PRIVACY POLICY

1. Purpose of this privacy policy

ID^® Identity A/S ('ID^® Identity', 'us' or 'we') takes data protection very seriously and we want to be open and transparent about how we process your personal data. We are also aware that you as a data subject have a number of rights, including the right to receive information about how we process your personal data. We have therefore prepared this privacy policy, which provides you with information about how we process your data, what your rights are, etc. If you have any questions, please contact us. Our contact details are listed in point 2.

This privacy policy applies when you visit our website, www.id.dk, including when you use our online store or dealer network, and when you enter into agreements with us or contact us, such as via our contact form.

2. Data controller

ID^® Identity A/S is the data controller and we process personal data about you in accordance with this privacy policy and applicable law. Please find our relevant contact details below:

ID^® Identity A/S
Address: Lægårdvej 138, DK-7500 Holstebro
CVR no: 16278874
Tel.: +45 97492144
E-mail: hr@id.dk
Website: www.id.dk

3. Use of cookies

We use cookies on our website. This means that data is already exchanged when you visit our website - depending on which cookies you have accepted. However, the use of cookies and obtaining consent for this already happens when you click on our website. Here you will be informed about the use and purpose of collecting data via cookies. This is done in the cookie policy that you are automatically presented with when visiting our websites. So please refer to the cookie policy for further information on this, including how we process personal data that may occur in connection with our use of cookies.

You can always find more information about our use of cookies at the bottom of our website. Here you will also find instructions on how to delete or block cookies.

4. Processing of personal data

We only process personal data when we have a legitimate reason for doing so. Our reasons for data processing and the legal basis for data processing depend entirely on the situation in which we process the personal data. This is described in more detail below.

4.1 If you contact us

If you contact us either by phone, email or via our website, we process the personal data included in the enquiry so that we can deal with it. This might be if you enquire about products, etc. and when using our support function.

The legal basis for processing this data is Article 6(1)(f) of the General Data Protection Regulation, as we have a legitimate interest in processing the data so that we can deal with the enquiry. In some cases, it may also be Article 6(1)(b) if the enquiry relates to a contract/order.

4.2 If you subscribe to our newsletter

We also process personal data about you if you subscribe to our newsletter. You subscribe via our website and we only send you newsletters if you have given us your consent.

The legal basis for the processing in these cases is Section 10 of the Danish Marketing Practices Act and Article 6(1)(a) of the Danish Data Protection Act (consent).

4.3 If you shop online with us or place an order with us by other means

If you shop online with us or place an order with us by other means, you will be asked to fill in/provide the following information when placing an order:

• Name
• Address/delivery address
• Email address
• Phone number
• Payment details to complete payment

There may be additional information that we collect related to your enquiry with our customer service team or finance department.

We process personal data about our customers so that we can deliver the purchased products, process the order and subsequent payment, and so that we can deal with any enquiries about the order. We only process general personal data about our customers and never sensitive personal data.

The legal basis for our processing is Article 6(1)(b) of the General Data Protection Regulation. In exceptional cases, the basis may also be Article 6(1)(f) if we have a legitimate interest in processing the data that is not overridden by the interest of the data subject.

It is important to us that your data is correct, so we would like to be informed if there are any changes to your data. You can notify us of the changes via the contact details above.

4.4 When you join our dealer network

We have set up a dealer network where dealers can log in to a part of our website and access relevant information, etc. To access this, you must be registered with a login.

When creating a new dealer, the following is registered in our system:

• company name
• contact person's name
• company and contact person's phone number
• contact person and company email
• the password used for login
• company purchase history 

This includes personal data about the contact person who handles communication between us and the dealer.

The legal basis for our processing is Article 6(1)(b) of the General Data Protection Regulation. In exceptional cases, the basis may also be Article 6(1)(f) if we have a legitimate interest in processing the data that is not overridden by the interest of the data subject.

5. Deletion of personal data

We retain personal data for as long as necessary for a legitimate purpose or as long as required by law. We therefore regularly delete personal data when the purposes for which it was collected no longer require processing.

If your personal data is included in accounting material, such as order confirmations, invoices and the like, this data will not be deleted until 5 years after the end of the relevant financial year. We do this to fulfil the retention requirements of the Danish Bookkeeping Act. This applies to all information about our customers who have shopped online with us or placed an order by other means.

5.1 Specifically about newsletter recipients

If you withdraw your consent for us to send you newsletters, we will delete you from our list of newsletter recipients no later than 5 business days after we have received the withdrawal of your consent. You will no longer receive newsletters. However, we will store your consent for up to 24 months to be able to document that you have (previously) consented to receive newsletters.

5.2 Specifics about our dealer network

We continuously update the contact details of the contact persons in our dealer network. We regularly (and at least once a year) review our dealer network to assess whether personal data needs to be updated or deleted. 

6. Disclosure and transfer of your personal data

As a rule, we do not share information about customers, dealers or newsletter recipients with third parties.

However, in special cases, customer information etc. may be disclosed. This may, for example, be in connection with reporting to a public authority or if we are ordered to disclose information by a court of law. Furthermore, personal data we process may be disclosed to our lawyer or accountant as part of any legal or accounting assistance.

We also use data processors who perform work on our behalf. This may include server hosting and system maintenance, analyses, email services, etc. These partners may have access to process our data to the extent necessary to provide their services. In this case, the processing is carried out on our instructions and a data processing agreement has been entered into with the supplier, which ensures that the supplier is contractually obliged to treat all information confidentially and not to use the information for purposes other than those covered by the contractual obligation between the supplier and ID® Identity.

7. Specifically for third country transfers

We use a number of systems owned and operated by a US company. This applies to the analytics tools we use on our website if you have accepted certain types of cookies, as well as the pop-up boxes you encounter on our website.

If you have subscribed to our newsletter, we use an American company to automatically send it to you.

Our use of these suppliers means that in these cases your personal data may be transferred to the United States.

If your personal data is transferred, this is always based on a special transfer basis that ensures that the data is processed securely in the third country, and that we have ensured that appropriate security measures have been taken before and during the transfer. For more information on which third country transfers we make, including the basis of transfer, please refer to the table below:

Suppliers	Transfer basis	Link to privacy policy/DPA
ActiveCampaign (Google and Amazon as sub-processors)	SCC (2021/914/EU) + certified under EU-U.S. Data Privacy Framework	https://www.activecampaign.com/legal/privacy-policy
Sleeknote (Amazon og Google som underdatabehandlere)	SCC (2021/914/EU) + certified under EU-U.S. Data Privacy Framework	https://sleeknote.com/gdpr
Google	SCC (2021/914/EU) + certified under EU-U.S. Data Privacy Framework	https://cloud.google.com/terms/data-processing-addendum
Microsoft	SCC (2021/914/EU) + certified under EU-U.S. Data Privacy Framework	https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
AmazonSCC (2021/914/EU) + certificeret under EU-U.S. Data Privacy Framework	SCC (2021/914/EU) + certified under EU-U.S. Data Privacy Framework	https://aws.amazon.com/blogs/security/aws-gdpr-data-processing-addendum/

8. Security

We have adopted an internal IT security policy with instructions and measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

We store customer information, information about dealers and information about newsletter recipients in systems to which access restrictions are in force and where we have entered into a data processing agreement with the supplier who processes the information on our behalf. We have set a number of requirements for the technical security that the supplier has built into and around the system.

9. Your rights

According to data protection regulations, you have a number of rights when it comes to us processing your personal data. If you wish to exercise these rights, simply contact us via the contact details provided at the top of this policy. You can also read more about your rights in the Danish Data Protection Agency's guide on the rights of the data subject, which you can find at www.datatilsynet.dk.

9.1 Right of access (right to see information)

You have the right to access the data we process about you. However, the right of access may be limited to protect the personal data or trade secrets of other persons.

9.2 Right of rectification (correction)

You have the right to have inaccurate information about you rectified.

9.3 Right to erasure

In special cases, you have the right to have your personal data erased before the time of our normal general erasure of data.

9.4 Right to restriction of processing

In some cases, you have the right to restrict the processing of your personal data. If you have the right to restrict processing, we may in future only process the data - with the exception of storage - with your consent or for the establishment, exercise or defence of legal claims, for the protection of another natural or legal person or for reasons of important public interest.

9.5 Right to object

In certain cases, you have the right to object to our otherwise lawful processing of your personal data. You can always object to the processing of your data for direct marketing purposes.

9.6 Right to transmit data (data portability)

In certain cases, you have the right to receive your personal data in a structured, commonly used and machine-readable format.

9.7 Right to withdraw your consent

If you have consented to the processing of your personal data, for example as part of receiving our newsletters, you have the right to withdraw your consent at any time. You can do so by contacting us via the contact details listed in section 2 above.

If you choose to withdraw your consent, this will not affect the lawfulness of our processing of your personal data based on the consent you have previously given us until the time of withdrawal. Therefore, the withdrawal of your consent will only be effective for the future.

10. Updating this privacy policy

We constantly endeavour to comply with applicable legislation, including the rules and principles on the protection of personal data. We will therefore need to update and amend this privacy policy from time to time. In the event of significant changes, we will inform you via our website or by email.

Last updated in October 2023.