Legal

HerbWoman® Privacy Policy

Last updated: June 2026

Available in 101 languages

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use herbwoman.com and all associated subdomains, create an account, purchase courses or products, or take part in the community.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Norwegian data protection law (personopplysningsloven).

1. Who is responsible for your data

HerbWoman® is operated by two companies registered in Norway. The data controller depends on the service:

Salon ASOrganization number: NO921312660MVA

Controller for: courses, digital education, community platform, memberships, certifications, and digital content.

Falkasete ASOrganization number: NO988195154MVA

Controller for: physical products, seeds, natural cosmetics, and all related sales and shipping.

Both companies are located at Skreddarstuva 141, 4160 Finnøy, Norway. For any privacy request or question, contact us through our contact form.

2. What data we collect

Depending on how you use the website, we may collect:

• Account data — your name, email address, username, password, and language preference.
• Contact data — email, and where you provide it, telephone number and postal address.
• Order and payment data — courses or products purchased, billing and delivery address, and payment confirmation. Card details are processed by our payment providers; we do not store full card numbers.
• Course data — your progress, lesson completion, quiz and exam results, assignments you submit, and certificate status.
• Community data — posts, comments, images, and other content you choose to share in the community.
• Technical data — IP address, browser type and version, operating system, and pages visited (collected automatically).
• Cookie data — see section 7.

3. Why we use your data and our legal basis

Under GDPR we must have a lawful basis for each use of your data. We rely on the following:

PurposeLegal basis

Providing your courses, account, and the services you purchasePerformance of a contract

Processing payments and fulfilling product ordersPerformance of a contract

Issuing certificates and tracking course progressPerformance of a contract

Keeping accounting and tax recordsLegal obligation (Norwegian law)

Securing the website and preventing fraud or abuseLegitimate interests

Improving our products, services, and websiteLegitimate interests

Sending newsletters and marketing emailsConsent (you may withdraw it at any time)

Non-essential cookies and analyticsConsent

4. Who we share your data with

We do not sell your personal data. We share it only with service providers (“processors”) who help us run the website and fulfil your orders, and only to the extent needed. These currently include:

• Hosting and delivery — our managed hosting provider and content delivery network, which store and serve the website.
• Payment processing — our checkout and payment providers, which process your payment securely.
• Email and customer communication — our email and customer-relationship tools, used to send transactional and (with consent) marketing emails.
• Translation — our translation system, which makes the website available in multiple languages.
• Shipping — carriers used by Falkasete AS to deliver physical orders.
• Analytics — tools that help us understand how visitors use the website, where you have consented.

All processors are bound by data-processing agreements and may use your data only on our instructions and in line with this policy.

5. International transfers

Your data is primarily stored and processed within the EU/EEA. Where a provider processes data outside the EU/EEA, we ensure an appropriate safeguard is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

We keep personal data only as long as necessary for the purpose it was collected, or as required by law:

• Account and course data — for as long as your account is active, and for a reasonable period afterwards in case you return or request your records.
• Order, payment, and accounting records — retained for the period required by Norwegian accounting and tax law.
• Community content — remains visible while your account is active; on deletion, see section 8.
• Marketing data — until you withdraw consent or unsubscribe.

7. Cookies and analytics

7.1 We use cookies and similar technologies. Essential cookies are required for the website, your account, and course progress tracking to work, and cannot be switched off.

7.2 Non-essential cookies (such as analytics) are used only where you have given consent. You can manage or withdraw consent at any time through your browser settings or our cookie controls.

7.3 If you disable essential functional cookies, we cannot verify course progress and cannot issue a certificate.

8. Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you, free of charge.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, where there is no overriding legal reason to keep it.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a portable format, or have it transferred where technically feasible.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — withdraw any consent you have given, without affecting prior processing.

To exercise any of these rights, contact us through our contact form. We will respond within one month. You may also access and update much of your data directly in your account.

9. Your right to complain

If you believe we have not handled your data properly, you have the right to lodge a complaint with a supervisory authority. In Norway this is the Norwegian Data Protection Authority (Datatilsynet). You may also contact the authority in your own EU/EEA country of residence.

10. Security

We take data security seriously and use appropriate physical, electronic, and organizational measures to protect your data, including secure hosting, encrypted connections, access controls, and regular backups. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we work continuously to protect your data.

11. Children

You must be at least 16 years old to create an account. Individuals under 18 may use the website only under the supervision of a parent or legal guardian, and payment must be made by or with the permission of an adult. We do not knowingly collect data from children under 16.

12. Changes of business ownership

If all or part of our business is transferred to another party, your data may be transferred as part of that change, where relevant. You will be informed in advance and, where the law requires, given the choice regarding your data.

13. Changes to this policy

We may update this Privacy Policy from time to time, or as required by law. The current version is always available on the website, with the “last updated” date shown above. Material changes will be communicated where appropriate.

14. Contact

For any question or request about this Privacy Policy or your personal data, contact us through our contact form, or by post to: Salon AS / Falkasete AS, Skreddarstuva 141, 4160 Finnøy, Norway.

This Privacy Policy should be read together with our Terms & Conditions.

FALKASETE AS

Skreddarstuva 141, 4160 Finnøy

NORWAY