Privacy and Personal Data Protection Policy

Effective Date: October 12, 2026

1. Overview

Protecting the personal information of our customers and website visitors is an important part of operating our online store.

This Privacy Policy explains what information may be collected when individuals browse our website, place orders, communicate with customer support, or use related services. It also describes the purposes of data processing, the circumstances in which information may be shared, and the rights available to individuals.

Personal information is handled in accordance with applicable data protection legislation, including the European Union General Data Protection Regulation (GDPR) where relevant.

This policy applies to personal data processed in connection with our online retail operations.

2. Information We Collect

The categories of personal information processed depend on the services requested and the way individuals interact with our website.

Information Supplied by Customers

When customers purchase products or contact our support team, we may collect:

• Full name and contact information.

• Email address and telephone number.

• Billing and delivery addresses.

• Order numbers and purchase details.

• Transaction and payment confirmation records.

• Shipping and delivery information.

• Return, refund, and exchange requests.

• Customer support correspondence.

• Information voluntarily submitted through forms or communications.

Information Collected During Website Visits

Certain technical information may be processed when visitors access the website, including:

• IP addresses.

• Browser type and operating system.

• Device characteristics.

• Access dates and times.

• Pages visited and navigation activity.

• Referring websites.

• Technical error and security logs.

• Cookie identifiers and related information, where permitted.

Payment Information

Payments may be facilitated by independent payment service providers.

These providers may collect information necessary to authorize and complete transactions.

We may receive payment confirmations, transaction references, and limited details required for refunds, accounting, or customer assistance.

Complete payment card details are processed according to the arrangements of the relevant payment provider.

3. Why Personal Information Is Used

Personal data may be processed for the following purposes.

Order Fulfillment

To receive and confirm purchases, arrange payment processing, coordinate shipping, and provide delivery-related communications.

Customer Assistance

To respond to questions, investigate concerns, manage cancellations, process returns and refunds, and resolve after-sales matters.

Website Operation

To maintain essential website functionality, identify technical problems, improve system reliability, and support secure online transactions.

Fraud Prevention and Security

To detect suspicious activities, prevent unauthorized access, and protect customers and website infrastructure.

Service Improvement

To evaluate website functionality and improve navigation, product information, and customer experience where permitted by law.

Marketing Communications

To provide promotional communications where a valid legal basis exists, including obtaining consent where required.

Legal Compliance

To maintain records and fulfill applicable tax, accounting, consumer protection, and regulatory obligations.

4. Legal Basis for Data Processing

Where the GDPR applies, personal data is processed only when an appropriate legal basis exists.

The relevant legal grounds may include:

Performance of a Contract

Processing information necessary to complete purchases, arrange delivery, provide contractual services, and administer returns or refunds.

Compliance with Legal Obligations

Processing information required for accounting, taxation, financial reporting, and other legally mandated purposes.

Legitimate Interests

Processing information where necessary for legitimate operational interests, such as website security, fraud prevention, and appropriate business administration, provided these interests are not overridden by individuals' rights and freedoms.

Consent

Processing information based on a freely given, specific, informed, and unambiguous indication of consent where legally required.

Where processing relies on consent, individuals may withdraw that consent at any time without affecting the lawfulness of processing previously performed.

5. Cookies and Similar Technologies

Our website may use cookies and comparable technologies to support website functionality and improve the browsing experience.

These technologies may serve different purposes.

Essential Cookies

Necessary technologies may support shopping cart operations, checkout functions, website security, and session management.

Preference Cookies

Where enabled, these may remember user choices such as language or display preferences.

Analytics Cookies

Where enabled, these may help evaluate website traffic, identify performance problems, and understand visitor interaction.

Advertising Cookies

Where enabled, these may support advertising measurement or personalized advertising in accordance with applicable privacy requirements.

Where applicable law requires consent for non-essential cookies or tracking technologies, those technologies will not be activated before valid consent is obtained.

Visitors must be able to exercise the consent choices required by applicable law.

Browser settings may also provide options to block or delete cookies, although disabling certain essential technologies may affect website functionality.

6. How Personal Information May Be Shared

Personal information may be disclosed to external service providers when necessary to operate the website and deliver requested services.

Depending on actual business arrangements, recipients may include:

• Payment processing organizations.

• Shipping companies and delivery operators.

• Website hosting and infrastructure providers.

• Technical maintenance and cybersecurity providers.

• Customer service and communication systems.

• Analytics providers, where applicable.

• Advertising service providers, where applicable.

• Professional advisers and compliance service providers.

Information should be shared only to the extent reasonably necessary for the relevant purpose.

Where external providers process personal data on our behalf, appropriate contractual and organizational safeguards will be implemented as required by law.

We do not sell customer contact information as a separate commercial product.

Personal information may also be disclosed when required by applicable legislation, a valid court order, or a lawful request from a competent public authority.

7. Third-Party Payment and Online Services

External providers may independently process information when customers use payment facilities or other integrated services.

Such processing may be necessary for payment authorization, fraud prevention, regulatory compliance, transaction verification, or service delivery.

Independent providers may have their own privacy notices explaining their data processing activities.

Customers are encouraged to review those notices when using the relevant services.

The use of an external provider does not remove data protection obligations that remain applicable to our own processing activities.

8. Website Analytics and Advertising Technologies

Our website may use analytics or advertising measurement technologies if those services are enabled.

Such technologies may process device identifiers, browsing information, and website interaction records for purposes such as:

• Measuring website traffic.

• Evaluating technical performance.

• Understanding visitor navigation.

• Measuring advertising conversions.

• Assessing marketing effectiveness.

• Identifying operational improvements.

Any non-essential analytics or advertising technology requiring consent will be subject to the applicable consent requirements.

The collection and use of information must reflect the technologies actually deployed on the website and the privacy choices made by visitors.

Where relevant, visitors may also consult the privacy notices of the independent service providers involved.

9. International Data Transfers

Some service providers may operate in countries outside the European Economic Area.

As a result, personal information may be transferred internationally or accessed from another jurisdiction.

Where the GDPR applies and personal data is transferred to a country without an applicable adequacy decision, appropriate legal safeguards will be implemented.

These may include European Commission Standard Contractual Clauses and additional protective measures where necessary.

Individuals may request further information about relevant transfer safeguards using the privacy contact details provided below.

10. Personal Information Retention

Personal information is retained only for as long as necessary to fulfill legitimate processing purposes or comply with applicable legal obligations.

Retention periods may differ according to the category and purpose of the information.

Purchase and transaction records may be retained to meet accounting, taxation, and consumer protection requirements.

Customer service records may be retained as reasonably necessary to resolve inquiries, process after-sales requests, and maintain relevant documentation.

Technical and security information may be retained for appropriate periods necessary to maintain website security and investigate incidents.

Marketing information processed on the basis of consent will be reviewed when consent is withdrawn, subject to any lawful retention requirements.

When information is no longer required, it will be deleted, anonymized, or otherwise processed in accordance with applicable law.

Where legally required, additional information about retention periods or the criteria used to determine them may be provided upon request.

11. Information Security

We recognize the importance of protecting personal information against unauthorized access, accidental loss, alteration, disclosure, and misuse.

Appropriate technical and organizational security measures will be implemented according to the nature of the information and the relevant risks.

Depending on the systems used, these measures may include:

• Secure transmission protocols.

• Access restrictions.

• Authentication controls.

• Technical maintenance and security updates.

• Monitoring of suspicious activities.

• Appropriate data backup procedures.

• Service provider security requirements.

• Incident investigation and response procedures.

Although reasonable security measures can reduce risks, no internet-based system can guarantee absolute protection against every potential security incident.

Individuals who suspect unauthorized access to their information may contact customer support.

12. Rights Concerning Personal Information

Individuals whose personal data is protected under the GDPR may exercise certain rights, subject to applicable conditions and exceptions.

Right of Access

Request confirmation of whether personal information is processed and obtain access to relevant data.

Right to Rectification

Request correction of inaccurate information or completion of incomplete records.

Right to Erasure

Request deletion of personal information where a recognized legal ground for erasure applies.

Right to Restriction of Processing

Request restrictions on processing activities in circumstances provided by law.

Right to Data Portability

Where applicable, request personal information in a structured, commonly used, machine-readable format.

Right to Object

Object to certain processing activities, including processing based on legitimate interests where the legal conditions are satisfied.

Individuals may object at any time to the processing of their personal data for direct marketing purposes.

Right to Withdraw Consent

Withdraw consent at any time when consent is the legal basis for processing.

Rights Regarding Automated Decision-Making

Where applicable, individuals may exercise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Privacy requests may be submitted to:

bartoldusmareanrt236@gmail.com

We may request reasonable information to verify the identity of a requester before disclosing or modifying protected personal data.

Where the GDPR applies, requests will normally be answered within one month. Legally permitted extensions may apply, with notice provided within the initial response period.

13. Privacy Complaints

Individuals who believe that their personal information has been processed contrary to applicable law may contact us to raise their concerns.

They may also have the right to submit a complaint to a competent data protection supervisory authority.

For matters supervised in Denmark, the relevant authority is:

Danish Data Protection Agency (Datatilsynet)

Website: https://www.datatilsynet.dk

Individuals may also have the right to lodge a complaint with the supervisory authority in their country of habitual residence, place of work, or the location of an alleged infringement.

Contacting our support team first is encouraged but is not a prerequisite for exercising statutory complaint rights.

14. Children's Personal Information

Our online shopping services are not specifically directed toward children who lack the legal capacity to make the relevant purchases.

We do not intentionally seek to collect children's personal information in circumstances where doing so would be unlawful.

Where parental consent or another legal authorization is required, the relevant requirements must be satisfied.

Parents or guardians who believe that a child's personal information has been collected inappropriately may contact us at:

bartoldusmareanrt236@gmail.com

We will review the matter and take appropriate action in accordance with applicable law.

15. External Websites

Our website may provide links to independently operated websites or online services.

Such websites may follow privacy practices different from those described in this policy.

When visitors access an external website, that provider's privacy terms may apply.

We encourage individuals to review the relevant privacy notices before sharing personal information with independent providers.

16. Personal Data Security Incidents

If a security incident involving personal data occurs, appropriate steps will be taken to investigate, contain, and address the issue.

Where required by the GDPR, a reportable personal data breach will be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will be informed without undue delay unless a lawful exception applies.

The response will depend on the circumstances and applicable legal obligations.

17. Changes to This Privacy Policy

This Privacy Policy may be revised to reflect changes in applicable legislation, website operations, service providers, technology, or personal data processing activities.

Updated versions will be published with a revised effective date.

Where material changes require additional notification or consent, the applicable legal requirements will be followed.

Visitors are encouraged to review this policy periodically.

18. Business Information and Privacy Contact

Questions concerning this Privacy Policy, personal information, cookies, data protection rights, or related privacy matters may be directed to:

Legal Business Name: Erma Industri Lædervarer v/Erling Mathiasen

Business Registration Number (CVR): 13705739

Business Structure: Sole Proprietorship

Registered Business Address: Nørremarksvej 67, 9440 Aabybro, Denmark

Privacy and Customer Support Email: bartoldusmareanrt236@gmail.com

We will review privacy-related requests and respond in accordance with applicable data protection requirements.

This policy does not restrict any mandatory rights or protections granted by applicable privacy legislation.