Fortrolighedspolitik

1. Introduction

Carmo A/S takes processing of your personal data very seriously, and we comply with the relevant personal data legislation in order to ensure fair and transparent processing of personal data.

This privacy policy describes how we process your personal data and applies to the website www.carmo.dk.

2. Data controller and contact information

Carmo A/S is data controller and is responsible for the data we collect and process about you. You can contact via the following contact information:

Carmo A/S
CVR-nr. 26987369
Højvangen 19
3060 Espergærde
Denmark

Contact: denmark@carmo.dk

If you have any questions regarding our processing of your personal data, you are always welcome to contact us.

3. Data We process about you

We process the following categories of data about you:

  • General information
    • Depending on which data you have provided us with, we process personal information including your name, address, telephone number or mobile number, e-mail address.
  • Company information
    • If you are contacting us on behalf of a company, we also process company name, CVR no. as well as company email and telephone number.
  • Cookies/online identifiers
    • We also process personal data in connection with our use of cookies and other online identifiers – see more in our cookie policy which you can access via this link.

Using our service is voluntary and so is our your choice to let us process your personal data.

4. Purpose and legal ground for processing

4.1 Purpose

We process your personal data for the following purposes:

  • To fulfill the contracts we enter into with our customers
  • Distribution of our products
  • Marketing of our products, including sending out newsletters via email, if we have obtained your explicit consent
  • To build profiles on our customers according to area of interests in order to make sure that they receive relevant marketing material
  • Measuring statistics of your use of our website www.carmo.dk. Please see more in our cookie policy.

We only process your personal data to the extend necessary in order to achieve the purposes under which they have been collected.

4.2 Legal grounds

We have to inform you about our legal grounds for processing your data, which are the following:

  • We send out targeted marketing emails based on your explicit consent, pursuant to the General Data Protection Regulation 2016/679/EU, article 6(1)(a) regarding consent.
  • We process your general contact information and company information in order to be able to fulfil our contract with you, pursuant to the General Data Protection Regulation 2016/679/EU, article 6(1)(b)
  • We create profiles on our customers in order to be able to send them relevant marketing material and to know our customers better. We also process data about you that we collect through our website. This processing is based on our legitimate interests in creating statistics about who visits out website and so that we can know more about our customers based on the General Data Protection Regulation 2016/679/EU, article 6(1)(f)

The General Data Protection Regulation is referred to as “GDPR” in this Privacy Policy.

5. Where do we collect your data from?

We process personal data about you that we collect in connection with our communication with your, when you sign up for our newsletter and when you visit our site. We process your personal data in order to be able to carry out our business and to be able to contact our customers.

6. Recipients of data

6.1 Transfer of data

We do not pass on or transfer your personal data to anyone unless we have obtained your explicit consent to do so. However, we will also disclose your data to public authorities upon request if we are obliged to do so and will cooperate with relevant authorities including the police, if we experience any illegal activities.

6.2 Data processors

In order to provide you with our service we use the following data processors

  • SiteGround
  • Google Inc.
  • Mailchimp
  • Next A/S

7. Transfer to third contries

We will in certain situations in connection with our processing of your personal data transfer such data to our data processor outside the EU/EFTA, including the USA.

The European Commission considers the United States as a so called unsafe third country. We only transfer your data to companies in unsafe countries, which have provided the appropriate safeguards to ensure that the recipient’s level of data protection is in compliance with the Privacy Policy and applicable legislation.

the appropriate safeguards are provided for by either that the relevant data processor has agreed to comply with the standard data protection clauses adopted by the EU-commission, or that the recipient is certified to comply with the principles for protecting personal data under the US-EU Privacy Shield. The transfer of data to unsafe third countries only takes place in a hosting environment and is used to be able to send out our newsletters. For a copy of these appropriate safe guards, please contact us.

8. Erasure

Your personal data is stored for a maximum of 5 years.

We will delete your personal data when they are no longer necessary for achieving the purposes for which the data were collected, processed and stored.

9. Right to withdraw your consent

If our processing is based on your consent, you have the right to withdraw your consent partially or wholly at any point in time.

A withdrawal does not necessarily affect the legality of the processing, which Carmo A/S has already done up until your withdrawal, and will only have effect from the time of withdrawal and onwards.

10. Your rights:

Under the GDPR you have a number of rights with regard to our processing of your information about you. You can read more about your rights in the guidelines from the Danish Data Protection Agency (Datatilsynet).

10.1 Contact information, if you want to use your rights

If you want to use any of these rights you are welcome to contact us by using the contact information provided in the beginning of this Privacy Policy.

We will process and respond to your inquiry as quickly as possible and at the latest within a month after receiving your request, unless the complexity and extent of you request makes it impossible for us to reply within a month. If that is the case, it may take us up to three months to reply to your request.

10.2 Right to access

You are entitled to gain access to the personal data, we process about you. Your access may be limited due to our protection of trade secrets, intellectual property rights or other people’s rights and freedom.

10.3 Right to rectification

If you believe the data we process about you are incorrect, you are entitled to rectification of inaccurate personal data. If we agree with you, we will correct your information as soon as possible.

Rectification or erasure of personal data will not take place if we are legally obligated to store all or parts of your personal data, or if it is necessary to store the personal data in order for a legal claim to be established or defended. In that case, we will only store the data, are legally obligated or entitled to store and will delete all other personal data about you.

10.4 Right to erasure

I special circumstances, you have the right to have your personal data deleted before our general time limits for storing of your personal data

10.5 Right restrict processing

In some situations, you have the right to restrict our processing of your personal data. If this is the case, we will only in the future process the information – except with regard to storing of data – with your consent or if it is necessary in order for a legal claim to be established or defended or to protect another person’s vital interests. In that case, we will only store the data, are legally obligated or entitled to store and will delete all other personal data about you.

10.6 Right to data portability

When we process your personal data based on your consent or a contract and the processing is automatic, you have the right to data portability.

The right to data portability means that you have a right to receive the personal data concerning you, which have informed us of, in a structured, commonly used and machine-readable format, which you have the right to transmit to another data controller (GDPR art. 20).

10.7 Right to object

At any point in time, you are entitled to object to our processing of your personal data, if the processing is based on GDPR article 6(1)(e) or (f) including profiling. You may also object if your data is processed with the purpose of sending direct marketing material to you. We will not send you direct marketing via email unless we have obtained your explicit consent.

11. Complaint

You are entitled to complain to the Danish Data Protection Agency about our processing of your personal data.

You can contact the Danish Data Protection Agency here:

Datatilsynet
Borgergade 28, 5
1300 København K
E-mail: dt@datatilsynet.dk
Tel.: +45 33193200
Website: www.datatilsynet.dk

March 27th 2018