Privacy Policy

1. Who is Data Controller

1. The data controller for the processing described in this notice is:
   
   1. Cookie Information A/S (with the second name Sheltr A/S)
      Købmagergade 19
      1150 Copenhagen K, Denmark
      CVR: 38758292
   If you have questions regarding this Privacy Notice or Sheltr's privacy practices, please contact us by email at privacy@sheltr.eu.
   

2. Information we collect and how we collect it

1. In the following, we will tell you which types of personal data we may collect about you and how we collect it. In section 3, we have explained in a table the purposes for which we process your personal data and the lawful basis we rely on.
2. We may collect, use, store and transfer different kinds of personal data about you, which we have grouped as follows:
3. Identity Data includes name, username, title and identity of the organisation you represent.
4. Contact Data includes email, telephone numbers and address (most often the address of the organisation you represent).
5. Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
6. Technical Data includes IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
7. Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
8. Usage Data includes information about your use and interaction with our website, products and services.
9. Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
10. Our products and services are mainly offered to businesses and other professional organisations. Financial and transactional data, therefore, rarely qualify as personal data as they relate to the organisation you represent and not to you.
11. In most situations, we collect information directly from you when you register to use our products and services, request marketing from us, or otherwise communicate with us.
12. As you interact with our website or services, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and similar technologies. We may also receive technical data about you if you visit other websites that employ our cookies. Please see our cookie policy for further details.
13. We may receive Identity and Contact Data from the organisation you represent if you are authorised to log into and utilise our products and services connected to your organisation's account.

3. The purpose and lawful basis

• We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
• Where we need to perform the contract, we are about to enter into or have entered into with you or the organisation you represent, cf. GDPR Article 6 (1) (b).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests cf. GDPR Article 6 (1) (f).
• Where we need to comply with a legal or regulatory obligation cf. GDPR Article 6 (1) (c).
• Where you have provided your consent cf. GDPR Article 6 (1) (a).
• Below, in table format, we describe all the ways we plan to use your personal data and which legal bases we rely on to do so. We have also identified our legitimate interests where appropriate.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us at privacy@sheltr.eu.

4. Sharing of information collected

1. Third-party service providers
2. We share information, including personal information, with our third-party service providers that we use to provide hosting for and maintenance of our Websites and Services, application development, backup, storage, payment processing, marketing, analytics, and other services for us. These third-party service providers may have access to or process your personal information to provide these services for us. We do not permit our third-party service providers to use the personal information we share with them for any other purpose than in connection with the services they provide. We have entered into data processor agreements with all of our data processors.
3. Compliance with laws
4. In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose personal information to establish or exercise our legal rights or defend against legal claims. We may also share such information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our Terms and Conditions, or as otherwise required by law.
5. Testimonials
6. Occasionally, we may post testimonials on the Websites that may contain personal information. We obtain your consent cf. GDPR art 6(1)(a) to post your name and testimonial. If you wish to update or delete your testimonial, you can contact us at privacy@sheltr.eu.
7. Cookie Information group sharing
8. We may share information, including personal information, with any member of the Cookie Information Group, and they will use that information only for the purposes already described in this privacy notice.
9. Business transfers
10. We may assign or transfer your account and related information and data, including any personal information, to any person or entity that acquires all or substantially all of our business, stock or assets, or with whom we merge. If we do, we will inform them of the requirement to handle your personal information in accordance with this privacy notice.

5. Transfer to third countries

1. We will not transfer your personal data to recipients outside the EU or EEA unless we have ensured compliance with GDPR Chapter V. 
2. Some of our third-party service providers are established outside the EEA, including in the US, so their processing of your personal data will involve a transfer of data outside the EEA. However, to ensure that your personal information receives an adequate level of protection, we have ascertained that sufficient safety measures have been implemented to allow for the transfer either by an adequacy decision made by the European Commission or by using standard contractual clauses approved by the European Commission, which give personal data the same protection it has in Europe.
3. You may request more information on our current data processors established outside the EEA and the safety measures in place to allow personal data transfer. Please send your request to us at privacy@sheltr.eu.

6. Data retention

• We retain the personal information we collect where we have an ongoing legitimate business need to do so. When we no longer have an ongoing legitimate business need to process your personal information, we will either delete or anonymise it.
• Identity, Contact, Financial, and Transaction Data are saved to demonstrate the agreement we have/have had and for bookkeeping and tax purposes for up to five full fiscal years after the expiry of the year in which you or the organisation you represent cancel the Service Account.
• Your consent to receive e-marketing will be saved for two years after the last time we relied on your consent to send marketing. We will stop sending you e-marketing when you withdraw your consent.
• Technical and Usage Data will be deleted three months after you or the organisation you represent cancel the Service Account.
• Data may be retained for a longer period if we are legally obliged to do so or if retention is necessary to establish, exercise, or defend legal claims.

7. How to exercise your data protection rights

You have certain choices available to you regarding your personal information. Below is a summary of those choices, how to exercise them and any limitations:

1. Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
2. Request corrections to the personal information we hold about you. This enables you to have any incomplete or inaccurate information corrected.
3. Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
4. Object to the processing of your personal information where we rely on a legitimate interest (or those of a third party), and something about your particular situation makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. You may manage your receipt of marketing and non-transactional communications by clicking on the “unsubscribe” link located at the bottom of our marketing emails, or you may send a request to privacy@sheltr.eu.
5. Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy or the reason for processing it.
6. Request the transfer of your personal information to another party (also known as data portability).
7. Where our processing is solely based on your specific consent, you can withdraw your consent at any time. Such withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
8. If you wish to exercise any of your data protection rights, please send your request to privacy@sheltr.eu. We will then act on your request in accordance with applicable data protection laws.
9. If you are unhappy with our data protection practices, you have the right to complain to your local data protection authority. In Denmark, you can lodge a complaint with Datatilsynet at https://www.datatilsynet.dk/borger/klage/saadan-klager-du.

8. Changes to this privacy notice

1. This privacy notice may be updated occasionally to reflect changing legal, regulatory, or operational requirements. We encourage you to periodically review this page for the latest information on our privacy practices.
2. If there are any material changes to this privacy notice, you will be notified by our posting of a prominent notice on the Websites before the change becomes effective.
3. If you do not accept any changes made to this privacy notice, please discontinue using the Websites and the services.