Neon (database).
• Resend (sends form messages to Hata and the confirmation to you) and Google (the Gmail inbox where Hata receives them), together with the email provider of our hatakoca.com inbox.
• Bunny Stream (video hosting and streaming).

Payment providers (Stripe for card payments, and Vipps where it is offered) process payment information as independent controllers under their own privacy policies. We do not share your data with anyone else unless the law requires it.

6. Transfers outside Norway and the EU/EEA

Some providers (for example Vercel, Neon, Resend and Google) may process data in the United States. Where they do, the transfer is protected by safeguards approved under the GDPR, such as the EU standard contractual clauses or the EU–US Data Privacy Framework.

7. How long we keep data

• Account: until you delete it or ask us to delete it.
• Bookings: as long as needed for your lessons, and up to 5 years after the end of the accounting year where Norwegian bookkeeping rules require it for payments.
• Form messages: in Hata's inbox as long as needed to answer and follow up, normally no longer than 12 months unless they lead to a booking or agreement.
• Consent to news: until you withdraw it.
• Testimonials: until you withdraw your permission or we remove them.
• Security counters (IP addresses): about one day.

8. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have your data deleted, unless we must keep it by law;
• restrict or object to our use of your data;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier use.

Email training@hatakoca.com. We answer within one month and may ask you to confirm your identity first.

9. Children

Students under 18 are booked by a parent or guardian, who also receives the messages about the lessons. We do not knowingly create accounts for children under 13.

10. Security

We protect your data with encrypted connections (HTTPS), securely hashed passwords, limited access to personal data, and rate limiting against repeated sign-in and form attempts.

11. Complaints

If you think we handle your personal data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). We would appreciate the chance to sort it out with you first.

12. Changes

If the way we use personal data changes, we update this policy and the date at the top, and tell account holders about important changes.

13. Contact

Privacy questions and requests: training@hatakoca.com, or by post to Kodnet AS, Markensgate 31, 4611 Kristiansand, Norway.