Privacy Policy

1. Who is responsible for your data

The data controller is Pernille Ravnkilde, trading as Pure Pernille, of Frederiksborgvej 15, 1, 3200 Helsinge, Denmark.

For anything about your data, write to hello@purepernille.com. We're small enough that this reaches a person, not a queue.

2. What we collect

When you buy: your email address, your order details, and the country your payment came from. Stripe handles the payment itself. We never see your card number.

When you create an account: your email address and a password we store only as a one-way hash, so nobody here can read it. If you sign in with Google or Facebook we receive your name and email from them, nothing more.

When you subscribe to the newsletter: your email address and whether you confirmed it.

When you write to us: whatever you choose to send.

Automatically: basic technical information every website receives, such as your IP address, for security and to keep the site working.

3. Why we use it, and on what legal basis

To deliver what you bought, send your receipt and download links, and answer questions about your order, because we have a contract with you (GDPR Art. 6(1)(b)).

To keep accounting records of sales, because the law requires it (Art. 6(1)(c)).

To send the newsletter, only with your consent, which you gave by confirming your address and can withdraw at any time (Art. 6(1)(a)).

To keep the site secure, prevent fraud, and fix problems, because we have a legitimate interest in the shop working and not being abused (Art. 6(1)(f)).

4. How long we keep it

Order and invoice records: for the period Danish accounting law requires, currently five years from the end of the financial year. We can't delete these on request, and no shop can.

Your account: until you delete it, or after a long period of inactivity.

Newsletter subscription: until you unsubscribe. We keep a record that you unsubscribed, so we don't email you again by mistake.

Messages you send us: normally up to two years, so we have context if you write again.

5. Who else sees it

Only the services needed to run the shop: Stripe for payments, Resend for email, Cloudflare for file storage and delivery, Neon for our database, and Vercel for hosting. Each is bound by a data-processing agreement.

We don't sell your data, and we don't share it for anyone else's marketing. Ever.

We may disclose data if the law requires it: a court order, or a tax authority exercising its powers.

6. Data leaving Europe

Some of those providers are US companies and your data may be processed outside the EU. Where that happens it's covered by the European Commission's standard contractual clauses, or by the EU–US Data Privacy Framework where the provider is certified.

If you'd like the specifics for a particular provider, ask and we'll tell you.

7. Your rights

You can ask us for a copy of your data, correct anything wrong, have it deleted, restrict how we use it, object to processing based on legitimate interest, and receive your data in a portable format.

Where we rely on consent (the newsletter), you can withdraw it whenever you like, and that doesn't affect anything sent before you did.

Write to hello@purepernille.com and we'll respond within one month. There's no charge.

If you're unhappy with how we've handled it, you can complain to Datatilsynet (the Danish Data Protection Agency), datatilsynet.dk, or to the authority in the EU country where you live.

8. The newsletter

Entering your address isn't enough on its own: we email you a confirmation link, and until you click it you're marked pending and receive nothing. That step is how we know the address belongs to you.

Every newsletter carries an unsubscribe link that works without signing in, and your mail app's own unsubscribe button works too. Leaving takes one click and stops marketing email immediately.

Order confirmations and download links are separate and keep working, because those are part of what you bought.

9. Cookies: almost none

The shop sets no tracking or advertising cookies, and there's nothing here to consent to. Your bag lives in your own browser's storage and never leaves it until you check out.

Signing in sets a cookie that keeps you signed in, and Stripe sets its own during checkout to prevent fraud. Both are necessary for something you asked for, which is why no cookie banner interrupts you.

10. Children

This shop isn't intended for anyone under 16, and we don't knowingly collect their data. If you believe a child has given us information, write to us and we'll remove it.

11. No automated decisions

We don't profile you and we don't make automated decisions that affect you. Stripe runs automated fraud checks on payments, which can decline a card. If that happens to you, write to us and we'll sort it out with a human.

12. Deleting your data

You can ask us to delete your data at any time. What goes, what has to stay, and why is set out in full on our data-deletion page.

13. Changes to this policy

If we change how we handle data we'll update this page, and the date at the foot tells you when it last changed. For anything significant we'll email you.