Privacy policy
Data controller
We are the data controller for the processing of the personal data we receive about our customers. You will find our contact details below.
Disc Tree ApS
Jernholmen 36, st, th
2650 Hvidovre, Denmark
CVR no.: 42040134
Background
We process personal data in accordance with the applicable data protection legislation, including the Danish Data Protection Act. Personal data is any information about an identified or identifiable natural person. In other words, it is any kind of information that can be linked, directly or indirectly, to a person. Read more about personal data (in Danish).
The purposes of processing your personal data
We process your personal data for the following purposes:
- Processing your order
- Replying to messages from you
- Checking that club discounts are only used by members of the club in question
- Marketing and newsletters, if you have given your consent.
When you have questions for us
When you have questions about our site, or want to hear more about our services, you can contact us via:
- The contact form on the website
- Email (see the contact details above)
- The chat on the website
We process your personal data through these channels so that we can answer your questions or provide a service to you. We only process the information you give us in the course of our communication. We will typically process the following ordinary information: name, email and phone number, and we only keep it to handle your enquiry or order.
Our legal basis for processing this personal data depends on the purpose of the processing. When we answer your questions, our legal basis is Article 6(1)(f) of the General Data Protection Regulation, and in the situation described under “When you are a customer with us”, the legal basis is Article 6(1)(b) of the General Data Protection Regulation.
We delete our stored communication with you no later than six months after our most recent contact. This applies as a general rule. Should a particular case require us to keep your personal data for longer, that may happen.
When you are a customer with us
When you are a customer with us, we naturally need to register some information about you or your company to meet our obligations. This means that we also process the following ordinary personal data: name, address, company name, company registration (CVR) number, contact person, phone number, email, website and payment information.
To the extent that we process personal data about our customers, our legal basis is the agreement we enter into with you, cf. Article 6(1)(b) of the General Data Protection Regulation.
We keep the information for as long as you are a customer with us. Once the customer relationship ends, we delete the personal data when any outstanding matters between us are settled. However, we are required to keep accounting records for at least 5 years after the most recently filed annual accounts.
When you visit our website
See more about how we use cookies in our cookie policy. We use cookies under the Danish Executive Order on Cookies. We use cookies to remember settings, for statistics and for targeted advertising where the user has given consent. See the guide at MineCookies.org (in Danish) for how you can delete cookies on your device at any time: https://minecookies.org/cookiehandtering/
Shopify Network Intelligence and Enhanced Services
Our webshop is hosted by Shopify. When you visit our webshop or make a purchase, your personal data is also processed by Shopify. Shopify may use this data, together with data from other merchants, to provide so-called "Enhanced Services": services intended to improve and protect our business and the businesses of other merchants.
These services are based on analyses of customer behaviour across webshops, and can be used, among other things, to prevent fraud and to improve the shopping experience.
Shopify may share your information with other third parties, including in countries outside the EU/EEA, to the extent necessary to provide these services. Transfers to third countries only take place where appropriate safeguards are in place, for example standard contractual clauses.
You can read more in Shopify’s Privacy Policy and use Shopify’s privacy portal to exercise your rights, including objecting to Shopify’s processing or withdrawing your consent.
Working with third parties
Few can do everything themselves, and the same goes for us. We therefore use external partners and suppliers (and data processors) to carry out tasks on our behalf. They may, for example, provide systems for organising our work, services, advice, IT hosting and marketing.
It is our responsibility to make sure your personal data is not misused. That is why we set high standards for our partners, and our partners must guarantee that your personal data is protected. We therefore enter into agreements to this effect with the companies that handle personal data on our behalf, to strengthen the security of your personal data.
Checking club discounts
When you use a discount code reserved for members of a specific club, we may check whether you are entitled to the discount.
To do so, we may share your name with the club in question to have your membership confirmed. We do not share information about your purchases or any other customer information.
This processing is based on our legitimate interest in ensuring that club discounts are only used by eligible members, cf. GDPR Article 6(1)(f).
You have the right to object to this processing. You can read more about your rights and contact us using the details in this privacy policy.
Disclosure of personal data
We do not disclose your personal data, except for your name to a club when we check a club discount, as described under Checking club discounts.
Third countries
Your personal data is processed by us. However, we also use suppliers who act both as independent data controllers and as data processors. After all, no one can manage everything alone. We are required to inform you, as the person whose personal data we process, that data may be transferred to third countries. Google, for example, is our data processor when we send emails to our customers and partners. Google processes our data in the EU.
The USA is a third country, and special requirements apply to transferring personal data to third countries. However, the EU allows us to use data processors in the USA, for example when they provide the necessary safeguards in the form of standard data protection clauses.
Security of processing
We process your personal data in accordance with data protection legislation and the legislation that applies to our line of business.
Taking good care of our customers' information is essential to us. That is why we have implemented technical and organisational measures that allow us to meet our responsibilities as data controller.
Technical and organisational measures
People make mistakes, which is why we train all employees in our guidelines for good data processing practice. We do this to reduce the number of errors and to keep improving how we process data. We have also introduced an IT security policy, which sets the direction for the company's overall security.
We continuously assess the need to encrypt or pseudonymise personal data as a way of reducing risk.
To keep our data secure, we change our passwords regularly, update our systems and keep up to date with developments in IT, so that we can protect ourselves against vulnerable IT systems and current IT threats.
Your rights
Under the General Data Protection Regulation, you have a number of rights regarding our processing of information about you. If you want to exercise your rights, please contact us.
Right of access
You have the right to access the information we process about you, along with a range of further information.
Right to rectification
You have the right to have inaccurate information about yourself corrected.
Right to erasure
In particular cases, you have the right to have information about you erased before the time of our ordinary, general erasure.
Right to restriction of processing
In certain cases, you have the right to have the processing of your personal data restricted. If you have the right to have the processing restricted, we may from then on only process the data, other than storing it, with your consent, for the establishment, exercise or defence of legal claims, or to protect a person or important public interests.
Right to object
In certain cases, you have the right to object to our otherwise lawful processing of your personal data. You can also object to the processing of your information for direct marketing.
Right to data portability
In certain cases, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have this personal data transferred from one data controller to another without hindrance.
You can read more about your rights in the Danish Data Protection Agency's guidance on the rights of data subjects, which you will find at www.datatilsynet.dk.
Complaints to the Danish Data Protection Agency
You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you are not satisfied with the way we process your personal data. You will find the Danish Data Protection Agency's contact details at www.datatilsynet.dk.