Privacy
Privacy policy
1. Who is responsible
Studio Hafnia is the data controller for the personal data described here. Our full company identification, including registration numbers, is on the terms of sale page.
Contact for anything about data: support@studiohafnia.mom, or Fuglebakkevej 24, 2000 Frederiksberg, Denmark. We do not have a statutory data protection officer; enquiries go to the same address and are answered by a person.
2. What we collect, and why
| Data | Why we have it | Legal basis | Kept for |
|---|---|---|---|
| Name, email, telephone, delivery address, order contents and amounts | To take, pack, deliver and invoice your order, and to answer you about it | Performance of a contract (Art. 6(1)(b)) | 5 years plus the current year, because Danish bookkeeping law requires it |
| Record of the boxes you ticked at checkout | To show that you were given the terms, the privacy policy and the natural materials information before ordering | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | With the order record |
| Contact form: name, email, optional phone, subject, message | To answer your enquiry | Consent and legitimate interest (Art. 6(1)(a), (f)) | 24 months, then deleted |
| Storage advice form: name, email, what you are storing, the space, the room, damp, budget | To answer with pieces that actually fit | Consent (Art. 6(1)(a)) | 24 months, then deleted |
| Complaint and return correspondence | To handle the case and evidence its outcome | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | 3 years after the case closes |
| Basket contents and cookie choice, held in your own browser | So the shop works and so we do not ask about cookies on every page | Necessary for a service you asked for | Until you clear your browser storage |
| Server logs: IP address, request, user agent, timestamp | Security, abuse prevention and diagnosing faults | Legitimate interest (Art. 6(1)(f)) | 30 days |
We ask for a telephone number at checkout because carriers need one for delivery. It is not used for marketing.
3. What we do not do
- We do not sell or rent personal data. Not to anyone, at any price.
- We do not build profiles of you and we take no automated decisions with legal or similarly significant effects.
- We do not add you to a mailing list because you bought something or asked a question. There is no newsletter on this site at present; if we add one it will be a separate, explicit opt-in.
- We do not collect special category data, and you should not send us any.
4. Who else processes it
Only parties we need to run the shop, each under a data processing agreement, each processing only what their job requires:
- Hosting and content delivery — serves the site and keeps the server logs described above. Hosted in the EU.
- Database — stores orders and enquiries. Hosted in the EU.
- Email — sends your order confirmation and carries our correspondence.
- Carriers — receive your name, address and telephone number to make the delivery, and nothing else.
- Payment — when you pay, the payment step is handled by a regulated payment provider. We never see or store your full card number.
- Our accountant — receives invoice records to meet Danish bookkeeping requirements.
We keep processing inside the EU/EEA wherever we can. If a processor ever needs to move data outside it, the transfer runs on the European Commission’s standard contractual clauses, and you can ask us which processors those are.
5. Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything wrong;
- delete it — subject to the bookkeeping retention above, which we cannot waive for order records;
- restrict or object to processing based on our legitimate interests;
- receive it in a portable format where we hold it on the basis of consent or a contract;
- withdraw consent at any time, where consent is the basis. That does not affect processing already carried out.
Write to support@studiohafnia.mom. We answer within one month. There is no charge unless a request is manifestly excessive, and we will say so before doing anything about it. We may ask for enough information to be sure it is you asking.
6. Complaining
You can complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk. You do not have to come to us first, though we would like the chance to put it right.
7. Cookies
Non-essential cookies are only set if you say yes, and rejecting is exactly as easy as accepting. The full list and how to change your mind are on the cookie policy page.
8. Children
This shop is for adults with legal capacity to contract. We do not knowingly collect data from children, and we do not market to them. If you believe a child has given us personal data, write to us and we will delete it.
9. Security
The site runs over HTTPS. Access to order and enquiry data is limited to the people who need it to do the job, over authenticated connections. We do not store full card numbers at any point. If a breach ever put your rights at risk, we would notify Datatilsynet within 72 hours and tell you directly where the regulation requires it.
10. Changes
If this policy changes materially we will say so on this page and change the effective date. The version that applied when you placed an order continues to govern the data from that order.