PRIVACY POLICY FOR HOUSE OF NEEDLEWORK

Last updated: 7 September 2026

House of Needlework ApS
Vandmanden 12B
9200 Aalborg SV
Denmark

Danish company registration no. (CVR): 45404366
Telephone: +45 81 65 57 81
Email: info@houseofneedlework.com

1. Data Controller

House of Needlework ApS is the data controller for the processing of personal data when you visit our website, shop in our webshop, create an account, act as a contact person for a customer or business partner, contact us or subscribe to our newsletter.

This Privacy Policy describes which personal data we process, why we process it, how long we retain it, and which rights you have.

2. Personal Data We Collect

We only process personal data that is relevant and necessary for the purposes described in this Privacy Policy.

2.1 Information You Provide When Making a Purchase or Contacting Us

When you make a purchase or place an order, we may process:

• Name
• Company name
• Address
• Delivery address
• Email address
• Telephone number
• CVR/VAT number
• Invoicing information
• Order and delivery information
• Correspondence relating to the order
• Information regarding payment and payment status
• We invoice after the order has been dispatched. Therefore, no card details or other payment information are entered when placing an order on our website.

2.2 Information Provided When Creating an Account

When you create an account, we may process the information you enter yourself, including:

• Username
• Email address
• First name and surname
• Password in hashed form
• Company name
• Country
• CVR/VAT number
• Telephone number
• Invoicing email address
• Address
• Postal code and city
• Account and login information
• The information is used to administer your account, identify you as a user and ensure correct order processing, invoicing and delivery.

2.3 Information Relating to Business Contacts

If you are a contact person at a company that purchases from or cooperates with House of Needlework ApS, we may process:

• Name
• Job title or function
• Company name
• Work-related email address
• Telephone number
• Correspondence
• Information about the company’s customer relationship, orders and agreements

The information is used to administer our business relationship, fulfil orders and agreements and communicate with the company.

2.4 Customer Service and Other Contact

When you contact us by email, telephone, contact form or by other means, we process the information you provide as well as any information necessary to respond to and handle your enquiry.

We ask you not to send us sensitive or otherwise specially protected categories of personal data unless this is necessary.

If we receive such information without needing it, we will generally delete it once it is no longer necessary for handling the enquiry.

2.5 Newsletters and Electronic Marketing

When you subscribe to our newsletter, we may process:

• Email address
• Company name
• Telephone number
• First name and surname, if provided
• Information about your consent, including the time of subscription and any subsequent unsubscribe request

We only send electronic marketing when we have a valid legal basis for doing so under applicable marketing legislation.

You may unsubscribe at any time via the unsubscribe link in our emails or by contacting us.

2.6 Technical Information, Cookies and Similar Technologies

When you visit our website, we may process technical information, including:

• IP address
• Browser type
• Device type
• Operating system
• Time of visit
• Technical log information
• Information collected through cookies and similar technologies
• We use technically necessary cookies and similar technologies for purposes including website operation, login, shopping basket functionality, security and other essential website functions.

Cookies and similar technologies used for purposes such as statistics, analytics, personalisation or marketing are only used where the necessary consent has been obtained.

You can view and change your choices via our cookie settings. Here you can also find further information about individual cookies and technologies, their purposes, providers and retention periods.

2.6 Information Received from Others

In certain cases, we may receive personal data from parties other than you, for example:

• Your employer or the company you represent
• A colleague at the same company
• Payment and shipping providers in connection with an order
• Publicly available company registers where necessary to verify company information
• We only process such information where we have a relevant and lawful purpose.

3. Purposes of Processing

We process personal data for the following purposes:

• Creation and administration of customer accounts
• Receipt, processing and delivery of orders
• Invoicing and payment administration
• Administration of customer relationships and business partnerships
• Customer service and communication
• Handling complaints, returns and other enquiries
• Compliance with accounting, tax, VAT and other legal requirements
• Newsletters and electronic marketing where a valid legal basis exists
• Operation, maintenance and security of our website and IT systems
• Prevention and handling of misuse, security incidents and fraud
• Documentation and handling of potential legal claims
• Compliance with other legal obligations

4. Legal Basis for Processing

We process personal data on the following legal bases:

4.1 Performance of a Contract – Article 6(1)(b) GDPR

We rely on this legal basis where processing is necessary in order to enter into or perform a contract with the person to whom the data relates.

This may, for example, be relevant in purchases made by a sole trader or in another situation where the data subject is personally a party to the agreement.

4.2 Legal Obligation – Article 6(1)(c) GDPR

We process personal data where this is necessary to comply with a legal obligation, for example under:

• Accounting legislation
• Tax and VAT legislation
• Other rules applicable to House of Needlework ApS
• 4.3 Legitimate Interests – Article 6(1)(f) GDPR

We may process personal data on the basis of a balancing of interests where this is necessary for our legitimate interests and where your interests or fundamental rights do not override those interests.

Our legitimate interests may include:

• Managing relationships with business customers and business partners
• Communicating with company contact persons
• Providing customer service
• Administering customer accounts
• Securing and operating our website and IT systems
• Preventing misuse and fraud
• Documenting agreements, correspondence and relevant events
• Establishing, exercising or defending legal claims where specifically necessary

4.4 Consent – Article 6(1)(a) GDPR
We rely on consent as the legal basis for processing where relevant, for example in connection with certain cookies and similar technologies.

Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

5. Is It Necessary to Provide Us with the Information?

Certain personal data is necessary if you wish to create an account, place an order or enter into an agreement with us.

This applies, for example, to your name, company details, contact information, invoicing information and delivery address.

If the necessary information is not provided, we may be unable to create your account, process your order, deliver the Goods or perform the relevant agreement.

Providing consent for newsletters and non-essential cookies is voluntary.

6. Retention and Deletion

We do not retain personal data for longer than necessary for the purpose for which it was collected unless a longer retention period is required by law.

6.1 Orders, Invoices and Accounting Records

Accounting records, including relevant order and invoice information, are generally retained for 5 years from the end of the financial year to which the records relate, in accordance with Danish bookkeeping legislation.

Information may be retained for longer where necessary as a result of other legislation or a specific ongoing matter.

6.2 Customer Accounts

Account information is retained for as long as the account remains active or for as long as the information is necessary to administer the customer relationship.

When an account is no longer required, the personal data will be deleted or anonymised unless the information must continue to be retained for purposes such as accounting, documentation or other lawful purposes.

6.3 Customer Service and Correspondence

Enquiries and correspondence are retained for as long as necessary to handle the matter and, where relevant, to subsequently document the circumstances concerned.

When the information is no longer necessary, it will be deleted or anonymised.

6.4 Newsletters

Information used for sending newsletters is processed until you unsubscribe or until we otherwise no longer have a lawful basis for the processing.

To the extent necessary, we may retain documentation relating to previous consent or an unsubscribe request for a limited period where this is required to demonstrate compliance with applicable rules.

6.5 Technical Information and Cookies

The retention period depends on the individual cookie, log file or technology. Further information about cookies and their lifespan is available in our cookie settings/cookie declaration.

7. Recipients, Suppliers and Data Processors

We only disclose or make personal data available to external parties where necessary for the purposes described in this Privacy Policy or where required by law.

We use suppliers in areas including:

• Hosting and IT operations
• Webshop and account functionality
• Email and system notifications
• Newsletters and email marketing, including Klaviyo
• Payment services
• Shipping and delivery
• Invoicing, accounting and bookkeeping
• VAT validation
• Technical support and security

Our website and webshop use, among other systems, WordPress and WooCommerce together with associated technical solutions.

Our hosting is provided by Simply.

Some suppliers process personal data on our behalf as data processors. Where this is the case, we enter into the necessary data processing agreements and ensure that the information is processed only in accordance with our instructions.

Other recipients, such as certain payment service providers, shipping companies, banks, accountants or public authorities, may act as independent data controllers in relation to their processing. In such cases, their processing is subject to their own privacy policies and legal obligations.

8. Transfers to Countries Outside the EU/EEA

Some of our suppliers or their sub-processors may process personal data in countries outside the EU/EEA.

Where personal data is transferred to a third country, we ensure that a valid transfer mechanism under the GDPR is in place.

This may, for example, include:

• An adequacy decision by the European Commission
• The EU-U.S. Data Privacy Framework where the relevant US recipient participates in the framework
• The European Commission’s Standard Contractual Clauses (SCCs)
• Another lawful transfer mechanism under the GDPR

Where necessary, we also assess whether supplementary measures are required to protect the information.

9. Automated Decision-Making

House of Needlework ApS does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

10. Your Rights

Under data protection legislation, you have a number of rights. The rights applicable depend on the specific processing activity and the legal basis relied upon.

Among other things, you have the right to:

• Obtain access to the personal data we process about you
• Have inaccurate information corrected
• In certain cases, have your personal data deleted
• In certain cases, have the processing restricted
• In certain cases, receive your personal data in a structured, commonly used and machine-readable format and have it transferred to another data controller
• Object to processing based on Article 6(1)(f) GDPR
• Withdraw consent where processing is based on consent

You have the right at any time to object to the processing of your personal data for direct marketing purposes. If you object to direct marketing, your personal data will no longer be processed for this purpose.

If you wish to exercise your rights, you can contact us at:

info@houseofneedlework.com

We may request the information necessary to verify that a request is being made by the correct person.

11. Complaints to the Danish Data Protection Agency

If you are dissatisfied with the way we process your personal data, you are welcome to contact us first.

You also have the right to lodge a complaint with:

The Danish Data Protection Agency (Datatilsynet)
Carl Jacobsens Vej 35
2500 Valby
Denmark

www.datatilsynet.dk.

12. Security

We use appropriate technical and organisational security measures to protect personal data against accidental or unlawful loss, alteration, disclosure, misuse or unauthorised access.

These measures may include:

• Encrypted connections to the website
• Access controls
• Restricted employee access
• Ongoing system maintenance and updates
• Secure hosting and technical operations
• Limiting access to personal data on a need-to-know basis

Security measures are continuously adapted according to the nature, scope and risks of the processing.

13. Cookies

We use cookies and similar technologies on our website.

Technically necessary cookies may be used without consent where they are necessary to provide a function or service requested by the user.

Other cookies and similar technologies are used in accordance with the choices you make through our consent solution.

You may change or withdraw your cookie choices at any time via our cookie settings.

Further information about the specific cookies, providers, purposes and retention periods can be found in our cookie declaration/cookie settings.

14. Changes to the Privacy Policy

We may update this Privacy Policy from time to time, for example if our processing of personal data changes, if we introduce new systems, or if applicable legislation changes.

The version currently in force will always be available on our website.

The date at the top of the page shows when the Privacy Policy was last updated.