Privacy Policy

1. Introduction & Controller Identity

Cie Piano Studio provides piano lessons and related educational services in Norway. When you visit our site, send us a message, or request availability, we process certain information about you. We take privacy seriously and aim to keep data handling practical, proportionate, and aligned with the General Data Protection Regulation (GDPR) as implemented in Norway through the Personal Data Act (Personopplysningsloven).

The data controller is Cie AS. Our registered address is Bjorøyvegen 332, 5177 Bjørøyhamn, Norway. Our primary contact email for privacy matters is [email protected]. At this time, we do not appoint a Data Protection Officer (DPO) because we do not engage in large-scale processing of special categories of data.

Effective Date: March 14, 2026.

2. Personal Data We Collect

The specific data we collect depends on how you interact with the site and which features you use. We aim to collect only what is necessary for providing lessons, responding to messages, maintaining website security, and (where consent is given) measuring and improving marketing performance.

• Identity and contact data: name, email address, phone number (if you provide it), and your preferred ways to be contacted.
• Form content and communications: message text you submit, lesson goals, availability, level details (beginner/returning/intermediate/exam prep), and any follow-up correspondence by email or phone.
• Technical data: IP address, browser type and version, device information, operating system, language settings, time zone, and basic diagnostics information that may be captured through server logs or security tooling.
• Usage data: pages visited, time spent on pages, referrer information, clicks and navigation paths, and interactions with site elements such as the cookie preference tools.
• Cookies and identifiers: first-party cookies that help keep the site working, and (only with consent) third-party cookies used for analytics and advertising measurement. Details are provided in Section 4 and our Cookie Policy at /cookie-policy/.
• Conversion events: signals indicating that a visitor completed an action such as sending a booking request or clicking a contact method, which may be used to measure advertising performance where consent is provided.

We do not intentionally collect special-category data (such as health information, religious beliefs, political opinions), financial account details, or government-issued identification numbers through our standard lesson inquiry process. Please avoid including such information in free-text message fields.

3. Why We Process Data & Legal Basis (GDPR Art. 6)

We process personal data only when there is a lawful basis under GDPR. In practice, this usually relates to responding to lesson inquiries, arranging lessons in Norway, improving site reliability, and (where you choose) enabling analytics and marketing measurement.

• Contact and booking requests: When you submit a form or contact us, we process the data to respond and to take steps at your request prior to entering a service arrangement. Legal basis: GDPR Art. 6(1)(b) (contract) and Art. 6(1)(a) (consent) where the form includes an explicit consent checkbox.
• Analytics (optional): If you consent to analytics cookies, we process usage information to understand how visitors use our site so we can improve lesson information pages, navigation, and performance. Legal basis: Art. 6(1)(a) (consent).
• Marketing and remarketing (optional): If you consent to marketing cookies, we may process identifiers and conversion events to measure advertising performance, build aggregated audiences, and limit irrelevant ads. Legal basis: Art. 6(1)(a) (consent).
• Security and fraud prevention: We process technical information and log data to protect the site, investigate abuse, and prevent spam submissions. Legal basis: Art. 6(1)(f) (legitimate interests). We balance this against your rights and use proportional measures.
• Legal obligations: If required by applicable law, we may process and retain certain records (for example, invoicing or accounting records). Legal basis: Art. 6(1)(c) (legal obligation).

Automated decision-making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any decisions about lesson scheduling, suitability, or format are made by humans based on the information you provide.

4. Cookies & Tracking Technologies

Cookies are small files stored on your device. We use cookies and similar technologies (such as pixel tags) to keep the website functioning, to understand usage (with consent), and to measure advertising performance (with consent). Cookie categories on this site are aligned with our Cookie Policy.

Essential cookies (always active)

Essential cookies are required for the site to function. They include cookies that maintain session continuity and store cookie preference choices. These cookies do not require your consent under ePrivacy principles when they are strictly necessary.

• _site_session: helps with basic session continuity and operational stability. Retention typically ranges from session to up to 12 months depending on configuration.
• cookie_consent: stores your cookie category choices. Retention: up to 12 months.
• CSRF / security tokens (if applicable): used to help protect forms and requests from abuse. Retention: session or limited duration.

Analytics cookies (consent required)

If you choose to allow analytics cookies, we may use Google Analytics 4 (GA4) to understand website usage. Where configured, IP anonymization is applied. Analytics helps us improve content clarity for lesson pages, reduce friction in contacting us, and diagnose performance issues.

• Examples: _ga (2 years), _ga_XXXXXXXXXX (2 years; the ID varies), plus related GA4 identifiers.
• Analytics retention in GA4 is typically configured at 14 months for event data.

Marketing cookies (consent required)

If you choose to allow marketing cookies, we may use technologies associated with advertising platforms (for example, Google Ads and Meta) to measure conversions, limit repeated ads, and show more relevant messages about piano lessons in Norway. These tools typically rely on cookie identifiers and event signals.

• Examples: _gcl_au (Google Ads, 90 days), _fbp (Meta Pixel, 90 days), _fbc (Meta click ID, 90 days when present).
• Where implemented, pixels and tags may be complemented by server-side measurement. If server-side measurement is used, it is configured to avoid collecting unnecessary information and may use hashed identifiers for matching where applicable.

For more detail on cookie names, purposes, and retention, read our Cookie Policy: /cookie-policy/.

5. Consent (EEA and UK)

Users in Norway and the wider EEA are presented with a cookie notice that allows them to accept all cookies, reject non-essential cookies, or manage preferences by category. Analytics and marketing cookies activate only after explicit consent, in line with GDPR consent requirements (freely given, specific, informed, and unambiguous).

Consent is recorded in the cookie_consent cookie (typically for 12 months). You can withdraw consent at any time by using “Manage cookie preferences” in the footer or by clearing cookies in your browser. Withdrawal does not affect processing that occurred before consent was withdrawn.

6. Sharing With Advertising & Service Partners

We use a limited set of service providers to help operate and protect the website and, where consent is provided, to measure performance and advertising outcomes. We share only what is necessary for the intended purpose.

• Google LLC (GA4, Google Ads, Tag Manager, remarketing where enabled): cookie IDs, device and usage data, conversion events. policies.google.com/privacy
• Meta Platforms (Pixel, Custom/Lookalike Audiences, Conversion API where enabled): page views, conversions, audience membership, and (where configured) hashed identifiers. facebook.com/privacy/policy
• Cloudflare (CDN and security): IP-based threat detection and site delivery optimization. cloudflare.com/privacypolicy

We do not sell personal data. Where third-party tools are used, they are configured to support our services, security, and measurement needs. These providers may process data as processors or, in some cases (for advertising products), as separate controllers for their platform-level operations. We encourage you to review their policies for full details.

7. International Transfers

Cie AS is based in Norway. Some service providers (such as Google and Meta) may process data outside the EEA/UK, including in the United States. When this happens, transfers are handled under appropriate safeguards, which may include the EU–US Data Privacy Framework (and relevant extensions) and/or Standard Contractual Clauses (EU 2021/914) as a fallback mechanism. UK and Swiss equivalents may apply where relevant.

We aim to select providers that offer suitable transfer mechanisms and technical measures. If you would like more detail about the safeguards used for a specific transfer, contact us at [email protected].

8. Data Retention

We retain personal data for only as long as needed for the purposes described in this policy. Retention depends on the nature of the data, the reason we collected it, and any legal obligations that apply.

• Contact submissions: typically retained for up to 2 years from the last interaction, unless a longer period is needed to manage an ongoing lesson relationship or resolve a dispute.
• Email correspondence: retained for the duration of the relationship and up to 1 additional year for continuity and reference, unless you request deletion and no overriding need exists.
• Server logs and security records: generally retained for up to 90 days, unless we must preserve logs for incident investigation.
• Analytics data: typically retained in GA4 for 14 months (configurable), plus cookie lifetimes as described in Section 4.
• Marketing cookies: retained according to cookie lifetimes (often 90 days) unless you withdraw consent sooner.
• Cookie consent record: we may keep a record of consent status for up to 3 years for audit and compliance purposes, primarily through the consent cookie and related logs where applicable.
• Legal and accounting records: retained as required by applicable Norwegian law where relevant.

9. Your Rights (GDPR and Norwegian Law)

Depending on your circumstances, you may have the right to request access to your personal data, request correction, request deletion, restrict processing, object to processing, and request data portability. You also have the right to withdraw consent at any time where processing is based on consent.

• Right of access (GDPR Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7(3))
• Right to lodge a complaint (Art. 77)

To exercise your rights, email [email protected]. We typically respond within 30 days. For complex requests, the response period may be extended by up to 60 additional days as permitted by GDPR.

If you believe our processing infringes applicable law, you can lodge a complaint with the Norwegian supervisory authority: Datatilsynet.

10. Children

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors without appropriate consent. If you believe a child under 16 has provided personal data through our site without verifiable parental consent, contact us and we will delete the information promptly where appropriate.

11. Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) preference. This website does not respond to DNT signals. Third-party providers (such as analytics and advertising platforms) may have their own DNT handling; you should review their documentation if this is relevant to you.

12. Data Deletion Requests

You can request deletion of personal data by emailing [email protected] with the subject line “Data Deletion Request”. We may ask for limited information to verify identity and to locate the relevant records. We aim to complete deletion within 30 days where the request is valid and no overriding legal obligation requires retention.

Please note that certain records may need to be retained to comply with legal obligations or to establish, exercise, or defend legal claims. In those cases, we will restrict processing and retain only what is required.

13. Business Transfers

If Cie AS is involved in a merger, acquisition, asset sale, financing, reorganization, or insolvency, personal data may be transferred as part of that transaction. If such a transfer materially changes how personal data is used, we will provide notice on the site.

14. California (CCPA / CPRA)

Although Cie AS operates in Norway, our website may be accessed from outside Norway, including the United States. This section describes disclosures for California residents where applicable.

In the last 12 months, we may have collected the following categories of information: identifiers (such as name, email, IP address, cookie IDs), internet or network activity (pages visited and interactions), and inferences (interests or preferences derived from browsing behavior when marketing cookies are enabled). We use this information for operating the site, responding to requests, analytics (with consent), and marketing measurement (with consent).

We do not sell personal information as defined by CCPA. We may share information for cross-context behavioral advertising when marketing cookies are enabled, and California residents may opt out through our cookie preferences panel (“Manage cookie preferences” in the footer).

California residents may have rights to know, delete, correct, and opt out of sale/sharing, as well as the right to non-discrimination. Requests can be submitted by emailing [email protected] with the subject line “California Privacy Request”. We will verify requests as required. Authorized agents must provide proof of authorization.

15. Virginia (VCDPA)

Virginia residents may have rights to access, correct, delete, obtain a copy of personal data, and opt out of targeted advertising. Requests can be sent to [email protected] with the subject line “Virginia Privacy Request”.

We do not sell personal data or engage in profiling that produces legal or similarly significant effects. If a request is denied, you may appeal by emailing with the subject line “Appeal of Refusal — Privacy Request”. We aim to respond to appeals within 60 days. If unresolved, you may contact the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified request to opt out of the sale of certain personal information by emailing [email protected] with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in how we operate the site, new service providers, or updates to legal requirements. If changes are material, we will provide a clear notice on the website at least 14 days before the updated policy takes effect when feasible. The “Last Updated” date at the top of the page reflects the latest version.

18. Contact

For questions about this Privacy Policy or how Cie Piano Studio processes personal data, contact:

• Legal entity: Cie AS
• Address: Bjorøyvegen 332, 5177 Bjørøyhamn, Norway
• Email: [email protected]
• Phone: +47 55 52 61 40