§1. Purpose of this privacy policy

ID® Identity A/S ("ID® Identity", "we" or "us") gives priority to the protection of personal data and strives to ensure full openness and transparency with regard to the processing of personal data by our company. We are also aware that, as a person registered with our company, you are entitled to a number of rights, including the right to obtain information from us about how we process your personal data. We have therefore prepared this privacy policy, which contains information about how we process your data, what rights you have, etc. Please contact us if you have any questions. You will find our contact details in section 2.

This privacy policy applies when you visit our website www.id.dk, including when you use our online shop or distributor network, as well as when you enter into agreements with us or contact our company, for example via our contact form.

§2. Data controller

The controller of personal data is ID® Identity A/S, which processes your personal data in accordance with this privacy policy and applicable law.

§3. Use of cookies

We use cookies on our website. This means that data is exchanged as soon as you enter our website, depending on which cookies you have accepted. The use of cookies and the obtaining of consent to their use take place as soon as you enter our website. When you enter the site, you will be informed that we use cookies and for what purpose we collect data by means of cookies. The above information is provided in the cookie policy, which is automatically displayed to users visiting our website. We therefore ask you to read our cookie policy for further information, including information about the processing of personal data that may take place in connection with our use of cookies.

Further information about our use of cookies can also be found at the bottom of our website. You will also find instructions there on how to delete or block cookies.

§4. Processing of personal data

We process personal data solely for legally justified purposes. The purpose for which we process data, and the legal basis for the processing, depend entirely on the situation in which we process personal data. A detailed description of the situations in which we process data is set out below.

§4.1 Contact between the user and our company

If you contact us by telephone, email or via our website, we process the personal data that you have provided in connection with the contact in order to handle your inquiry. This may concern situations involving product inquiries etc. as well as the use of our technical support.

In this case, the legal basis for processing this data is Article 6(1)(f) of the General Data Protection Regulation, as we have a legitimate interest in processing this data in order to handle your inquiry. In some cases, the legal basis may also be Article 6(1)(b) of the Regulation if you contact us in connection with an agreement/order.

§4.2 Subscription to our newsletter

We also process your personal data if you have signed up for our newsletter service. You can subscribe to the newsletter service on our website, which means that we only send you newsletters if you have consented to this.

In this case, the legal basis for processing the data is Section 10 of the Danish Marketing Practices Act and Article 6(1)(a) of the Danish Data Protection Act (consent).

§4.3 Use of our online shop or placing an order in another way

If you use our online shop or place an order in another way, you will be asked to complete/provide the following information when placing the order:

• Full name
• Address/delivery address
• Email address
• Telephone number
• Payment details in order to complete the payment

Furthermore, we may collect data obtained in connection with your inquiries directed, for example, to our customer service department or finance department.

We process the personal data of our Customers in order to deliver the purchased products, manage the order and payment for the order, and handle inquiries concerning the order. We only process ordinary personal data of our Customers. We never process sensitive personal data.

The legal basis for our processing of the data is Article 6(1)(b) of the General Data Protection Regulation. In exceptional cases, we may also process data on the basis of Article 6(1)(f) if the processing is necessary for the purposes of our legitimate interests, except where such interests are overridden by the interests of the data subject.

We attach great importance to ensuring that your data is accurate, so please inform us of any changes to your data. You can notify us of changes via the contact details above.

§4.4 Joining our distributor network

We have established a distributor network in which distributors can log in to certain areas of our website and access relevant information, etc. In order to gain access, a distributor must have an account with a login.

When creating an account for a new distributor in our system, the following data is recorded:

• company name
• name of the contact person
• telephone number of the company and the contact person
• email address of the contact person and the company
• password used for login
• the company's purchase history

The information recorded includes the personal data of the contact person who is responsible for communication between us and the distributor.

The legal basis for our processing of this personal data is Article 6(1)(b) of the General Data Protection Regulation. In exceptional cases, we may also process data on the basis of Article 6(1)(f) if the processing is necessary for the purposes of our legitimate interests, except where such interests are overridden by the interests of the data subject.

§5. Deletion of personal data

We store personal data for the period necessary to fulfil the legitimate purpose of its storage or for as long as we are required to do so by law. We therefore regularly delete personal data when the purposes for which it was collected no longer require further processing of that data.

If your personal data is contained in accounting documents, such as order confirmations, invoices, etc., it will only be deleted after 5 years have elapsed from the end of the financial year in question. This follows from the provisions of law governing the obligation to retain accounting documents. This also applies to all data of our Customers who have used our online shop or placed an order in another way.

§5.1 Additional information for recipients of our newsletter

If you withdraw your consent to receiving the newsletter, we will remove you from our newsletter recipient list within 5 business days of receiving notice of the withdrawal of consent. You will no longer receive our newsletter. However, we will retain your consent for a maximum period of 24 months in order to be able to document that you have (previously) consented to receiving the newsletter.

§5.2 Additional information about our distributor network

We endeavour to keep the data of contact persons in our distributor network up to date. On an ongoing basis (at least once a year), we review our distributor network to assess whether any personal data needs to be updated or deleted.

§6. Transfer and disclosure of your personal data

As a general rule, we do not transfer the data of customers, distributors and newsletter recipients to third parties.

In special cases, however, we may transfer Customer data, etc. This applies, for example, to situations involving the reporting of a matter to a public authority or where a court of law obliges us to disclose data. Furthermore, we may transfer the personal data we process to our lawyer or accountant in connection with obtaining legal or accounting assistance.

We also use the services of data processors who perform work on our behalf. This concerns, for example, server hosting and system maintenance services, analytics, email services, etc. These partners may have access to processing our data to the extent necessary to provide their services. In such cases, the processing of data takes place exclusively in accordance with our instructions and on the basis of data processing agreements concluded with the provider of these services, thereby ensuring that the data processor is contractually obliged to treat all information confidentially and not to use it for purposes other than the fulfilment of the obligations arising from the agreement between the provider and ID® Identity.

§7. Additional information on transfers of data to third countries

We use a number of systems that are owned and managed by a US company. This applies to the analytics tools that we use on our website if the user has accepted certain types of cookies, as well as the pop-up windows that you may encounter on our website.

If you subscribe to our newsletter, we use the services of a US company for the automatic dispatch of the newsletter.

Our use of these providers' services means that in these cases your personal data may be transferred to the United States.

The transfer of your personal data always takes place on the basis of a specific legal basis for the transfer, which ensures that your data is processed securely in the third country. Further information is provided in the table below:

§8. Security

We have adopted an internal IT security policy containing instructions and measures aimed at protecting your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data that is transmitted, stored or otherwise processed.

We store customer data, distributor data and information about newsletter recipients in systems with established access restrictions, in respect of which we have concluded a data processing agreement with the provider who processes this data on our behalf. In the agreement, we have specified a number of technical security requirements that the provider has integrated into the system and its surrounding environment.

§9. Your rights

Under the data protection legislation, you are entitled to a number of rights in connection with our processing of your data. If you wish to exercise your rights, please contact us using the contact details provided at the beginning of this policy. You can also find more information about your rights in the guidance of the Danish Data Protection Agency, available at www.datatilsynet.dk.

§9.1 Right of access (right to inspect data)

You have the right of access to the data about you that we process. The right of access may be restricted in order to protect the personal data or trade secrets of other persons.

§9.2 Right to rectification of data (correction)

You have the right to request the rectification of data about you that is inaccurate.

§9.3 Right to erasure of data

In special cases, you have the right to request the erasure of your personal data before the general deadline by which we normally delete data has expired.

§9.4 Right to restriction of processing

In certain cases, you have the right to request that the processing of your personal data be restricted. If you are entitled to request restriction of the processing of your data, we may in future only process your data – other than storing it – with your consent, or for the establishment, exercise or defence of legal claims, for the protection of another natural or legal person, or for reasons of important public interest.

§9.5 Right to object

In certain cases, you have the right to object to our processing of data that we process lawfully. You may always object to the processing of your personal data for direct marketing purposes.

§9.6 Right to data portability

In certain cases, you have the right to receive your personal data in a structured, commonly used and machine-readable format.

§9.7 Right to withdraw consent

If you have consented to the processing of your personal data, for example in connection with receiving our newsletters, you have the right to withdraw the consent given at any time. If you wish to exercise this right, please contact us using the contact details provided above in section 2.

Withdrawal of consent does not affect the lawfulness of the processing of your personal data carried out on the basis of consent before its withdrawal. This means that withdrawal of consent takes effect only with regard to the future.

§10. Changes to the privacy policy

At all times, we make every effort to ensure that our privacy policy complies with the current requirements set out in legislation, including the legislation and rules governing the protection of personal data. This requires us to keep this policy up to date and to make changes to it. In the event of significant changes, we will inform you of them on our website or in an email message.