Privacy and Data Protection Policy

Last updated: May 18, 2025

Table of contents

Company information

Legal entity	Copenhagen Chocolate Factory ApS (trade name Simply®)
VAT number	DK-32761844
Registered address	Amager Landevej 123, 2770 Kastrup, Denmark
Email	info@simplychocolate.dk
Phone	+45 36 34 00 70
Year of establishment	2011

1. Introduction

This Privacy and Data Protection Policy ("Policy") explains how we collect, use, disclose, transfer, and protect Your personal data when You:

• purchase products or services on our websites (simplychocolate.dk, simplychocolatecph.de, simplychocolatecph.com) or future domains we operate;
• interact with our social media pages;
• subscribe to our newsletter or loyalty program;
• participate in competitions, events, or surveys; or
• contact us otherwise online or offline (e.g., by phone or visiting our Factory Shop).

We process Your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Danish data protection legislation. 

2. Personal data we collect

Category	Examples
Identity and contact information	Full name, postal address, email address, phone number, customer number.
Purchase & delivery data	Order ID, selected products, quantity, delivery address, preferred parcel shop, return information, VAT number (B2B).
Payment information	Masked card number, MobilePay token or other payment token, transaction ID. We do not store full card numbers.
Marketing & profiling	Newsletter status, campaign participation, purchase and browsing history, preferred language, approximate geolocation.
Technical data	IP address, device ID, browser type/version, OS, referral URL, cookies/SDK events.
Communication data	Content of emails, chats, social media messages, phone notes, support cases.
Competitions & events	Registration forms, responses, photos/videos, guest lists.

The information is collected directly from You, automatically via cookies, or indirectly from partners (e.g., address updates).

3. Purpose and legal basis for processing

#	Purpose	Description	Legal basis for processing
3.1	Order fulfillment & customer service	Process and ship your order, handle returns, complaints, etc.	GDPR art. 6(1)(b) – contract
3.2	Service messages	Order confirmations, delivery updates, recalls.	GDPR art. 6(1)(b) & 6(1)(c)
3.3	Statutory	Accounting requirements, consumer and product safety.	GDPR art. 6(1)(c)
3.4	Security & fraud prevention	Detect and prevent unauthorized access and fraud.	GDPR art. 6(1)(f) – legitimate interest
3.5	Marketing & personalization	Newsletters, offers, recommendations, abandoned cart reminders. No automated decisions with significant legal effect.	GDPR art. 6(1)(a) – consent
3.6	Competitions & events	Manage prize draws, publish winner(s), event login.	GDPR art. 6(1)(b) + 6(1)(a)
3.7	Analytics & product development	Aggregate/anonymize data to improve products & UX.	GDPR art. 6(1)(f)

You can withdraw Your consent at any time (see section 7).

4. Consent to marketing

By ticking the consent box, sending YES via SMS or otherwise actively signing up, You give Simply permission to send You marketing via email, SMS/MMS and advertising on e.g. Facebook, Instagram, Pinterest, Google, TikTok, Snapchat, YouTube and LinkedIn.

• Personalized content. We use name, contact details, purchase and browsing history, preferred language and nearest parcel shop/showroom to tailor offers.
• Cookies. If You accept marketing cookies, cookie data is linked to Your profile for better targeting.
• Withdrawal. Unsubscribe via link in email, reply STOP to SMS or contact us (section 11). Afterwards, You will only receive service messages.
• Data controller. Copenhagen Chocolate Factory ApS.

5. Retention period

Data category	Period
Accounting & transactions	Current fiscal year + 5 years
Customer service cases	3 years after completion
Marketing consent	Until consent is withdrawn
Competition entries	12 months after completion
Cookies	As stated in the Cookie Policy or until You delete them

6. Disclosure and transfer of personal data

6.1 Recipients

We only share data when it is legal and necessary:

• Data processors under data processing agreement, e.g. webshop platform (Shopify Inc.), email/SMS (> Klaviyo Inc.), project management (ClickUp Inc.), payment, warehouse/3PL and IT support.
• Marketing & analytics partners (only if You have given consent) such as Meta Platforms, Google LLC, TikTok Pte. Ltd., Pinterest Inc. and Microsoft Corp.
• Carriers for delivery.
• Professional advisors (lawyers, accountants, banks).
• Public authorities where required by law.

6.2 International transfers

Some recipients are located outside the EU/EEA – especially Meta Platforms, Google LLC, TikTok Pte. Ltd., Pinterest Inc., Shopify Inc., Klaviyo Inc., ClickUp Inc. and Microsoft Corp.

For transfers to third countries without an adequacy decision, we use:

• Standard Contractual Clauses (SCCs) approved by the EU Commission,
• Supplementary measures after a transfer impact assessment, or
• Your explicit consent (GDPR art. 49(1)(a)) for specific transfers.

 

7. Your rights

Under GDPR, You have the right to:

1. Access – receive confirmation of and a copy of Your data.
2. Rectification – have inaccurate or incomplete data corrected.
3. Deletion – request Your data to be deleted.
4. Restriction – have processing temporarily limited.
5. Data portability – receive data in a machine-readable format.
6. Objection – object to processing based on legitimate interests or direct marketing.
7. Withdraw consent – at any time.

Contact us (section 11) to exercise Your rights. You can also complain to The Danish Data Protection Agency.

8. Data Security

• Encryption (TLS) of data in transit and encrypted backups.
• Two-factor authentication for admin accounts.
• Role-based access with need-to-know principle.
• Endpoint protection and patch management.
• Supplier due diligence and audit rights.

9. Cookies and similar technologies

We use cookies, pixel tags, and similar technologies for functionality, statistics, and marketing. On first visit, You can choose which cookies You accept. See our separate Cookie Policy for details.

10. Changes

The policy may be updated from time to time. Significant changes will be announced on the website or directly at least 30 days before taking effect. The date at the top indicates the latest revision.

11. Contact Information

Copenhagen Chocolate Factory ApS (Simply®)
Amager Landevej 123
2770 Kastrup
Denmark
Phone: +45 36 34 00 70
Email: info@simplychocolate.dk

If You disagree with our processing of Your data, You can complain to The Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, phone +45 33 19 32 00.