Privacy policy

We look after the information you entrust to us. This policy explains in plain language which information we process, why we do it, who else gets to see it, how long we keep it, and what rights you have.

Data controller

Lumé by Trine is the data controller for the information you choose to send us. Company reg. no. 46598040. Falkoner Allé 100, 2000 Frederiksberg. You can write to us at hej@lumebytrine.dk or call +45 81 98 51 59. You will also find the details on the contact page.

We are not required to have a data protection officer (DPO) and have not appointed one. All questions about your information therefore come straight to us.

Which information do we process – and why?

When you write to us

If you use the contact form or send an email, we process the information you provide yourself – typically name, email address, possibly phone number and the content of your message. We use it solely to reply to you. The form also stores your IP address temporarily in order to curb automated spam.

When you book an appointment

Booking takes place in a booking system from Admind ApS (bestilling.nu), shown on our booking page. You typically enter name, phone number, email address and the treatment you want. Admind processes the information on our behalf as a data processor, and a data processing agreement is in place. The information is used to make and keep track of your appointment – and to send you a confirmation and a reminder.

When you are in the salon

If you tell us something about your hair or scalp that matters for the treatment – an allergy, a pregnancy or an earlier reaction to colour, for example – we only make a note of it where that is necessary to treat you safely next time. Such details are health data, and we record them only with your consent and never share them with anyone.

When you use the website

Like any web server, our web host logs technical information about the visit – including IP address, time and which page was requested. This happens for operational and security reasons. Beyond that, we only use cookies for statistics and marketing if you have said yes. It is all set out in our cookie policy.

Legal basis

We process your information on one of these bases in the GDPR:

• Article 6(1)(b) – to perform the agreement you ask for, that is your booking or the answer to your enquiry.
• Article 6(1)(f) – our legitimate interest in running the salon, including keeping the website running and protecting it against misuse.
• Article 6(1)(a) – your consent, where cookies for statistics and marketing and any notes on health matters are concerned. Consent can always be withdrawn.
• Article 6(1)(c) – legal obligations, first and foremost the Danish Bookkeeping Act's requirement to retain accounting records.

Health data is a special category and is processed only with your explicit consent under article 9(2)(a).

Who gets to see the information?

We never sell your information, and we do not pass it on to anyone other than the suppliers who help us run the salon. They may only use it on our instructions:

• Admind ApS (bestilling.nu) – booking system.
• Our web host – running the website and email.
• Google Ireland Ltd. – only if you have consented to statistics or marketing. See the cookie policy.

Beyond that, we only hand over information where the law requires it, for example to a public authority.

Transfers outside the EU/EEA

Our booking system and web host are Danish, and the information you give us stays in the EU. If you have consented to statistics or marketing, Google may transfer information about your visit to the USA. This rests on the European Commission's decision on the EU-US Data Privacy Framework and on standard contractual clauses. Without your consent, no transfer takes place.

How long do we keep the information?

• Enquiries by form or email: for as long as it takes to answer them, and as a rule no more than 12 months.
• Bookings and client records: for as long as you are a client with us, so that we can follow up on earlier treatments.
• Accounting records: five years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires.
• Notes on health matters: until you withdraw your consent, or they are no longer relevant.
• Server logs: for a short period, for operational and security reasons.

Security

The website runs encrypted (HTTPS), and access to the booking system and email is password protected. Only Trine has access to client information. Should a security breach occur that poses a risk to you, we notify the Danish Data Protection Agency within 72 hours, and you yourself if the risk is high.

Your rights

Under the GDPR you have a number of rights. Write or call us if you want to use them – it is free, and we reply within a month:

• Access – you can be told what information we hold about you, and get a copy.
• Rectification – you can have incorrect information corrected.
• Erasure – in certain cases you can have information deleted before we would do so ourselves.
• Restriction – in certain cases you can have the processing of your information restricted.
• Objection – you can object to processing that rests on our legitimate interest.
• Data portability – you can receive the information you gave us yourself in a common machine-readable format.
• Withdrawal of consent – if you have given consent, you can always withdraw it. That does not affect the lawfulness of the processing up to that point.

You are not obliged to give us information, but without a name and contact details we can neither book you an appointment nor answer your enquiry. We do not use automated decision-making or profiling that has legal effect for you.

Complaints

If you are unhappy with how we handle your information, we would very much like to hear from you first. You can also always complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark (datatilsynet.dk).

Changes to this policy

If we change the website or the way we handle information, we update this page. The date below shows when the text was last changed.

Last updated: 22 July 2026.