Privacy Policy of Heyloyalty

Heyloyalty ApS (CVR no. 29394458) is the data controller responsible for processing your personal information, and we ensure that your personal data is processed in accordance with the law.

We take the protection of your data seriously, and therefore we have adopted this privacy policy, which informs you how we process your personal data.

 

Contact information

If you wish to contact us regarding our privacy policy, you can do so at:

Heyloyalty ApS
Jens Baggesens Vej 47
dpo@heyloyalty.com and/or
+45 8730 0399

 

Processing of personal data

Personal data is information that to some extent can be attributed to you. This privacy policy describes how Heyloyalty ApS processes your personal data. We only process information about you that is necessary and serves a purpose, and we always treat your personal data confidentially.

 

Data security

We have taken appropriate technical and organizational measures to protect your information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access. We ensure that the processing can only take place when all data protection principles are met.

 

We keep data up to date

As our service depends on your personal data being correct and up to date, we ask you to inform us of relevant changes to your personal data. You can use the contact information above to notify us of any changes, and we will make sure to update your personal data. If we ourselves become aware that your personal data is incorrect, we will update the information and notify you thereof.

Below you can see on what basis we process your information, for what purpose, and for how long we store it.

 

Website visitors

When you visit our website, we process the following personal data about you:

• The personal data that Heyloyalty collects may, for example, include your name, your email address, your company address, your job title, your mobile number, and IP address.

We process personal data about you for the following purposes:

• To improve customer service and provide support
• To personalize the user experience
• To improve the website
• To ensure optimal operation of our website.

We process the information on the following processing basis:

• You have given consent via our cookie banner (General Data Protection Regulation art. 6, para. 1, letter a).
• Our legitimate interest, which is to be able to administer our website (General Data Protection Regulation art. 6, para. 1, letter f).

We delete (or anonymize) personal data as soon as it is no longer relevant. However, we always store customer information related to purchases for a minimum of 5 years for accounting purposes. We often store customer information longer, in anonymized form, for statistical purposes.

 

Contact and service

When you contact us by email, telephone, contact form on the website, or by regular mail, we process the following information about you:

• Your contact information and the content of your inquiry.

The purpose of processing your personal data is to provide you with good customer service and answer your inquiry.

We process this information on the following processing basis:

• You have consented to us processing your information (General Data Protection Regulation art. 6, para. 1, letter a)
• We process your information in order to provide you with a service in connection with the formulation of a contract (General Data Protection Regulation art. 6, para. 1, letter b)
• We process your information based on a legitimate interest in being able to answer your questions and possibly enter into a more in-depth conversation in order to clarify your needs (General Data Protection Regulation art 6, para. 1 letter f)

Your personal data is deleted when the purpose of storing the data is no longer valid. This is assessed specifically based on the individual inquiry and the nature of the inquiry. We process your personal data as long as we have a correspondence with you. When the correspondence is completed, and the content of this does not give rise to further action, your information in the correspondence is deleted.

 

Exchange of goods and services

In connection with us entering into an agreement on the exchange of goods or services, it is necessary for us to process personal data about you. Furthermore, we will process general personal data, such as your name and your email, for the purpose of complying with our obligations under the agreement with you (General Data Protection Regulation Article 6, para. 1, letter b).

Information collected in connection with this will be deleted when the agreement is fulfilled, unless there is a specific reason to store the information for a longer period, e.g. a warranty period, or if there is a need to advertise.

We will store accounting material for 5 years from the end of the financial year to which the purchase or sale relates.

 

Social Media

When you like and / or follow us on [insert the social medium], we process the following information about you:

• your name
• The purpose of processing your personal data is to keep interested followers updated on, among other things, [insert examples of relevant posts on social media, e.g. offers, new areas, points of attention, etc.].

We process personal data on the following basis:

• Our interest in marketing and improving our website and product (General Data Protection Regulation art. 6, para. 1, letter f)

LinkedIn

We are joint data controllers with LinkedIn for the information about you that is collected when you visit our site. This means that together with LinkedIn we must allocate and determine the responsibility for complying with the legislation regarding the processing of your personal data.

You can find our agreement on joint data responsibility here: https://legal.linkedin.com/pages-joint-controller-addendum

If you do not have a profile on LinkedIn, information about your device, location/geodata and behavior on LinkedIn and outside LinkedIn, e.g. visits to websites, will be collected.

If you have a profile on LinkedIn, information that you have provided in connection with the creation of your profile, such as reactions, comments and shares that you and others make, is also collected.

We only receive the information that you yourself send to us in the form of your inquiry, like or comment. Additionally, we receive anonymous statistical information about the users from LinkedIn, via a function called LinkedIn Page Analytics.

If you want to delete your information on LinkedIn, you must delete your profile. If you delete your profile, this also means that your posts, pictures and information will be deleted. If you have questions about LinkedIn Page Analytics, you must contact LinkedIn.

Facebook and Instagram

We are joint data controllers with Meta for the information about you that is collected when you visit our pages on Facebook and/or Instagram. This means that together with Meta we must allocate and determine the responsibility for complying with the legislation regarding the processing of your personal data.

You can find our agreement on joint data responsibility here: https://www.facebook.com/legal/controller_addendum

Meta uses Insights on Facebook / Instagram to collect statistical information about visitors’ behavior on the page, including age, gender, relationship status, work, lifestyle, areas of interest, information about purchases and geographical information. For this purpose, Meta has placed cookies on your device when you visit Facebook/Instagram. Each cookie contains a unique identification code that remains active for a period of 2 years, unless they are deleted before the end of this period. Meta receives, stores and processes your personal data through these cookies. We receive aggregated results of this information.

You can read more about Facebook’s/Instagram’s use of cookies here:  https://m.facebook.com/policies/cookies/  and Cookie Policy | Instagram Help

We do not disclose information about you that we receive from Meta. However, Meta may disclose information about you to third parties. You can read more about this under the section “how is this information shared” in their Privacy Policy.

If you want to delete your cookies, you can see how via our Cookie banner, or you can contact Meta.

Meta processes information about you, even if you do not have an account with them. You can read more about this here:  Meta’s privacy policy – How Meta processes and uses user data | Privacy Center (facebook.com)

 

Newsletter

When you sign up to receive our newsletter, we process the following information about you:

• Email and name

The purpose is to deliver a newsletter to you that is tailored to your interests and preferences, so that you experience the content as relevant.

We process this information on the following processing basis:

• You have consented to receiving our newsletter (General Data Protection Regulation art. 6, para. 1, letter a)

Your personal data will be deleted when you withdraw your consent. You are free to withdraw your consent, and you can use the contact information at the top if you wish to withdraw your consent.

 

Recruitment

If you are applying for a position with us, we will process the information that appears in your application, CV and other submitted documents. It is not necessary for you to write your social security number.

The purpose of processing your personal data in the recruitment process is to assess whether you are a qualified candidate for a vacant position with us.

We process this information on the following processing basis:

• Based on our legitimate interest, which is to assess your qualifications and competencies in relation to the advertised position (General Data Protection Regulation art. 6, para. 1, letter f).

• The processing of social security numbers only takes place if you have provided it yourself in connection with the application or CV. We process social security numbers in order to be able to defend or assert a possible legal claim (Data Protection Act § 11, para. 2, no. 4, cf. § 7, para. 1 and General Data Protection Regulation art. 9, para. 2 letter f).

If you submit personal data of a sensitive nature, we process these on the following legal basis:

• A legitimate interest, which is in the interest of both parties, in assessing a future collaboration (General Data Protection Regulation art. 6, para. 1, letter f) and with the purpose of establishing or defending against a possible legal claim in connection to the recruitment process (General Data Protection Regulation art. 9, para. 2, letter f).

Applications and supporting documents can be stored for up to 6 months after the recruitment process has been completed, after which your information will be deleted. The purpose of storage after the recruitment process is to safeguard interests in the event of any objections to discrimination, unequal treatment, etc. during the recruitment process.

In the case of unsolicited applications, the application and attachments are stored for a maximum of 6 months, after which they are deleted. If we wish to store your applications for longer than this, this will happen on the basis of a specific consent from you.

If we wish to save your application with attachments, for the purpose of possible future employment, this will happen on the basis of your consent (General Data Protection Regulation art. 6, para. 1, letter a).

 

Disclosure of information

We use external suppliers/partners for the storage and processing of information. When we use an external data processor, we enter into a data processing agreement with them. Therefore, they only process personal data on our behalf and may not use them for their own purposes.

We prioritize suppliers from the EU, as well as from third countries that the EU Commission has approved in relation to the level of protection regarding personal data, cf. the General Data Protection Regulation art. 45. 

In relevant cases, personal data is passed on to independent data recipients, such as banks, debt collection.

 

Disclosure of information to insecure third countries 

Besides the Heyloyalty app, we also use some data processors/suppliers from insecure third world countries. However, when the legislation of third world countries does not offer the same security as the EU does, we have stricter obligations in the protection of your data. 

• Personal data we collect and process in connection with marketing is transferred to Google Commerce Ltd, Meta Platforms Inc, Microsoft US. We have ensured that there is a legal basis for the transfer in the form of Joint SCC art. 46 para. 2 letter c, and that the information is processed under adequate security measures.
• We use Outlook as a mail client. So if you contact us through Outlook, your information will be transferred to Microsoft USA. We have ensured that there is a legal basis for the transfer in the form of SCCs art. 46 para. 2 letter c, and that the information is processed under adequate security measures.

If you want to know more about the transfer bases that affect you, you can contact us at GDPA@arnsbogroup.com.

 

Your rights

You can by using the contact information at the top of the page:

• gain insight into your personal data
• have your registered personal data corrected
• have personal data deleted
• have the processing of your personal data restricted.
• have your personal data delivered (data portability) for the purpose of transferring to another data controller
• object to the processing

If you give consent to us, your consent is voluntary, and it has no consequences for you if consent is not given, only given to individual points or later revoked.

Withdrawal of consent can take place at any time by using the contact information above.

If you contact us with a request to make use of the abovementioned rights, we will answer you within one month. If we cannot accommodate your request, you will receive a justification for it.

To make use of your rights, or if you have questions about the above, you can contact us. You will find our contact information at the top of the page.

If you are subsequently dissatisfied with the way in which we process your information, you have the right to submit a complaint to the Danish Data Protection Agency.

Updated April, 2023