Privacy policy
How Synergy Massage handles your personal data under the GDPR.
Data controller
The data controller is Rafal Andersen, a sole trader registered as Andersen Innovations Studio, with Synergy Massage as a registered trading name (särskilt företagsnamn), org.nr 871228-7971. Contact: bokning@synergymassage.se.
What data we process
• Booking data: name, email, phone, treatment, appointment time. • For earlier home-visit bookings: address, postal code, city and access notes. • Analytics data (only with your consent). • Email correspondence.
Measuring booking confirmations
With your analytics consent, we can connect a later booking confirmation to your website visit. We temporarily retain pseudonymous analytics identifiers for at most 24 hours from the start of the session. The event includes the booking reference, service, value and confirmation time, but no name, email, phone, address or notes. Withdraw consent through cookie settings on the same device to stop pending transfers. If offline, we retry on your next visit; the identifiers also expire automatically. Events already transferred are not automatically recalled — contact us about deletion requests.
Optional ads measurement
You can give separate consent for ads measurement in cookie settings. Google Analytics and Google Ads can then connect ad clicks to confirmed bookings using pseudonymous visitor and session identifiers, the booking reference and value. Name, email, phone, address and notes are not included in the measurement event. This consent covers ad measurement, not personalised ads or remarketing. For a booking request confirmed later, we use no more than the consent given when the request was made; older analytics consent is never upgraded. You can choose analytics only or necessary cookies only without affecting your ability to book.
We don't collect health information via the website
We do not collect health information via the website. Health and any complaints are discussed verbally before treatment.
Purposes and legal bases
• Delivering bookings (contract, GDPR art. 6(1)(b)). • Accounting and tax records (legal obligation, Bokföringslagen). • Analytics and marketing email (consent, art. 6(1)(a)). • Service quality follow-up (legitimate interest, art. 6(1)(f)).
Recipients and processors
We rely on: Supabase (hosting/database), an email delivery provider, Google Calendar for scheduling, Google Analytics (only with consent), Google Ads (only with separate ads measurement consent) and Lovable (website platform/hosting). Transfers outside the EU/EEA may occur for Google, with appropriate safeguards (Standard Contractual Clauses).
Card payment with Stripe
When you choose card payment, Stripe’s payment page opens. Stripe handles the card and payment details you enter there. We send the booking reference, amount and currency to Stripe and retain payment status and payment and refund references to match payment to your booking. We do not store full card numbers or security codes. A temporary payment link may be kept in your browser’s session storage so payment status remains available after a refresh. The saved link stops working here after two hours.
Stripe’s privacy policyRetention
• Booking and accounting records: 7 years (Bokföringslagen). • Address and access notes for earlier home-visit bookings: deleted 3 months after the appointment. • Analytics: max 14 months. • Feedback: 2 years.
Your rights
You have the right of access, rectification, erasure, restriction, portability, objection and to withdraw consent at any time. Contact us at bokning@synergymassage.se. You may also complain to the Swedish Authority for Privacy Protection (imy.se).