Privacy policy

Last updated 8 September 2026

This policy explains what information Cinco Studio collects about you, what we use it for, and what rights you have.

We process personal data under the GDPR and the Norwegian Personal Data Act. We collect as little as we can, and never anything we have no use for.

1. Who is responsible

Cinco Studio is the data controller for the personal data processed through this shop.

Data controller: Cinco Studio
Email: hello@cincostudio.no
Privacy contact: Chris Valentino Sengko
Postal address: Tetenveien 11, 1960 Løken, Norway

2. What we collect

Contact details: Name, email address, phone number and delivery address. You enter these yourself at checkout.
Order details: What you bought, in which size and colour, the amount, the time and the delivery method.
Payment details: Confirmation that payment went through, which method was used, and a reference from Stripe. We never see, and never store, your full card number.
What you write to us: The content of emails or messages you send us about an order, and our reply.
Technical data: IP address, browser type and timestamps, logged by the providers that run the shop as a normal part of operations and security.
Newsletter signup: If you sign up for the newsletter we store your email address, when you signed up, which language the shop was in, and which consent wording you agreed to. We also store the IP address and browser the signup came from. That last part is the evidence that consent was actually given, which we are required to be able to show.

We use no tools that follow you across websites, and we build no profile of you.

3. What we use it for, and on what basis

Fulfilling your order: Processing, packing and shipping your items, and sending you an order confirmation and shipping notice. Basis: our contract with you (GDPR article 6(1)(b)).
Customer service, returns and complaints: Answering questions and handling withdrawals and faulty goods. Basis: our contract with you.
Payment and fraud prevention: Taking payment securely and protecting both you and us against misuse. Basis: our contract with you, and our legitimate interest in preventing fraud (article 6(1)(f)).
Accounting: Meeting our duties under the Norwegian Bookkeeping Act. Basis: legal obligation (article 6(1)(c)).
Running and securing the site: Keeping the shop up, debugging and protecting it against attack. Basis: legitimate interest.
Newsletter: Sending you news about drops and events, if you have signed up. Basis: consent (article 6(1)(a)).

The newsletter is optional, and you only get it if you signed up for it yourself at the bottom of the page. You can withdraw your consent at any time by emailing hello@cincostudio.no, and we will stop sending. We never use your email address for anything other than the newsletter you agreed to.

4. Cookies and browser storage

We use no cookies for analytics, tracking or marketing. The shop has neither Google Analytics nor any equivalent, and we share no data with ad networks. That is also why you never see a consent banner here.

This is everything stored in your browser:

Your bag is stored locally in your own browser, so it survives between visits. Its contents are not sent to us until you go to the checkout.
A cookie remembering which language you picked.
Once you reach the checkout, Stripe sets its own cookies to complete the payment securely and prevent fraud.

You can clear all of this at any time in your browser settings. Clearing it empties your bag.

If we add analytics or marketing later, we will ask for consent first and update this policy.

5. Who we share it with

We never sell personal data. To run the shop we use the following providers, which process data on our behalf under a data processing agreement:

Stripe: Takes the payment at checkout and handles your card details.
Supabase: The database holding orders, products and customer records.
Netlify: Hosts and serves the website itself.
Resend: Sends order confirmations and the other emails about your order.
Posten: Delivers the parcel. Receives your name, address, email and phone number so it can notify you.
Fiken: Accounting. Receives the details that have to appear on a sales record.

We also disclose data to public authorities where we are legally required to.

6. Transfers outside the EEA

Several of the providers above are US companies, or use sub-processors outside the EEA. Data about you may therefore be processed outside the EEA.

Such transfers happen only on a valid basis under chapter 5 of the GDPR, in practice the European Commission's Standard Contractual Clauses or a Commission adequacy decision for the receiving country.

7. How long we keep it

Order and customer records: As long as needed to complete the purchase and handle withdrawal, returns and complaints. The complaint window can run up to five years.
Accounting records: Five years after the end of the financial year, as the Norwegian Bookkeeping Act requires.
Emails and messages: While the case is open, and afterwards for as long as we need it to document what was agreed.
Newsletter signups: Until you unsubscribe. After that we keep your address and the dates you subscribed and unsubscribed, so we can show that we stopped when you asked and so you are not added back by mistake.

Once the retention period is up, the data is deleted or anonymised.

8. Your rights

You have the right to:

see what data we hold about you
have inaccurate data corrected
have data erased, where the law gives you that right
ask us to restrict processing
receive your data in a common file format so you can take it elsewhere
object to processing we carry out on the basis of legitimate interest
withdraw a consent you have given, at any time

Email hello@cincostudio.no and we will normally reply within 30 days. We may ask you to confirm who you are before releasing data, so it does not end up with the wrong person.

Some of these rights have limits. We cannot, for instance, delete a sales record that the Bookkeeping Act requires us to keep, even if you ask.

9. Security

All traffic to and from the shop is encrypted. Payment happens directly with Stripe, so card details never pass through our systems. Access to customer data is password protected and limited to those who need it to do their job.

We use no automated decision making or profiling that produces legal effects for you.

10. Children

This shop is aimed at adults. We do not knowingly collect data about children under 13, which is the age of digital consent in Norway. If you are under 18, a parent or guardian should make the purchase.

11. Complaints

Talk to us first and we will try to put it right. If you still believe we are handling your data unlawfully, you can complain to the Norwegian Data Protection Authority.

12. Changes to this policy

We update this policy when our services, our providers or the rules change. The date of the last update is shown at the top of this page.