Personal data policy
Privacy and Data Protection Policy
Last updated: 18 May 2025
Table of Contents
Company Information
| Legal entity | Copenhagen Chocolate Factory ApS (trading name Simply®) |
|---|---|
| CVR / VAT number | DK‑32761844 |
| Registered address | Amager Landevej 123, 2770 Kastrup, Denmark |
| E‑mail | info@simplychocolate.dk |
| Telephone | +45 36 34 00 70 |
| Year of establishment | 2011 |
1. Introduction
This Privacy and Data Protection Policy (the “Policy”) explains how we collect, use, disclose, transfer and safeguard your personal data when you:
- purchase products on our websites (simplychocolate.dk, simplychocolatecph.de, simplychocolatecph.com) or any future domains we operate;
- interact with our social‑media pages;
- subscribe to our newsletter or loyalty programme;
- participate in competitions, events or surveys; or
- otherwise contact us online or offline (e.g. by phone or when visiting our Factory Shop).
We process your data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Danish data‑protection law.
2. Personal Data We Collect
| Category | Examples |
|---|---|
| Identity & contact details | Full name, postal address, e‑mail address, telephone number, customer ID. |
| Purchase & delivery data | Order ID, selected products, quantities, delivery address, preferred parcel shop, return details, VAT number (B2B). |
| Payment information | Masked card number, MobilePay token or other payment token, transaction ID. We do not store full card numbers. |
| Marketing & profiling | Newsletter status, campaign participation, purchase and browsing history, preferred language, approximate geolocation. |
| Technical data | IP address, device ID, browser type/version, OS, referrer URL, cookies/SDK events. |
| Communication data | Content of e‑mails, chats, social‑media messages, phone notes, support tickets. |
| Competitions & events | Entry forms, answers, photos/videos, guest lists. |
Data are collected directly from you, automatically via cookies, or indirectly from partners (e.g. address‑update services).
3. Purposes and Legal Basis
| # | Purpose | Description | Legal basis |
|---|---|---|---|
| 3.1 | Order fulfilment & customer service | Process and ship your order, handle returns, complaints etc. | GDPR Art. 6(1)(b) – contract |
| 3.2 | Service communications | Order confirmations, delivery updates, recalls. | GDPR Art. 6(1)(b) & 6(1)(c) |
| 3.3 | Legal compliance | Bookkeeping, consumer‑ and product‑safety obligations. | GDPR Art. 6(1)(c) |
| 3.4 | Security & fraud prevention | Detect and prevent unauthorised access and fraud. | GDPR Art. 6(1)(f) – legitimate interest |
| 3.5 | Marketing & personalisation | Newsletters, offers, recommendations, abandoned‑cart reminders. No automated decisions with legal or similarly significant effect. |
GDPR Art. 6(1)(a) – consent |
| 3.6 | Competitions & events | Administer prize draws, publish winner(s), manage event login. | GDPR Art. 6(1)(b) + 6(1)(a) |
| 3.7 | Analytics & product development | Aggregate/anonymise data to improve products & UX. | GDPR Art. 6(1)(f) |
You may withdraw your consent at any time (see section 7).
4. Marketing Consent
By ticking the consent box, texting YES via SMS or otherwise actively opting in, you authorise Simply to send you marketing via e‑mail, SMS/MMS and advertising on Facebook, Instagram, Pinterest, Google, TikTok, Snapchat, YouTube and LinkedIn.
- Personalised content. We use your name, contact details, purchase and browsing history, preferred language and nearest parcel shop/showroom to tailor offers.
- Cookies. If you accept marketing cookies, cookie data are linked to your profile for better targeting.
- Withdrawal. Unsubscribe via the link in any e‑mail, reply STOP to an SMS or contact us (section 11). You will then receive service messages only.
- Data controller. Copenhagen Chocolate Factory ApS.
5. Data Retention Period
| Data category | Period |
|---|---|
| Bookkeeping & transactions | Current fiscal year + 5 years |
| Customer‑service cases | 3 years after resolution |
| Marketing consent | Until consent is withdrawn |
| Competition entries | 12 months after completion |
| Cookies | As stated in the Cookie Policy or until you delete them |
6. Disclosure and Transfer of Personal Data
6.1 Recipients
We share data only when lawful and necessary:
- Data processors under a data‑processing agreement, e.g. webshop platform (Shopify Inc.), e‑mail/SMS (Klaviyo Inc.), project management (ClickUp Inc.), payment providers, warehouse/3PL and IT support.
- Marketing & analytics partners (only with your consent) such as Meta Platforms, Google LLC, TikTok Pte. Ltd., Pinterest Inc. and Microsoft Corp.
- Carriers for delivery.
- Professional advisors (law firms, auditors, banks).
- Public authorities where required by law.
6.2 International transfers
Some recipients are located outside the EU/EEA – notably Meta Platforms, Google LLC, TikTok Pte. Ltd., Pinterest Inc., Shopify Inc., Klaviyo Inc., ClickUp Inc. and Microsoft Corp.
For transfers to third countries without an adequacy decision, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Supplementary measures following a transfer‑impact assessment; or
- Your explicit consent (GDPR Art. 49(1)(a)) for specific transfers.
7. Your Rights
Under the GDPR you have the right to:
- Access – obtain confirmation and a copy of your data.
- Rectification – have inaccurate or incomplete data corrected.
- Erasure – request that your data be deleted.
- Restriction – have processing restricted temporarily.
- Data portability – receive data in a machine‑readable format.
- Object – object to processing based on legitimate interests or direct marketing.
- Withdraw consent – at any time.
Contact us (section 11) to exercise your rights.
8. Data Security
- Encryption (TLS) of data in transit and encrypted backups at rest.
- Two‑factor authentication for admin accounts.
- Role‑based access on a need‑to‑know basis.
- Endpoint protection and patch management.
- Vendor due diligence and audit rights.
9. Cookies and Similar Technologies
We use cookies, pixel tags and similar technologies for functionality, analytics and marketing. On your first visit you can choose which cookies you accept. See our separate Cookie Policy for details.
10. Changes
This Policy may be updated from time to time. Material changes will be announced on the website or directly to you at least 30 days before coming into effect. The date at the top indicates the latest revision.
11. Contact Information
Copenhagen Chocolate Factory ApS (Simply®)Amager Landevej 123
2770 Kastrup
Denmark
Telephone: +45 36 34 00 70
E‑mail: info@simplychocolate.dk
