Privacy Policy

1. Introduction and Company Information

This Privacy Policy explains how Nordisk Quilling Atelier collects, uses, stores, shares, and protects personal data when you visit our website, contact us, place an order, subscribe to updates, or otherwise interact with us.

Data Controller: Nordisk Quilling Atelier
Address: Møllebakken 12, 8250 Læring, Denmark
Email: [email protected]
Phone: +45 71 84 29 63

Nordisk Quilling Atelier is a business specializing in quilling products, custom paper art, creative workshops, and related services.

2. Data Collection and Processing

We may collect and process the following categories of personal data:

• Identification data: name, username, or similar identifiers.
• Contact data: email address, phone number, billing address, shipping address, and other contact details.
• Order and transaction data: purchased products, order history, payment status, delivery details, and customer service communications.
• Communication data: messages sent to us by email, contact forms, social media, or other channels.
• Technical data: IP address, browser type, device information, cookies, log data, and website usage information.
• Marketing preferences: subscription choices, consent records, and communication preferences.

We generally collect personal data directly from you. In some cases, we may receive data from payment providers, delivery partners, analytics providers, or publicly available sources where permitted by law.

3. Purpose of Data Processing

We process personal data for the following purposes:

• To provide and manage our products and services.
• To process orders, payments, deliveries, returns, and refunds.
• To communicate with you about inquiries, orders, and customer support.
• To organize workshops, custom quilling commissions, and related services.
• To send marketing communications where permitted and, where required, with your consent.
• To improve our website, services, product offerings, and customer experience.
• To maintain security, prevent fraud, and ensure proper operation of our systems.
• To comply with legal obligations, including accounting, tax, and consumer law requirements.

4. Legal Basis for Processing

We process personal data only where we have a valid legal basis. Depending on the context, the legal basis may include:

• Performance of a contract: when processing is necessary to fulfill an order, provide services, or take steps at your request before entering into a contract.
• Legal obligation: when processing is required to comply with applicable laws, such as accounting, tax, or consumer protection requirements.
• Legitimate interests: when processing is necessary for our legitimate business interests, provided these interests are not overridden by your rights and freedoms, such as improving services, securing systems, or handling customer inquiries.
• Consent: when you have given clear consent, for example for certain marketing communications or optional cookies where required.

5. Data Sharing and Third Parties

We may share personal data with trusted third parties only when necessary and appropriate for the purposes described in this policy. These may include:

• Payment service providers for processing payments and refunds.
• Shipping and logistics partners for delivering orders.
• IT, hosting, and cloud service providers supporting our website, email, and data storage.
• Analytics and marketing providers where applicable and in accordance with your preferences and legal requirements.
• Professional advisers such as accountants, auditors, or legal advisers.
• Public authorities where disclosure is required by law or necessary to protect our rights.

We require third parties to handle personal data securely and in accordance with applicable data protection laws.

6. Data Transfer to Third Countries

If personal data is transferred outside Denmark, the European Economic Area (EEA), or to a country that does not provide an adequate level of data protection, we will ensure that appropriate safeguards are in place where required by law. Such safeguards may include:

• Standard contractual clauses approved by the European Commission or relevant authority.
• Other lawful transfer mechanisms recognized under applicable data protection law.
• Additional technical and organizational measures where appropriate.

You may contact us for more information about any international data transfers and the safeguards used.

7. Storage Duration

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Order and transaction data: retained for the period required by accounting, tax, and consumer law obligations.
• Customer service communications: retained for as long as needed to handle the matter and for a reasonable period thereafter.
• Marketing data: retained until you withdraw consent or object, or until it is no longer relevant.
• Technical and security logs: retained for a limited period necessary for security, troubleshooting, and system integrity.

When data is no longer needed, we will delete, anonymize, or securely archive it in accordance with applicable law.

8. User Rights

Subject to applicable law, you may have the following rights regarding your personal data:

• Right of access: to obtain confirmation of whether we process your personal data and receive a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we limit the processing of your data in certain situations.
• Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller.
• Right to object: to object to processing based on legitimate interests or to direct marketing at any time.

To exercise your rights, please contact us using the details provided below. We may need to verify your identity before responding. We will respond within the time limits required by applicable law.

9. Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If you withdraw consent for marketing communications, we will stop sending such communications, although you may still receive essential service-related messages.

10. Right to Complain

If you believe that our processing of your personal data does not comply with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority.

In Denmark, this is generally the Danish Data Protection Agency (Datatilsynet). We encourage you to contact us first so that we can try to resolve your concern directly.

11. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, secure systems, encryption where appropriate, staff confidentiality obligations, and regular review of our security practices.

While we strive to protect your personal data, no method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

12. Contact Information

If you have questions about this Privacy Policy, wish to exercise your rights, or need further information about how we process personal data, please contact us:

Nordisk Quilling Atelier
Møllebakken 12, 8250 Læring, Denmark
Email: [email protected]
Phone: +45 71 84 29 63

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or operational needs. The updated version will be published on our website with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.