Privacy & Cookie Policy

1. General 

1. This policy on the processing of personal data (“Privacy Policy”) describes how Karmameju ApS (“Karmameju”, “us”, “our”, “we”) collects and processes information about you. 
2. This Privacy Policy applies to personal data that you provide to us or that we collect via the Karmameju ApS website, karmameju.dk (“the Website”).
3. Karmameju is the data controller for your personal data. Any enquiries to Karmameju can be made using the contact details set out in section 7.

2. What personal data we collect, for what purposes, and the legal basis for processing

1. When you visit the Website, we automatically collect information about you and your use of the Website, for example, the type of browser you use, the search terms you enter on the Website, your IP address (including your network location) and information about your computer.
   1. The purpose is to optimise the user experience and the Website’s functionality, as well as to carry out targeted marketing, including retargeting via Facebook and Google. This processing of information is necessary for us to pursue our legitimate interests in improving the Website and showing you relevant offers. 
   2. The legal basis for the processing is Article 6(1)(f) of the EU General Data Protection Regulation.
2. When you purchase a product or communicate with us via the Website, we collect the information you provide yourself, such as your name, address, email address, telephone number, payment method, details of the products you have purchased and any you may have returned, delivery preferences, and the IP address from which the order was placed.
   1. The purpose is to enable us to deliver the products you have ordered and, in general, to fulfil our agreement with you, including to manage your rights to return goods and make complaints. We may also process information about your purchases to comply with legal requirements, including for bookkeeping and accounting purposes. When you make a purchase, your IP address is collected for this purpose and to safeguard our legitimate interest in preventing fraud. 
   2. The legal basis for the processing is Article 6(1)(b), (c) and (f) of the EU General Data Protection Regulation. 
3. When you subscribe to our newsletter, we collect information about your name, email address and, where applicable, your mobile number.
   1. The purpose is to safeguard our legitimate interest in being able to send you newsletters. Your email address and name are shared with MailChimp and Klaviyo, which handle the distribution of our emails. Our emails may contain marketing, sales material, inspiration, invitations, vouchers, stories and articles on various topics from Karmameju and our partners. 
   2. We do not sell your information, nor do we share it with other companies for marketing purposes.
   3. As a general rule, we will send you a maximum of 1–4 emails per month. At times, this may be more or fewer, depending on the content and the season.
   4. The legal basis for processing your data is Article 6(1)(f) of the EU General Data Protection Regulation.

3. Recipients of personal data

1. Information regarding your name, address, email address, telephone number, order number and specific delivery requests is passed on to the warehouse and carriers responsible for delivering the purchased goods to you. Your information is also shared with our technical partner for the purpose of operating the Website in conjunction with us.
2. Information may be provided to external partners who process the information on our behalf. We use external partners for, amongst other things, the technical operation and improvement of the Website, the sending of newsletters and targeted marketing, including retargeting, as well as for your evaluation of our business and products. These companies are data processors acting under our instructions and process data for which we are the data controller. The data processors are not permitted to use the information for any purpose other than fulfilling the agreement with us, and are bound by confidentiality obligations regarding this information. We have entered into written data processing agreements with all data processors who process personal data on our behalf.
3. Two of these data processors, Google Analytics (operated by Google LLC) and Facebook Inc., are established in the USA. The necessary safeguards for the transfer of data to the USA are ensured through the data processor’s certification under the EU-US Privacy Shield, in accordance with Article 45 of the EU General Data Protection Regulation.
   1. A copy of Google LLC’s certification can be found here:https://www.privacyshield.gov/ps/participant?id=a2zt000000001L5AAI
   2. A copy of Facebook Inc.’s certification can be found here: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

4. Your rights

1. In order to ensure transparency regarding the processing of your data, we, as the data controller, must inform you of your rights. 
2. The right of access 
   1. You are entitled at any time to request access to the information we have recorded about you, the purpose for which it has been recorded, the categories of personal data and any recipients of the data, as well as information on the source of the data. 
   2. You have the right to receive a copy of the personal data we process about you. If you wish to receive a copy of your personal data, please send a written request to info@karmameju.com. You may be asked to provide proof of your identity.
3. The right to rectification 
   1. You have the right to have any inaccurate personal data about yourself rectified by us. If you become aware of any errors in the information we have recorded about you, please contact us in writing so that the information can be corrected. 
   2. You can correct information that we have collected in connection with your registration for our customer club yourself by logging in to your user profile.
4. The right to erasure 
   1. In certain cases, you have the right to have all or some of your personal data erased by us, for example if you withdraw your consent and we have no other legal basis for continuing to process your data. To the extent that continued processing of your data is necessary – for example, to enable us to comply with our legal obligations, or to establish, exercise or defend legal claims – we are not obliged to delete your personal data. 
5. The right to restrict processing to storage  
   1. In certain cases, you have the right to have the processing of your personal data restricted to storage only, for example if you believe that the information we are processing about you is incorrect.  
6. The right to data portability 
   1. In certain circumstances, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transfer this data to another data controller.
7. The right to object 
   1. You have the right at any time to object to our processing of your personal data for the purposes of direct marketing, including the profiling carried out to enable us to target our direct marketing.
   2. You also have the right, at any time, on grounds relating to your particular situation, to object to the processing of your personal data that we carry out on the basis of our legitimate interests, cf. sections 2.1 and 2.3.
8. The right to withdraw consent 
   1. You have the right at any time to withdraw any consent you have given us for a specific processing of personal data, including the profiling carried out in relation to you as a member of the customer club. If you wish to withdraw your consent, please contact us at customerservice@karmameju.com.
9. The right to lodge a complaint 
   1. You have the right at any time to lodge a complaint with the Danish Data Protection Agency, Borgergade 28, 5, 1300 Copenhagen K, regarding our processing of your personal data. The complaint may be lodged, for example, by email at dt@datatilsynet.dk or by telephone on +45 33 19 32 00.

5. Deletion of personal data

1. Information collected regarding your use of the Website, as set out in section 2.1, will be deleted at the latest when you have not used the Website for one year. 
2. Information collected in connection with your subscription to our newsletter will be deleted when you withdraw your consent to receive the newsletter, unless we have another legal basis for processing the information. 
3. Information collected in connection with purchases you have made on the Website, as set out in section 2.2, will, as a general rule, be deleted three years after the end of the calendar year in which you made your purchase. However, information may be retained for a longer period if we have a legitimate need for longer retention, for example, if it is necessary to establish, exercise or defend legal claims, or if retention is necessary for us to comply with legal requirements. Accounting records are retained for five years until the end of a financial year to comply with the requirements of the Bookkeeping Act.

6. Security

1. We have implemented appropriate technical and organisational security measures to prevent personal data from being accidentally or unlawfully destroyed, lost, altered or degraded, and to prevent it from falling into the hands of unauthorised persons or being misused.
2. Only staff who have a genuine need to access your personal data in order to carry out their work are granted access to it.

7. Contact details
   1. Karmameju ApS is the data controller for the personal data collected via the Website.
   2. If you have any questions or comments regarding this Privacy Policy, or if you wish to exercise one or more of your rights as described in section 4, please contact:
      
      KARMAMEJU ApS
      Rentemestervej 62, 2nd floor, left
      2400 Copenhagen
      
      Tel: +45 3887 5513
      Email:customerservice@karmameju.com
   3. CVR: DK-26198771

8. Changes to the Privacy Policy
   1. Should we make any changes to our Privacy Policy, you will be notified of this on your next visit to our website.

9. Cookie Policy

Read about our cookie policy here.