1. Data controller
Princess Beauty v/Mia Kjeldahl Christophersen, CVR 44850885, Fyrkildevej 43, st. tv., 9220 Aalborg Øst, Denmark · kontakt@princessbeauty.dk · +45 22 44 24 27
We have not appointed a data protection officer. Write to kontakt@princessbeauty.dk if you have questions about your information.
2. What we process and why
| Purpose | Information | Legal basis (GDPR art. 6) |
|---|---|---|
| Orders and delivery | name, address, email, phone, order history | art. 6(1)(b): contract |
| Payment | payment is handled by the payment provider; we do not see or store your card details | art. 6(1)(b): contract |
| Customer account and courses ("Mine Kurser") | name, login email, course access, your progress in the courses and your consent to immediate access (stored on the order) | art. 6(1)(b): contract. We also keep the consent to start the course under art. 6(1)(c), to be able to document it under the Danish Consumer Contracts Act |
| Messages and community in "Mine Kurser" | what you write to us or in the community, and your name | art. 6(1)(b): contract. Community posts can be seen by the other participants |
| Gift cards | the buyer's details and the recipient's name and email, which the buyer gives us | buyer: art. 6(1)(b). Recipient: art. 6(1)(f), our legitimate interest in delivering the gift card the buyer ordered |
| Salon bookings via Planway | name, phone, email and your bookings. Do not write health information in booking notes | art. 6(1)(b): contract |
| Bookkeeping | invoice details | art. 6(1)(c): legal obligation (Danish Bookkeeping Act) |
| Complaints and withdrawals | the order and our correspondence | art. 6(1)(c) and (f): to comply with the Sale of Goods Act and the Consumer Contracts Act and to document the case |
| News and offers by email (only if you said yes) | email, name | art. 6(1)(a): consent |
| Statistics and marketing via cookies | see the Cookie Policy | art. 6(1)(a): consent |
| Enquiries, including B2B applications | your message and your contact details | art. 6(1)(f): our legitimate interest in answering your enquiry and documenting what was agreed. If the enquiry concerns a purchase: (b) |
You must give us your name, address and email so that we can deliver an order or give you access to a course. Without them we cannot complete the purchase. Everything else you give us voluntarily.
We do not make automated decisions about you, and we do not sell your information.
Your right to object
Where we process your information on the basis of our legitimate interest (see the table), you can object to the processing at any time. Write to kontakt@princessbeauty.dk.
3. Who we share information with
Processors, which process information on our behalf and on our instructions. We have a data processing agreement with Shopify, Tevello and Planway:
- Shopify International Limited, Ireland: webshop platform, checkout, customer accounts, gift cards and order emails. Shopify transfers information to Shopify Inc. in Canada, which the European Commission has recognised as providing adequate protection, and to other Shopify companies under Shopify's Binding Corporate Rules (BCR). Shopify's Data Processing Addendum
- Tevello LLC, USA: the course platform behind "Mine Kurser", including messages and community. Information is processed in the USA and in the EU. The transfer to the USA is based on the European Commission's standard contractual clauses. Tevello's privacy policy
- Planway ApS, Denmark: salon bookings. Planway's privacy policy
- ImprovMX Incorporated, USA: forwards email sent to kontakt@princessbeauty.dk. Incoming mail is processed briefly in France, outgoing mail in France and the USA. The transfer is based on the European Commission's standard contractual clauses. ImprovMX on GDPR
- The payment provider that handles your payment at checkout: payment processing.
Other recipients, which are controllers of their own processing:
- GLS Denmark receives your name, address, email and phone so the parcel can be delivered. GLS on data and security
- The payment processor also processes payment information as an independent controller, for example to prevent fraud and money laundering and to verify identity.
- Microsoft (Outlook.com): email sent to kontakt@princessbeauty.dk arrives in an Outlook.com mailbox. Microsoft Ireland Operations Limited processes it as an independent controller under the Microsoft Privacy Statement.
- Shopify as an independent controller: The store is hosted by Shopify. Shopify also uses information you give the store for its own purposes, including providing and improving its services, targeting ads and personalising content, and the information may be shared with third parties in other countries. If you log in with Shop or pay with Shop Pay, Shopify also collects information directly from you. Read more in Shopify's Consumer Privacy Policy, and object at privacy.shopify.com.
- Our accountant and public authorities, where the law requires it.
You can get a copy of the standard contractual clauses that apply to the transfers by writing to us.
4. How long we keep information
- Order and accounting information: 5 years from the end of the financial year it relates to (Danish Bookkeeping Act).
- Customer account and course progress: for as long as you have the account. You can always ask us to delete it. Order information is kept as stated above.
- Messages and posts in "Mine Kurser": for as long as you have access to the course, or until you delete them or ask us to.
- News and offers by email: until you unsubscribe.
- Enquiries, complaints and withdrawals: up to 3 years after the case is closed, which is the general Danish limitation period, or longer if the information forms part of the accounts.
- Salon bookings: up to 3 years after your most recent booking.
5. Your rights
You can ask for access to your information and have it corrected or deleted. You can ask for processing to be restricted, receive your information in a portable format and object to processing. Write to kontakt@princessbeauty.dk.
You can withdraw consent at any time with effect for the future: for news and offers via the link at the bottom of every email, and for cookies via "Cookie settings" at the bottom of the page.
6. Complaints
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority in the country where you live.
Last updated: 16 September 2026. If the language versions differ, the Danish version prevails.