This document was last updated on 25 July 2023.

This privacy policy applies to the handling of personal data that we collect, or you submit, when you visit our website, engage with us via social media, apply to a job with us or act as representative of any of our business partners. Unless otherwise stated, The Vintage Bar ApS company registration no. 39106744, Prags Boulevard 49A, 2300 Copenhagen, Denmark act as data controller for all processing activities mentioned herein.

Below you can read more about how and why we collect and store your personal data – and whom we share it with. You can also read about how you can exercise your privacy rights, e.g. how to request access to your personal data. We note that our use of personal data is supervised by EU General Data Protection Regulation (GDPR) and the Danish Data Protection Agency.

As we offer various services and interact with private persons in various capacities, please read the following carefully and be aware that our treatment of your personal data may fall into one or more of the categories described below. In case you have any questions regarding our handling of your data feel free to reach out via legal@thevintagebar.com .

IF YOU ARE APPLYING FOR A JOB WITH US

We process the personal data included in interviews, correspondences, your CV, your application and any other documents that you wish to share with us throughout the application process. We may collect, record and store any such information for the purpose of properly evaluating your job application. Please note that we may also conduct general searches and process any publicly available personal data regarding your person that we find during such searches for the purpose of evaluating your application for a position with us.

The basis for our processing of this information is your application for the conclusion of an employment contract with us (cf. Article 6(1)(b) of the General Data Protection Regulation), and our legitimate interest in processing such information for the purpose of hiring decisions (cf. Article 6 (1)(f) of the General Data Protection Regulation).

Lastly, if your application includes references, we may ask for your consent to collect information about your person from such sources as part of the application process. The basis for our processing of this information is your consent (cf. Article 6(1)(a) of the General Data Protection Regulation).

We strongly recommend that you do not share any sensitive personal data (e.g. ethnic background, religion, sexuality and health information) with us as part of the application process; if it should be relevant to process any such information in connection with the application we will ask for you consent to process such information, as required pursuant to Article 9(2)(a) of the General Data Protection Regulation.

If you are not offered a position based on your application, we will retain your application and the collected personal data for a period of 12 months after the final decision as documentation for the application process and the basis of the final decision, unless you have agreed to a longer period.

If you are offered a position, any information gathered during the application process will be transferred and stored in your personal file and processed in accordance with our guidelines regarding handling of employees’ personal data.

IF YOU ARE A REPRESENTATIVE OF ANY OF OUR BUSINESS PARTNERS

We process the personal data that you or your employer share with us as part of our communication relating to the (potential) business relationship between us and the business partner that you represent. This personal data may include, name, email, phone number or similar identifying information, information about your preferences (such as language preference), organizational information about your relation to the business partner that you represent, and contractual information.

The personal information may be collected, recorded and stored by us during pre-cooperation situations such as part of a sales pitch, through a reference or mutual meeting; throughout the contractual relationship as part of the day-to-day administration of the mutual business relationship; or post-cooperation for future reference or for documentation purpose of prior relationship. The information is processed for the purpose of establishing a collaboration, general planning, administration and execution of our mutual partnership; for the purpose of statistical analysis and improvement of products; as part of general communication or for documentation, compliance and dispute resolution purposes.

Our basis for processing of the information may be for the purpose of entering into or administering a contractual relation (cf. Article 6(1)(b) of the General Data Protection Regulation) between us and the business partner you represent, due to a legal requirements/obligation (cf. Article 6(1(c) of the General Data Protection Regulation), based on your consent (cf. Article 6(1)(a) of the General Data Protection Regulation) or our legitimate interest (cf. Article 6(1)(f) of the General Data Protection Regulation) in being capable of identifying our business partners and in improving our products and services.

Your personal information will be stored throughout our collaboration and in up to 3 years after end collaboration, unless such information is included in accounting materials or order documentation in which case it will be stored for 5 years from the end of the financial year. Following such period, the information will be deleted.

IF YOU ENGAGE WITH US VIA OUR WEBSITE, COMMUNITY CARE, PARTNERSHIP REPRESENTATIVES OR SOCIAL MEDIA

We process various types of personal data that you decide to share with us when you engage with us via the website, via our community care service or when interacting with partnership representatives. Generally, this information is processed for the purpose of assisting you (acting as buyer) in the completion and fulfillment of transactions that you take part in via the website; assisting you with various inquires that you may have about such transactions or any related services; or to improve our services and your experiences as a user of our services.

Our legal basis for collecting such information various depending on the type of information and the purpose. The following section describes the collection, purpose and our legal basis for collecting such information in further detail.

Fulfilment and delivery of your orders via the Platform

To process your order on the website, we will ask you to provide us with your name, address, email, phone number and which products you wish to purchase. The information is collected, processed, and stored by us for the purpose of fulfillment of your order, packaging, delivery, returns, etc. We will also send you transactional emails, which we sent to you to make sure you are notified about the various steps in the transaction process. We do also ask you to provide card information or similar payment information – please see below for a description of the processing of such information.

The legal basis for our processing of this information is the performance of our contractual commitments as described in our terms and conditions and or related agreements between you and us (cf. Article 6(1)(b) in the General Data Protection Regulation).

Engagement via Community Care or our partnership representatives

To process (i) inquires you might have concerning your use of our services (ii) your orders, and (iii) claims, we collect, process and store your name, address, email, phone number, order number, and similar identifiers that may help us understand your inquire or identify the user case you are seeking assistance with and which is considered relevant to solve matters which you bring to our attention. Please note that the information collected may also be used for optimization of our customer service, which for instance may include use of information for internal training of our customer service team.

The basis for our processing of this information is our legitimate interest to improve the products and services offered to you and other customers (cf. Article 6(1)(f) in the General Data Protection Regulation).

Improvement of your user experience when engaging with us via the website or social media (Marketing)

We constantly strive to give you the very best user and shopping experience. We do that in different ways, but an important part of it is by collecting information about your browsing behavior on our website and social media pages. Another way for us to improve the user friendliness, layout, functionalities, and overall experience of our product and services, we collect cookies. You can read more about which cookies we collect in our cookie policy (see below).

As part of these activities, we collect, process and store personal data, such as your name, email, phone number, address, information about orders, information you enter when signing up for a user account, IP address, information about your use of the website and products you show interest in via our website. The purpose for collection of this information is optimization of our services and your user experience; please note that we also use these data to recommend products that we think you might like. This information may be combined with other information which you have provided via social media platforms (see more below) or which they have collected themselves. We may also use this information to send direct marketing information about campaign, events, etc., but no direct marketing material will be sent to you unless you have given your prior consent.

You can always object to our processing of your personal data for direct marketing purposes, including profiling, by contacting us at legal@thevintagebar.com .

The basis for our processing of this information is our performance of services set out in our terms and conditions and or related agreements between you and us (cf. Article 6(1)(b) in the General Data Protection Regulation) our legitimate interest to improve the products and services offered to you and other customers (cf. Article 6(1)(f) in the General Data Protection Regulation) and your prior consent (cf. Article 6(1)(a) in the General Data Protection Regulation).

Fraud prevention

We use the personal data submitted by you when you place an order for fraud detection and fraud prevention purposes. For those purposes, we may also receive additional information from our payment gateway providers.

The basis for our processing of this information is our legitimate interest to improve the products and services offered to you and other customers (cf. Article 6(1)(f) in the General Data Protection Regulation) and our legal obligations as provider of the applicable product and services, (Article 6(1)(c) in the General Data Protection Regulation).

Regulatory requirements

We also use and store your personal data in order to comply with regulatory requirements, e.g. bookkeeping regulations.

The basis for our processing of this information is our legal obligations as provider of the applicable product and services, (Article 6(1)(c) in the General Data Protection Regulation).

Specifically, about information you share via social media

Facebook: https://www.facebook.com/about/privacy/update
Instagram: https://help.instagram.com/519522125107875/?maybe_redirect_pol=0
TikTok: https://www.tiktok.com/legal/privacy-policy-us?lang=en
Snapchat: https://snap.com/en-US/privacy/privacy-policy
Pinterest: https://policy.pinterest.com/da/privacy-policy

We and/or the respective social media platform that you are engaging with us via, may collect and process personal data about you when you visit the platform, leave comments or utilize functions that express your interest or opinion (e.g. the use of “like” buttons). The information is used by us to improve products, services. We use aggregated data supplied by the social media platform for statistical purposes. Any such information is processes for the purpose of our legitimate interest in improving our products and services (cf. Article 6(1)(f) of the General Data Protection Regulation).

As stated below you do have certain special rights when one or more companies act as joint data controllers, but please note that if you wish to exercise your rights towards one or more of the social media platforms we encourage you to (also) take direct contact to the respective social media platform as we only have limited options to take necessary steps regarding personal data shared via the social media platform.

Specifically, about financial information provided in connection with transactions

If you are a party to a transaction via our platform, you will share your card information or account ID for a designated account with a third-party payment provider; such information are not stored by us but is stored and processed by the respective payment gateway provider for the purpose of implementing and completing the transactions in which you are a party. For information about payment providers processing and storage of such information, please refer to the privacy policy of the payment gateway provider that you choose in relation to a specific transaction:

List of payment gateway providers that we cooperate with and that you may choose from in connection with a transaction:

Klarna: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/da_dk/privacy
PayPal: https://www.paypal.com/us/webapps/mpp/ua/privacy-full
Stripe: https://stripe.com/en-gb-us/privacy

Storing of information collected

The personal information collected when you interact with us via the website, our community care service, our partnership representative or via social media will be stored in up to 3 years after your last purchase unless such information is included in accounting materials or order documentation in which case it will be stored for 5 years from the end of the financial year.

Documentation of your marketing consent will be kept for 2 years from the time that you have withdrawn your consent.

Please note that if we are - or become - required by law, or if necessary due to an ongoing legal claim, we may keep the information for a prolonged period. Any information kept for such prolonged period will be deleted as soon as such storage is no longer necessary or legally required.

IF YOU ARE AS ACTING AS A PRIVATE SELLER

In addition to such information as may be collected during your general use of our platform, we process additional personal information if you act as private seller of your own private item via our platform. The personal data that we may collect in connection herewith include name, email, address, pictures and description about the item you want to list for sale, account information (your account ID from your Stripe account), and such other information as you wish to share with us in connection with the listing and sale of your product. We process this information in order to assist you in the listing of your item and the completion and fulfillment of the order (including handling of payments). The personal information may be collected and stored by us in connection with your listing of the product or in connection with the sale and fulfillment of the sale.

Our basis for processing of the information may be our legitimate interest (cf. Article 6(1)(f) of the General Data Protection Regulation) to improve the products and services offered to you and other private seller, due to a legal requirements/obligation (cf. Article 6(1(c) of the General Data Protection Regulation) or based on your consent (cf. Article 6(1)(a) of the General Data Protection Regulation).

DISCLOSURE OF YOUR PERSONAL DATA TO OTHER DATA CONTROLLERS AND DATA PROCESSORS

To perform the services, we may share your personal data with service providers who will only process your personal data in accordance with our instructions set out in data processer agreements, unless they act as independent data controllers, in which case.

The type of service providers that we may share your information with are: The sellers with whom you enter into a transaction with; Companies such as payment service providers that help us to process your order; Companies that help us to deliver your purchases such as couriers and parcel delivery companies who deliver your goods and act as data controllers for the duration of the delivery process.; Professional service providers, such as email delivery suppliers, IT software providers, marketing and research agencies, analytics companies and website hosts who help us to run our business; and, Governmental bodies and regulators to comply with our legal obligations and in case of prevention of fraud. We may also share information with our affiliated companies.

When you shop via The Vintage Bar you may purchase products from independent professional sellers. Please note that in order for those sellers to process your order we disclose your name, address and order details to the professional seller. The professional seller act as an independent data controller of your personal data, since they process the personal data for their own purposes. We require all sellers to comply with any applicable legal requirements relating to the collection of your personal data. No information is disclosed if you purchase a product from a private seller. with whom you enter a transaction.

Lastly, we share your name, address and order information with the courier you have chosen to deliver your order (e.g. DHL), the disclosure is necessary to ensure correct delivery of your order. DHL act as independent data controller since they process the personal data for their own purposes.

If your personal data were to be shared with providers in so-called third-party countries, we do our best to ensure that your personal data is kept save, and therefore we only share personal data with providers from countries demanding high standards of data protection. We are constantly working on solutions to make the transfer and treatment of your personal data more save. For instance, EU has proposed the use of “standard contractual clauses” (SCC), and when possible, we work to include such clauses in our cooperation with the providers from third party countries. Furthermore, and were possible, we seek to minimize and/or pseudonymize information which is shared.

PROTECTION OF STORED AND TRANSMITTET INFORMATION

We do our best to protect and safeguard the confidentiality, integrity and availability of your personal data and have implemented both technical safeguards, e.g. pseudonymization of data or encryption, and organizational safeguards such password protection, 2-factor authentication and similar.

YOUR RIGHTS

When we collect and use your personal data you have a number of privacy rights. If you wish to exercise any of your rights, please submit your request to us at legal@thevintagebar.com .
You can read more about your various rights below:

• The right to request a copy of the personal data that we hold about you.
• The right to ask us to correct any inaccuracies in the personal data we hold about you.
• The right to withdraw your consent to marketing.
• The right to object to our processing of your personal data on the basis of our legitimate interest.
• The right to request the deletion of your personal data in certain circumstances.
• The right to data portability to transfer your data to another entity.
• The right related to automated decision-making including profiling. We use profiling to make relevant and tailored recommendations to you. We do not use automated decision-making processes that would have a potentially damaging effect on you. However, if we did, you have the right to obtain human intervention, express your point of view, obtain an explanation of the decision and challenge it.

COMPLAINTS

If you wish to lodge a complaint about how we handle your personal data, you can always contact our community care team. You can also file a complaint with The Danish Data Protection Agency (www.datatilsynet.dk).

CHANGES TO NOTICE

We reserve the right to update and amend this Policy. If we do, we correct the date and the version at the bottom of this Policy. The latest version will always be available at: thevintagebar.com/privacy-policy

This document was last updated on 25 July 2023.