Privacy & Cookie Policy

Depending on how you use the website, we may process:

• Information you provide yourself in the contact or job application form.
• Technical usage data via Google Analytics 4.
• Your consent choice, stored locally in your browser.
• Publicly available review data from Google, which we fetch and display on the website.
• Aggregated statistics about the CUTS&CUPS Google Business Profile for internal reporting — this does not include information about individual visitors to our website.

We do not ask for sensitive personal data through the website. If you choose to write such information in the form’s free-text field yourself, we process it only to answer your enquiry.

The same form at /jobba-med-oss is used both for general contact enquiries and for job applications. Which legal basis applies depends on why you are getting in touch:

• If you contact us with a general enquiry, we process your data on the basis of our legitimate interest in being able to respond to you.
• If you send a job application, we process your data to take steps at your request prior to a possible employment contract.

We send the details you enter (first name, last name and email are required; phone number and message are optional) by email directly to CUTS&CUPS.

The data is not stored in any database on the website. What you write in the form only remains in your own browser while you are filling it in.

Data from contact enquiries and job applications is kept for as long as needed to handle the enquiry or recruitment process, and after that only if there is a legitimate or legal reason to.

We use Google Analytics 4 to understand how visitors use the website. The Analytics tag loads on every visit, but what it is allowed to send is controlled by your choice:

When consent has not been given, storage for Analytics is denied. Google’s Consent Mode can still send limited, cookieless signals to Google for measurement and modelling. Once you consent, Analytics can use cookies and send more complete measurement data.

Signals for advertising and personalisation (ad_storage, ad_user_data, ad_personalization) are always denied, regardless of your choice for Analytics. We have enabled IP anonymisation for Analytics measurement. We have not configured any Google Ads or remarketing tag on the website.

You make your choice in the banner at the bottom of the screen the first time you visit the site. You can change your choice by clearing the website’s stored browser data and reloading the page.

Your choice in the consent banner is stored locally in your browser — not as a cookie — under the key cc-consent. This information is never sent to us or to any third party.

On the home page we show an embedded Google map with our address. The map loads when the page opens, independently of your choice in the consent banner for Analytics, and establishes a connection to Google at that point. Google’s own privacy policy applies to that connection.

Booking an appointment happens with our booking partner Bokadirekt, which you are taken to via an external link when you click a booking button. From that point you leave cutsandcups.se: the booking — including details such as your name and phone number — is handled entirely by Bokadirekt, in their own service and under their own privacy policy. We do not receive or store that information.

With your consent to Analytics, we measure that a click towards Bokadirekt happened (page, button, sometimes which treatment) — never what happens after you have left our website.

Through Google OAuth, CUTS&CUPS has granted our own integration access to the CUTS&CUPS Google Business Profile, in order to:

• Fetch reviews and display them publicly on the website.
• Read visit and interaction statistics ("performance data") for internal reporting and analysis.

Access is requested with the business.manage permission, but is currently only used to read this information. We do not use the integration to change our business profile, reply to reviews, create posts, or otherwise write to Google Business Profile.

The integration is linked to CUTS&CUPS’ own Google account, not to you as a visitor. You never log in with Google on our website, and we never store your Google password.

The reviews on the home page are real, publicly available reviews from the CUTS&CUPS Google Business Profile: display name (unless left anonymously), rating, text and date, fetched as they already appear on Google. We do not add to or edit the content.

Review data is normally cached for around six hours. If Google is temporarily unreachable, the most recently available copy may be kept longer until a new update succeeds.

In addition to reviews, we read aggregated statistics about our Google Business Profile page at business level. It does not contain information about individual people, is not published on the website, and is used only internally by CUTS&CUPS.

The data we fetch from the Google Business Profile API is used only for what is described above. We do not sell Google Business Profile data, and we do not share it for other companies’ independent marketing or commercial purposes. Data may be processed by technical service providers needed to run the integration and the website, with limited access.

The OAuth token that gives our integration access is stored server-side in AWS SSM Parameter Store with restricted access and is never exposed to visitors of the website.

This integration does not imply any partnership with, or endorsement by, Google. CUTS&CUPS is an independent business using Google’s public API under Google’s own terms.

CUTS&CUPS can revoke the access we have granted our integration at any time, via the Google account’s connected apps page. If access is revoked, the integration stops working until a new authorisation is given.

We share data with the following categories of recipients, to the extent described above for each processing activity:

• Google (Analytics, Maps, Business Profile API) — Google may process and transfer data to servers outside the EU/EEA, including the US. According to Google’s own documentation, Google applies safeguards for such transfers.
• AWS, to run the website’s technical functions (the contact form via SES, secure storage of the access token via SSM, review caching via S3) — our AWS services run in AWS’s EU region in Stockholm.
• Bokadirekt — not a recipient from us, but its own, independent service that you navigate to yourself.

• Contact and job application data: see the section above.
• Analytics data (Google Analytics 4): event data is kept for 2 months and user data for 14 months, with the retention period automatically reset on new activity from the same user, according to our Google Analytics configuration.
• Your consent choice: until you delete it yourself in your browser.
• Review data from Google: cached as described above; displayed for as long as the review remains on Google Business Profile.

Depending on the legal basis and circumstances that apply to a particular processing activity, you have the right to:

• Request a copy of the personal data we process about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Request restriction of processing.
• Object to processing based on legitimate interest.
• Where applicable, request data portability.
• Where processing is based on consent (e.g. Google Analytics), withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Contact us at info@cutsandcups.se to exercise your rights. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden.

In summary, the website uses:

• Cookies from Google Analytics 4, once you have consented.
• LocalStorage to remember your consent choice (the key cc-consent).
• An embedded Google Maps map, which connects to Google independently of consent (see above).

External sites you are linked to, such as Bokadirekt, set their own cookies under their own policies.

We may update this policy if our services, processing activities or applicable legal requirements change. The date of the most recent update is shown at the top of the page.