Privacy notice

1Controller

Træhøj, owner Birgitte Arnason
Øster Kjulvej 2
9850 Hirtshals
Denmark

Phone: +45 23 34 98 75
Email: Staldnordkap@live.de

You can contact me directly with any questions about data protection and your rights.

2In brief

• This website uses no analytics or advertising services and does not embed content from social networks, map or video platforms. Fonts and videos are hosted on the website’s own server.
• Your browser only stores what a feature you use yourself needs (section 10). That is why there is no cookie banner.
• There are no payment details on this website. You pay on the page of the payment service Stripe; I only receive a confirmation and a reference.
• I do not pass your data on to others for advertising.

3Visiting the website

The website is hosted by Vercel Inc. (USA). When you visit it, Vercel processes the technically necessary connection data: your IP address, date and time, the page requested, the browser and the operating system. A page cannot be delivered without these data. Vercel stores them in logs to detect errors and attacks.

The legal basis is my legitimate interest in a secure and available website (Art. 6(1)(f) GDPR). Retention period of the logs: Details to follow: retention period of the Vercel logs.

Name resolution of the address (DNS) is handled by Cloudflare, Inc. (USA). In doing so, Cloudflare processes your device’s request for the website’s address.

4Contact form and enquiries

If you write to me using the form or by email, or call me, I process your details in order to reply: name, email address, phone number if you wish, your message and, depending on the subject, the piece of jewellery you want and your horse’s name, or the dates you would like and the number of guests. If you enquire via the configurator, your selection is added.

The legal basis is taking steps towards or performing a contract (Art. 6(1)(b) GDPR); for general questions, my legitimate interest in answering your message (Art. 6(1)(f) GDPR).

Please do not send me any information about your health. I do not need it for jewellery, and it belongs to the specially protected categories of data (Art. 9 GDPR).

The form stores your enquiry in the website’s database (Supabase, data centre in Frankfurt am Main) and sends me an email via the delivery service Resend. I read notifications in my email inbox at Details to follow: provider of the business inbox.

Protection against misuse

I use Cloudflare Turnstile against automated form submissions. Turnstile only loads on pages with a form. Cloudflare checks characteristics of the connection and the browser (including IP address, TLS fingerprint and user agent) to tell people from programs. According to Cloudflare, Turnstile sets no cookies. For the check, Cloudflare acts on my behalf; Cloudflare itself is responsible for improving Turnstile.

The website also counts requests per sender to slow down mass requests. For this it does not store your IP or email address, order number or the identifier of your reservation, but a key value calculated from them that cannot be reversed, together with the number of requests in a time window. The website gradually deletes counters older than one day while it counts new requests.

The legal basis for both is my legitimate interest in protection against spam and attacks (Art. 6(1)(f) GDPR).

Retention period

I delete enquiries once they have been dealt with and no contract has resulted from them, at the latest after Details to follow: deletion period for completed enquiries. If the enquiry becomes an order, the periods in section 5 apply.

5Orders in the shop

For an order I process your name, your delivery and billing address, email address, phone number if you wish, the pieces ordered with your selection in the configurator, prices, payment status and shipping. For a piece made from your own hair, the code you send with the hair and the note in the envelope with your contact details are added.

The legal basis is the contract (Art. 6(1)(b) GDPR). I have to keep invoices and accounting records under the Danish Bookkeeping Act (Art. 6(1)(c) GDPR).

Payment via Stripe

Payment takes place on Stripe’s payment page. There you enter your card or account details directly with Stripe; they do not reach this website. From Stripe I only receive the payment status, the amount, the payment method and a reference number. For processing the payment, Stripe acts on my behalf; Stripe itself is responsible for its own purposes such as fraud prevention and its own legal obligations. More on this in Stripe’s privacy policy (opens in a new window).

Emails about the order

I send the order confirmation, contract documents, shipping notice and invoice by email via Resend. Invoices are stored as PDFs in a non-public storage area of the website.

Retention period

I keep invoices, credit notes and the related records for 5 years from the end of the financial year (§ 12 bogføringsloven) and then delete them. I delete the other order data when no more claims can be made under the contract, at the latest after Details to follow: deletion period for order data outside bookkeeping.

6Withdrawal, complaints about defects and other complaints

If you withdraw using the Withdraw from contract function, I store the order number, name, email address, your statement and the date and time of receipt, and send you an acknowledgement of receipt. I am required to do this by law (Art. 6(1)(c) GDPR).

I record complaints about defects and complaints about the safety of a piece of jewellery in a register, as required by the EU General Product Safety Regulation (Art. 6(1)(c) GDPR, Art. 9(12) and (13) Regulation (EU) 2023/988). I keep personal data in it for no more than 5 years.

7Booking the Træhøj cabin

For a booking I process your name, email address, phone number, dates, number of guests and animals, chosen extras such as the linen package, your message, price and payment status. The legal basis is the rental contract (Art. 6(1)(b) GDPR). Payment works as in the shop, via Stripe (section 5).

The cabin is also listed on Airbnb. So that nothing is double-booked, the website matches its calendar with the Airbnb calendar. Only booked periods are exchanged, no names and no contact details.

If you choose dates and cancel the payment, the website deletes the reservation that did not go ahead after 30 days. The 5-year period from section 5 applies to booking records.

Anyone who books via Airbnb concludes the contract via Airbnb. Airbnb’s privacy policy applies to the data Airbnb collects in the process.

Guest register

Where Danish law requires a guest register for the cabin, I collect the details required there on arrival, keep them for as long as the rules require and then delete them (Art. 6(1)(c) GDPR). Whether the obligation applies to the cabin: Details to follow: obligation to keep a guest register (lawyer, REQUIREMENTS M-10).

8Emails from me

I write to you about your enquiry, order or booking. I only send advertising by email if you have given your consent beforehand. You can withdraw consent at any time for the future, for example with a short email to me.

9Services working on my behalf

The website does not run on my own computers. These services process data on my behalf and only on my instructions:

For the USA there is an adequacy decision of the European Commission: providers certified under the EU-US Data Privacy Framework are considered sufficiently safe. You can get a copy of the standard contractual clauses from me on request.

Beyond that, I only pass on data if a law requires it, for example to tax authorities, or if the contract requires it, for example the delivery address to the shipping service: Details to follow: shipping service.

10Storage in your browser

The website only stores something in your browser when a feature you expressly use needs it. No consent is required for this (§ 4(2) of the Danish Cookie Order, BEK 1148/2011; § 25(2) no. 2 TDDDG). There are no cookies for analytics or advertising.

The website’s administration area sets login cookies. It is intended only for me; as a visitor you do not come into contact with it.

11Your rights

You have the right

• to request access to your data (Art. 15 GDPR),
• to have incorrect data rectified (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR), unless I have to keep it,
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a common format (Art. 20 GDPR),
• to withdraw consent at any time for the future (Art. 7(3) GDPR).

Objection: Where I process data on the basis of my legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to advertising at any time without giving reasons (Art. 21(2) GDPR).

An email or a phone call is enough. I reply within one month.

Complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work (Art. 77 GDPR). The Danish supervisory authority is responsible for me:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
Email: dt@datatilsynet.dk
Phone: +45 33 19 32 00
datatilsynet.dk (opens in a new window)

12Mandatory details and automated decisions

Without a name and email address I cannot handle an enquiry, order or booking, and without an address I cannot send an order. There are no other obligations to provide data. I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13Changes

If anything changes on the website or in the services used, I will update this notice. The version on this page applies.