Introduction

Personal data refers to any information that can be linked to you in any way. When you use our website, we collect and process certain types of information, as described in this Privacy Policy. This Privacy Policy is subject to change at any time, and the most recent version is always available on our website.

Publisher

The website is owned and published by:

KasaSagi ApS
Byflou.com
Jyllandsvej 7
Denmark

Company Reg No. DK46352785
Phone:

We are responsible for the processing of your personal data.

Security

We have taken technical and organizational measures to prevent your information from being accidentally or illegally deleted, published, lost, impaired, or disclosed to unauthorized persons, misused, or otherwise processed in violation of the law.

What information we collect

When you make a purchase

• Name
• Address
• Email address
• Phone number
• Order and payment information

When creating a customer account

• Login information
• Name
• Address
• Email address
• Phone number
• Date of birth
• Purchase history

When signing up for the newsletter

• Email address
• Purchase history and behavioral data (if consent is given)

When using the website

• IP address
• Device information
• Browser information
• Behavioral data (clicks, views, and interactions)

When applying for a job

If you submit a job application to us, we process the following information:

• Name and contact information (email, phone number, address)
• Resume
• Application
• Education and work experience
• Any references
• Other information you choose to share

Purpose and Legal Basis

Processing of purchases

Purpose: Order processing, delivery, and customer service.
Legal basis: GDPR Art. 6(1)(b) (contract fulfillment).

Accounting

Purpose: Storage of invoice and accounting information.
Legal basis: GDPR Art. 6(1)(c) (legal obligation).

Customer service and improvement of the online store

Purpose: Support, statistics, and optimization.
Legal basis: GDPR Art. 6(1)(f) (legitimate interest).

Processing of Job Applications

Purpose: To evaluate your application and conduct the recruitment process.
Legal basis: GDPR Article 6(1)(b) (processing prior to entering into an employment contract).

If we retain your application after the recruitment process has ended for future positions, this is done solely on the basis of your consent, cf. GDPR Art. 6(1)(a).

Marketing and personalized communication

Purpose: Newsletters, segmentation, automated flows, product recommendations, and targeted advertising.
Legal basis: GDPR Art. 6(1)(a) (consent).

You may withdraw your consent at any time.

Profiling and automated processing

If you have consented to marketing, we may use your purchases and your behavior on the website for segmentation and personalization of our communications.

No automated decisions with legal effect on you are made.

Use of Data Processors and Third-Party Providers

We use external providers and partners who process personal data on our behalf in connection with operations, payments, delivery, marketing, analytics, and security.

We use the following platforms, among others:

• Google (analysis, advertising, and tag management)
• Meta (advertising and conversion tracking)
• Customer.io (email communication and marketing automation)
• Cloudflare (hosting and security)

In addition, we use providers in the following areas:

• Payment solutions
• Logistics and shipping
• Hosting and technical operations
• Analytics and reporting

Depending on the specific solution, providers may act as data processors or as independent data controllers.

Data processing agreements have been entered into with relevant suppliers in accordance with Article 28 of the General Data Protection Regulation.

If personal data is transferred to countries outside the EU/EEA, this is done on a lawful basis for transfer, including the European Commission’s Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, where applicable.

Further information regarding the use of advertising and conversion features, including Facebook Advanced Matching and Google Ads Enhanced Conversions, is provided in the section on Cookies in this Privacy Policy.

Retention Period

We retain personal data for the period permitted by law and delete it when it is no longer necessary for the purposes for which it was collected.

As a general rule, the following applies:

• Purchase and accounting information is retained for a minimum of 5 years in accordance with the Danish Bookkeeping Act. Information may be retained for longer if necessary to establish, assert, or defend legal claims.
• Information used for marketing purposes is retained as long as consent remains active and has not been withdrawn.
• Information associated with a customer account is retained as long as the account is active.

Your Rights

You have the right to:

• Access
• Rectification
• Deletion
• Restriction of processing
• Data portability
• Objection
• Withdrawal of consent

You can contact us at [email protected].

You have the right to file a complaint with the Danish Data Protection Agency, Datatilsynet, or the appropriate Data Protection Authority in your country.