Processing of personal data at Knitting for Olive

1 Introduction

1.1 In this privacy notice, you can learn more about how Knitting for Olive ApS ("Knitting for Olive", "we", "us", "our") processes your personal data in various situations. We provide you with this information as we are required to do so under the EU General Data Protection Regulation (the "GDPR").

1.2 Below, you will find information on the various situations where we process personal data:

when you visit our website (use of cookies),
when you sign-up to our newsletters,
when you use our web shop or create an account (B2C customers)
when you communicate with us, including on behalf of a customer (B2B), and when you represent a supplier, vendor or other third party.

2 Controller

2.1 Knitting for Olive ApS, CVR no. 39685000, Godthåbsvej 55, 2000 Frederiksberg, Denmark, acts as a data controller for the processing of personal data in connection with the below mentioned purposes.

2.2 If you have any questions about how we process personal data, please contact us at info@knittingforolive.dk, +45 31 35 37 30.

2.3 Further, in the sections below, you can read more about your right to withdraw your consent as well as your other rights.

3 Description of the processing

3.1 Below, please find the specific purposes for our data processing, the categories of personal data that we process, the legal basis for such processing, and the retention periods that we have decided (in specific situations, we may defer from our general retention periods in case of e.g., complaints, objections, or other specific situations).

3.2 When you visit our website (use of cookies)

3.2.1 We use cookies on our website. When you first visit our website, we set the cookies that are necessary for you to use our website (necessary cookies). If you consent to additional cookies (statistical cookies, marketing cookies and/or functional cookies), we will set these cookies to analyse and improve the use and performance of our website and products, to show you relevant marketing material, and to save your preferences on our website. Some marketing cookies could be owned by third parties such as Google, Meta, TikTok and Pinterest.

3.2.2 Below, you can read more on how we process your personal data when you visit our website. For further information on our use of cookies, please refer to our Cookie Policy.

Purpose	Categories	Legal basis	Retention
To ensure the functionality and security on our website (strictly necessary cookies).	Preferred language and region, username and password, the use of our website, including traffic on the pages, time, what you click, pages/products visited, browser type, keywords, IP address, information about device type (computer, smartphone, etc.), as well as the features used.	Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests in ensuring the functionality and security of our website.	Personal data obtained via cookies are stored in accordance with our cookie declaration [insert link], or when you withdraw your consent.
To compile statistics in order to optimize the user experience on our website and the services we offer (performance cookies).	Activity on our website, including location, IP-addresses, browser used, time and date of access, operating system, pages visited, web requests etc..	According to the Danish Executive Order on Cookies we are required to obtain your consent to use cookies for statistical purposes. At the same time we obtain your consent to the processing of your personal data, c.f. Article 6(1)(a) of the GDPR.	Personal data obtained via cookies are stored in accordance with our cookie declaration [insert link], or when you withdraw your consent.
To ensure functionality and personalise the browsing experience by saving information about your preferences (functional cookies)	Login details and information related to comments.	According to the Danish Executive Order on Cookies we are required to obtain your consent to use preference cookies. At the same time we obtain your consent to the processing of your personal data, c.f. Article 6(1)(a) of the GDPR.	Personal data obtained via cookies are stored in accordance with our cookie declaration [insert link], or when you withdraw your consent.
Tracking website visitors for marketing purposes, including targeted advertising (targeting cookies).	Activity on our website, including location, IP-addresses, browser used, time and date of access, operating system, pages visited, web requests etc.	According to the Danish Executive Order on Cookies we are required to obtain your consent to use targeting cookies for marketing purposes. At the same time we obtain your consent to the processing of your personal data, c.f. Article 6(1)(a) of the GDPR.	Personal data obtained via cookies are stored in accordance with our cookie declaration [insert link], or when you withdraw your consent.

3.3 When you sign up for newsletters (direct marketing)

Purpose

Legal basis

Retention

To send out newsletters (direct marketing)

Name, email address and any preferences you have given in connection with your subscription.

The consent you have given in accordance with article 6(1)(a) of the GDPR and section 10 of the Danish Marketing Practices Act.

You can read more about your right to withdraw your consent below.

Personal data pertaining to our distribution of electronic newsletters will be deleted 2 years after our last newsletter has been distributed to document that we comply with the Danish Marketing Practices, unless you have withdrawn your consent (i.e., unsubscribed) before such time.

3.4 When you use our web shop or create an account (B2C customers)

Purpose	Categories	Legal basis	Retention
Customer administration.	Name and contact details, including email, address and phone number. Payment and invoicing information, including credit card information, information about purchases and purchase history, complaints, as well as information about delivery.	Article 6(1)(b) of the GDPR, as the processing is necessary in order for us to fulfil our end of the purchase agreement. For purchase history, the legal basis is article 6(1)(f) of the GDPR, as we are pursuing our legitimate interest in offering a simple and user-friendly overview of your purchase history.	Personal data pertaining to your order will as a starting point be deleted 3 years after the end of the financial year where your last order or inquiry has been handled/concluded.
Administration of accounts on our website.	Name, address, phone number, email address and if also customers, information about purchases and purchase history.	Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interest in providing our best services and membership benefits, as well as a simple and user-friendly account with purchase history overview etc.	Personal data only pertaining to your account will be deleted 3 years after you cancelled your membership, or after 3 years of inactivity.
Bookkeeping	Information on invoices, including name, address, phone number and email address. Payment and invoicing information and information about the specific purchase.	We are obligated to store bookkeeping information, including information related to payments/transactions in accordance with the Danish Bookkeeping legislation. Our GDPR-legal basis in this regard is Article 6(1)(c).	Bookkeeping records will be stored for 5 years after the end of the financial year where your order was concluded.

3.5 When you communicate with us on behalf of a B2B customer or when you represent a business partner or other third party

Purpose	Categories	Legal basis	Retention
Communicating with you when you represent a customer, business partner, supplier, or another third party.	Name and contact information, title, and position. The relationship to the business that you represent.	Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests in managing business contacts and fulfilling any agreement, we may have concluded with the company you represent.	As long as the business relationship exists and up to 2 years after the end of the financial year in which the customer or supplier relationship has ended.
Managing customer relations, such as customer support and assistance	Name and contact information, data relating to historic reservations and transactions and any information included in your inquiry.	Article 6(1)(f) of the GDPR, as we are pursuing our legitimate interests in providing answering queries, customer support, etc.	Up to 2 years after the last inquiry.
Bookkeeping purposes.	Information stated on invoices such as name and contact details.	Article 6(1)(c) of the GDPR. The legal obligations derive from the Danish bookkeeping legislation.	Up to 5 years after the end of the financial year in which the customer or supplier relationship has ended.

4 Categories of recipients

4.1 We may process and share your personal data with external partners who process personal data on our behalf (data processors). Such external partners include e.g. providers of hosting services, IT systems and technical assistance with regard to our IT.

4.2 When you make a purchase in our web shop, we share information with the packing- and transport providers that will pack and deliver your purchased goods. We share your name, address, email address, phone number, order number and information on any specific delivery requests you may have. We also disclose your payment details to the service providers for the online payments.

4.3 On our website, you can click the icons (plug-ins) of the social media providers where we have our social media profiles (Facebook, YouTube, Instagram). When you interact with these plug-ins, the social media providers use cookies to collect and process personal data on your behaviour, in accordance with the consent you may have given.

4.4 Further, we may share your personal data with suppliers or subcontractors, if relevant in their work, insofar as reasonably necessary for the purposes set out in this privacy notice.

4.5 If necessary, e.g., in relation to any disputes or when we otherwise need external advice, we may disclose information to our advisors, such as auditors and lawyers.

4.6 We may also share it with our current and future affiliated companies and business partners, and if we are involved in a merger, asset sale or other business reorganization, we may also share or transfer your personal and non-personal information to our successors-in-interest.

4.7 Additionally, we may share personal data with public authorities such as the tax and custom authorities or with the police, if necessary to meet our legal obligations or if necesary in relation to a specific case or dispute.

5 Transfer to third countries

5.1 We transfer your personal data to countries outside the EU/EEA, when making data available to our processors and other third parties, including the US and Canada.

5.2 Unless the country in question has been approved by the European Commission as having sufficient level of protection (including companies located in the US that are covered by the EU-US Data Privacy Framework (e.g. Microsoft in the US), and Shopify which is protected under Canadian law), the basis for the transfer is the European Commission Standard Contractual Clauses.

5.3 Further, some of our processors may use sub-processors located in other countries outside the EU/EEA. You can find information on such sub-processors via the links and information below:

See a list of Microsoft's sub-processors here.
See a list of Shopify sub-processors here.
See a list of One.com sub-processors here.
See a list of Shipmondo sub-processors here.
See a list of Mailchimp sub-processors here.
See a list of Dropbox sub-processors here.

5.4 If you want additional information about our transfer of personal data to third countries, you may make a request for such additional information by contacting us (see above).

6 Your right to withdraw consent

6.1 If you no longer wish to receive newsletters, you can withdraw your consent by unsubscribing to the newsletter in each email you receive from us.

6.2 You can withdraw your consent to cookies via the link in our Cookie Policy.

6.3 In other circumstances, you can withdraw your consent by contacting us, see contact details above.

6.4 If you withdraw your consent, the withdrawal will not affect the lawfulness of processing that has already been carried out based on your consent.

7 Your other rights

7.1 As a starting point and depending on the specific situations, you have the following rights:

Right of access: You have the right to have confirmed whether collection or processing your personal data has taken place, and, if so, you have the right to request a copy of your personal data in a digital format.
Right of rectification: You have the right to require that we correct any inaccurate personal data, and that we complete incomplete personal data.
Right of erasure: In certain circumstances, you have the right to request that we erase personal data concerning you; for example, if it is no longer necessary for the purposes in which it was originally collected.
Right to restrict processing: In certain circumstances, you have the right to request that we restrict the processing of your personal data, for example, if you believe that the personal data is not accurate or lawfully processed.
Right to object to the processing: In certain circumstances, you have the right to request that we stop processing your personal data.
Right to data portability: In certain circumstances, you have the right to receive the personal data you have provided us with in a structured, commonly used, machine readable format, and the right to have us transmit the data to another entity, where technically feasible.

7.2 You can read more about your rights in the Danish Data Protection Agency's guidelines on data subjects' rights, which is available atdatatilsynet.dk (in Danish) and at datatilsynet.dk (in English). Please contact us if you wish to exercise any of your rights. The relevant contact details are stated above.

8 Complaint to a supervisory authority

8.1 If you want to lodge a complaint with a supervisory authority about our processing of your personal data, you can do so by contacting the Danish Data Protection Agency via their website, www.datatilsynet.dk.

9 California residents

9.1 The California Consumer Privacy Act (CCPA) requires us to disclose categories of personal information we collect and how we use it, the categories of sources from whom we collect personal information, and the third parties with whom we share it, which we have explained above.

9.2 We are also required to communicate information about rights California residents have under California law. You may exercise the following rights:

Right to know and access. You may submit a verifiable request for information regarding the: (1) categories of personal information we collect, use, or share; (2) purposes for which categories of personal information are collected or used by us; (3) categories of sources from which we collect personal information; and (4) specific pieces of personal information we have collected about you.
Right to equal service. We will not discriminate against you if you exercise your privacy rights.
Right to delete. You may submit a verifiable request to close your account and we will delete personal information about you that we have collected.
Request that a business that sells a consumer's personal data, not sell the consumer's personal data.

9.3 If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

9.4 We do not sell the personal information of our users.

9.5 For more information about these rights, please contact us

10 California online privacy protection act (CALOPPA)

10.1 CALOPPA requires us to disclose categories of personal information we collect and how we use it, the categories of sources from whom we collect personal information, and the third parties with whom we share it, which we have explained above.

10.2 CALOPPA users have the following rights:

Right to Know and Access. You may submit a verifiable request for information regarding the: (1) categories of Personal Information we collect, use, or share; (2) purposes for which categories of personal information are collected or used by us; (3) categories of sources from which we collect personal information; and (4) specific pieces of personal information we have collected about you.
Right to Equal Service. We will not discriminate against you if you exercise your privacy rights.
Right to Delete. You may submit a verifiable request to close your account and we will delete personal information about you that we have collected.
Right to request that a business that sells a consumer's personal data, not sell the consumer's personal data.

10.3 If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

10.4 We do not sell the personal information of our users.

Processing of personal data at Knitting for Olive

1 Introduction

2 Controller