This policy explains what we collect when you use kumaridecors.com, why we collect it, how long we keep it, and what you can ask us to do about it.
We are [LEGAL COMPANY NAME], [STREET ADDRESS, POSTCODE, CITY], CVR [CVR NUMBER]. Write to us at [PRIVACY EMAIL] or call +45 91 54 34 93.
Who is responsible for your data
[LEGAL COMPANY NAME] decides why and how your personal data is used. In data protection law that makes us the data controller.
Our address is [STREET ADDRESS, POSTCODE, CITY], and our CVR number is [CVR NUMBER].
For anything about your data, including the requests in section 9, write to [PRIVACY EMAIL]. You can also call +45 91 54 34 93.
Our approach in short
We collect what the shop needs to work, and little else.
- We do not sell your personal data.
- We do not share it so that other companies can market to you.
- Marketing from us is opt-in only, and never a condition of buying.
Buying from us does not sign you up for marketing. If you do opt in, you can withdraw at any time, and the shop keeps working exactly as before.
What we collect and why
When you create an account, we store your name, your email address and a cryptographic hash of your password. We never see the password itself. If you sign in with Google, Google gives us your name, email address, account identifier and profile picture.
When you place an order, we store your name, email address, telephone number and delivery address, along with what you bought and what it cost. We need this to take payment, deliver the goods and keep the accounting record the law requires.
Card payments are handled by Stripe. You enter your card details on Stripe's own page, not ours, so we never receive or store your card number. Stripe tells us only whether the payment succeeded.
If you pay cash on delivery, no card data exists at all.
If you are signed in, your basket is saved to your account so it follows you between devices. If you are not signed in, your basket stays in your own browser and never reaches us.
If you write to us, or use a form on the site, we keep what you wrote so that we can answer and so that we have a record of what was agreed.
Our servers keep technical logs of requests, including IP addresses, for security and troubleshooting.
For visitor statistics we use Umami, which we run on our own server. It counts page views and where visitors came from. It sets no cookies, does not follow you to other sites, and sends nothing to another company.
Marketing
You can sign up for our newsletter. We ask you to confirm by email first, so nobody can put your address on the list but you.
We keep the exact sentence you agreed to, and when you agreed to it. You can leave the list at any time, from the link in the confirmation email or in any newsletter we send.
We have not sent a newsletter yet. When we do, it will be sent through an email company on our behalf, and this page will name them before the first one goes out.
The one marketing channel we have is browser notifications. You have to turn them on yourself, and you can turn them off again in your browser or from your account at any time.
Choosing to receive order updates does not opt you into marketing. They are separate choices, and the shop treats them separately.
We do not build profiles of you for marketing, and we do not target messages by what you have bought.
Why we are allowed to use it, and how long we keep it
Data protection law requires a reason for each use. Ours are these.
- To complete an order and deliver it: we need the data to perform the contract you entered.
- To keep accounting records: we are required to by law.
- To keep the site secure and working: we have a legitimate interest, balanced against your privacy.
- To send you marketing: only with your consent, which you can withdraw.
How long we keep each thing:
- Your account, for as long as you have one. If you do not use it for [INACTIVE ACCOUNT YEARS] years, we erase it.
- Orders, for 5 years after the end of the financial year they fall in, because the Danish Bookkeeping Act requires it. After that we delete them.
- A saved basket, for [BASKET DAYS] days.
- Messages between us, for [CORRESPONDENCE YEARS] years after our last contact.
- Your newsletter subscription, until you unsubscribe. If you sign up and never confirm, we delete the address after 30 days.
- Server logs, for [SERVER LOG DAYS] days.
- Visitor statistics, in aggregate, with no way to identify you.
These limits are enforced by a job that runs every night, not by hand.
Cookies
We use cookies only where the site cannot work without them.
- A session cookie, so you stay signed in.
- A language cookie, so the site remembers whether you chose English or Danish.
That is the whole list. We set no advertising cookies and no analytics cookies.
Your basket is not a cookie. When you are not signed in it is kept in your browser's own storage, which we cannot read from our servers.
When you pay by card, Stripe sets its own cookies on Stripe's page to prevent fraud. Those are Stripe's, described in Stripe's privacy policy.
Because we set no cookies that need consent, the site has no cookie banner.
Who else sees your data
We share data only with the companies that make the shop work, and only what each one needs.
- Stripe, to take card payments.
- Resend, to send the emails about your order and your account.
- [HOSTING PROVIDER], which runs the servers the site is on.
- [CARRIER], which delivers your parcel and receives your name, address and telephone number.
- [ACCOUNTANT AND ACCOUNTING SOFTWARE], for the bookkeeping records.
- Google, if you choose to sign in with a Google account.
One more happens in your own browser rather than on our servers. If you turn on browser notifications, your browser registers with its own maker's service, Google for Chrome or Mozilla for Firefox, which then delivers each notification.
Our visitor statistics are not shared. Umami runs on our own server.
None of these companies may use your data for their own purposes.
Data that leaves the EU
Most of your data stays in the EU. Three things do not.
- Stripe is a United States company, and card payments pass through it.
- Resend processes our email in the United States.
- If you turn on browser notifications, the delivery service belongs to Google or Mozilla, both in the United States.
Each of these transfers relies on the safeguards European law requires, and we keep the paperwork for them.
If you would rather no data left the EU, you can pay cash on delivery and leave notifications off. You cannot avoid the email confirmation, because that is how we tell you the order exists.
Your rights
You can do all of this yourself, from your account, or ask us and we will do it.
- See what we hold. Your settings page has a download button that gives you a file with everything linked to your account.
- Correct it. You can edit your details in your account.
- Delete your account. Your settings page starts it, and we email you a link to confirm, because deletion cannot be undone.
- Take it elsewhere. The download is a machine-readable file another service can read.
- Object to marketing. Turn notifications off, and we stop.
- Withdraw consent you have given, at any time, without affecting what we did before you withdrew it.
Deleting your account does not delete your past orders. The law requires us to keep the record of a sale, so we remove your name, address, email address and telephone number from those orders, and keep the amounts, the dates and the order number.
The download covers what is linked to your account. An order you placed as a guest, before you had an account, is not linked to it, so it is not in the file. Ask us and we will find it.
For anything you would rather we did, write to [PRIVACY EMAIL]. We answer within a month.
Complaining to the authority
If you think we have handled your data wrongly, please tell us first, so that we can put it right.
You can also complain to the Danish Data Protection Agency, whatever we say. They are Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, and their website is www.datatilsynet.dk.
How we protect it
The whole site runs over an encrypted connection, and browsers are told to refuse an unencrypted one.
Passwords are stored only as salted cryptographic hashes. Nobody at the shop can read your password, and a stolen database does not reveal it.
The administration system is limited to the people who need it, each with their own account. Nobody can register themselves, and accounts can use a second factor from a phone as well as a password.
Backups are kept [WHERE AND WHETHER ENCRYPTED], and the servers are patched regularly.
If a breach happens that puts you at risk, we tell Datatilsynet within 72 hours and we tell you directly.
Children
The shop is meant for adults, and our terms require you to be at least 18 to order or hold an account.
We do not knowingly collect data about children. Nothing on the site targets them, and we do not profile anyone by age.
If you are a parent and believe your child has given us data, write to [PRIVACY EMAIL] and we will delete it.
Changes to this policy
The version on this page is always the one that applies, and the date it last changed is shown at the top.
If a change matters to you, we will tell you by email or with a clear notice on the site before it takes effect.
If a change needs your consent, we will ask for it rather than assume it.
Contact
[LEGAL COMPANY NAME]
[STREET ADDRESS, POSTCODE, CITY]
CVR [CVR NUMBER]
[PRIVACY EMAIL]
+45 91 54 34 93