Last updated: 8 August 2026
Your privacy matters to us. This policy explains what personal data Laga collects, why we collect it, and how we protect it — in compliance with GDPR and the Norwegian Personal Data Act (Personopplysningsloven).
LAGA CO AS ("Laga", "we", "us"), organisasjonsnummer 938 176 663, Møllergata 8, 0179 Oslo, Norway, is the data controller for personal data processed through this platform. We are established in Oslo, Norway and operate under Norwegian law, which incorporates the EU General Data Protection Regulation (GDPR) via the Personal Data Act (Personopplysningsloven). Contact: support [at] laga.studio
We collect the following categories of personal data: • Account data: name, email address, profile photo. • Booking data: workshop selections, dates, number of participants, payment confirmation references. • Host/Artist data: business name, bank account details (processed by Stripe), workshop descriptions and images. • Communication data: messages sent through our platform, customer support correspondence. • Business enquiry data: where you contact us through our "For companies" page, the company name, contact name, work email, phone number, team size, preferred dates and the content of your message. • Usage data: pages visited, search queries, device type and browser (collected via anonymised analytics). • Technical error data: when something goes wrong, our error monitoring records the technical context of the failure — internal reference numbers such as a booking or payment identifier, never your name, email address or IP address. We do not collect sensitive personal data (health, biometric, political views) unless you voluntarily provide it in a message or booking note.
We process your personal data under the following legal bases (GDPR Art. 6): • Contract performance (Art. 6(1)(b)): to fulfil your bookings and provide access to your account. • Legitimate interests (Art. 6(1)(f)): to prevent fraud, improve platform security and reliability, and send service-related communications. • Pre-contractual steps (Art. 6(1)(b)): to respond to a business enquiry you send us through the "For companies" page. • Legal obligation (Art. 6(1)(c)): to maintain financial records required by Norwegian accounting law. • Consent (Art. 6(1)(a)): for marketing emails, where you have opted in.
Your data is used to: • Create and manage your account. • Process bookings and payments via Stripe. • Send booking confirmations, reminders, and receipts by email. • Display workshop reviews (name or username only). • Give the host the details they need to run the session you booked. • Respond to business and team-building enquiries you send us. • Comply with Norwegian VAT and accounting obligations. • Improve the platform through anonymised usage analytics, and diagnose technical failures through error monitoring. • Send marketing emails (only with your explicit consent, which you can withdraw at any time).
We share your data with the following service providers, who act as data processors on our behalf and are bound by GDPR-compliant data processing agreements (except where noted otherwise): • Stripe: payment processing and payout management. Data processed in the EU. Stripe acts as an independent controller for its own regulatory obligations. Privacy policy: stripe.com/privacy. • Supabase: database and authentication infrastructure, hosted in Stockholm (eu-north-1). • Vercel: web hosting, deployed to the Frankfurt (fra1) region, and cookieless audience measurement (Vercel Analytics). • Resend: transactional email delivery. • Sentry: error monitoring, EU region. Configured not to send IP addresses or cookies; error reports carry internal reference numbers only. • Billie: 30-day invoice (faktura) payment for business bookings, where that option is offered to you. We also share with the workshop host the data they need to run the session you booked — your name, the booking details, and anything you chose to tell them (an allergy, an accessibility need). Hosts are independent businesses and are separate data controllers for that data; they are contractually bound to use it only to deliver your workshop and never for their own marketing. We do not sell your personal data. We do not share your data with third parties for marketing purposes without your explicit consent.
We retain your personal data for the following periods: • Account data: for as long as your account is active, then deleted or anonymised within 12 months of closure, unless a longer period is required by law. • Booking and payment records: 5 years, as required by Norwegian accounting law (Bokføringsloven). • Business enquiries via the "For companies" page: 24 months from your last contact with us, unless the enquiry leads to a booking, in which case the booking record's retention period applies. • Technical error reports: 90 days. • Analytics data: anonymised and retained indefinitely. • Marketing consent records: until withdrawn, plus 1 year.
All personal data is stored and processed within the European Economic Area (EEA). Our database is hosted in Stockholm, Sweden, and our web servers run in Frankfurt, Germany. No data is transferred to countries outside the EEA without an appropriate legal mechanism (Standard Contractual Clauses or adequacy decision).
Under GDPR and the Norwegian Personal Data Act, you have the following rights: • Right of access (Art. 15): request a copy of your personal data. • Right to rectification (Art. 16): request correction of inaccurate data. • Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"). • Right to restriction (Art. 18): request that we limit processing of your data. • Right to portability (Art. 20): receive your data in a structured, machine-readable format. • Right to object (Art. 21): object to processing based on legitimate interests or direct marketing. • Right to withdraw consent: at any time, for processing based on consent (e.g. marketing emails). To exercise any right, contact: support [at] laga.studio. We will respond within 30 days.
Laga uses only essential cookies, which are required for authentication, session management and security. These cookies are strictly necessary to provide the service you have asked for, so they do not require consent under the Norwegian Electronic Communications Act (ekomloven § 2-7b). Our audience measurement is provided by Vercel Analytics, which is cookieless: it stores no cookie or identifier on your device and produces aggregated, anonymised statistics only. We do not use advertising or third-party tracking cookies. You may block or delete cookies through your browser settings, but doing so will prevent you from staying signed in.
We apply appropriate technical and organisational measures to protect your personal data, including TLS encryption in transit, row-level security in our database, and access control limiting who can view personal data within our organisation.
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at www.datatilsynet.no. We would, however, appreciate the opportunity to address your concern directly first — please contact support [at] laga.studio.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify registered users of material changes by email at least 14 days before they take effect. The date at the top of this page indicates when the policy was last revised.