Privacy Policy
Last updated: 16 July 2026
1. Data controller
ShifaOrigins
Klosterparkvej 168
4400, Kalundborg, Denmark
CVR no.: DK43579681
Email: shifaoriginsofficial@gmail.com
Phone / WhatsApp: +45 60 71 11 25
We are the data controller for the personal data described in this policy, which we process in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
2. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, address, email, phone number | Processing and delivering your order, order confirmation, customer service | Contract (GDPR art. 6(1)(b)) |
| Order history and payment confirmation (we never see full card details) | Fulfilling the purchase, handling returns and complaints | Contract (art. 6(1)(b)) |
| Invoice and transaction data | Bookkeeping | Legal obligation — Danish Bookkeeping Act (art. 6(1)(c)) |
| Email address for newsletter | Marketing, only if you actively sign up | Consent (art. 6(1)(a)) — you can withdraw at any time via the unsubscribe link |
| Technical data and cookies (IP address, browser, pages visited) | Running the webshop, statistics, marketing | Consent via the cookie banner (see section 6) |
3. Who we share data with (data processors)
Our webshop runs on Shopify, which stores customer and order data on our behalf under a data processing agreement. We also share data with:
- Payment providers (SHOPIFY PAYMENTS / MobilePay / PayPal) — to process payment
- Shipping carriers (GLS / POSTNORD / DAO) — name and address, to deliver your order
- Shopify — to send newsletters you signed up for
Some providers (including Shopify) may process data outside the EU/EEA. Such transfers are protected by the EU Commission's Standard Contractual Clauses or an adequacy decision.
We never sell your personal data.
4. How long we keep your data
- Order and invoice data: 5 full financial years after the purchase year, as required by the Danish Bookkeeping Act (bogføringsloven).
- Newsletter data: until you unsubscribe, plus documentation of your consent for up to 2 years afterwards.
- Customer service correspondence: up to 2 years after the case is closed.
5. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have incorrect data corrected
- Have data deleted, where we are not legally required to keep it
- Object to or restrict our processing
- Receive your data in a machine-readable format (data portability)
- Withdraw consent at any time, where processing is based on consent
To exercise your rights, email us at shifaoriginsofficial@gmail.com. You can also complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — datatilsynet.dk.
6. Cookies
We use cookies to make the shop work (e.g. your basket), to measure traffic, and — only with your consent — for marketing. When you first visit, a cookie banner lets you accept or decline non-essential cookies, and you can change your choice at any time via the cookie settings link in the footer. See our Cookie Policy for the full list.