Privacy Policy

Balad ApS ("Balad", "we", "our", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect the information you provide when using our website (Balad.dk) and purchasing our products. We comply with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

We collect and process the following categories of personal data: • **Identity data:** Name, username, and title • **Contact data:** Email address, phone number, billing address, delivery address • **Transaction data:** Details of products you've ordered and payment information (we do not store full card numbers) • **Technical data:** IP address, browser type and version, time zone, browsing and session data • **Profile data:** Your purchase history, preferences, and wishlist • **Marketing data:** Preferences in receiving marketing communications from us

We use your data to: • Process and fulfill your orders, including taking payment and arranging delivery • Manage your customer account and provide customer service • Send transactional emails (order confirmations, shipping updates) • Send marketing communications, if you've opted in • Prevent fraud and verify your identity • Comply with legal obligations • Improve our website and personalise your experience We rely on the following legal bases: contract performance, legitimate interests, legal obligation, and consent (for marketing).

We share your data with carefully selected third parties only where necessary: • **Payment processors:** Stripe Inc. processes all card payments securely • **Delivery partners:** PostNord, GLS, and DHL receive your delivery address • **Email service providers:** We use Mailchimp for marketing emails • **Analytics:** Google Analytics helps us understand how our site is used (anonymised data) • **Legal requirements:** We may disclose data to authorities when required by law We never sell your data to third parties.

We retain your personal data for as long as necessary: • Customer accounts: For the duration of the account plus 3 years after last activity • Order data: 5 years for accounting and tax compliance • Marketing consent: Until you withdraw consent • Website analytics: 26 months You can request deletion of your data at any time (subject to legal retention requirements).

Under the GDPR, you have the right to: • **Access** the personal data we hold about you • **Rectify** inaccurate data • **Erase** your data ("right to be forgotten") • **Restrict** processing of your data • **Data portability** — receive your data in a machine-readable format • **Object** to processing based on legitimate interests • **Withdraw consent** at any time for marketing communications To exercise your rights, contact us at privacy@Balad.dk. We will respond within 30 days.

We use cookies to improve your browsing experience. Essential cookies are necessary for the site to function. Analytics cookies (only set with your consent) help us understand visitor behavior. You can manage cookie preferences via the banner shown on first visit or in your browser settings.

We implement appropriate technical and organisational measures to protect your data, including SSL/TLS encryption, secure servers, access controls, and regular security assessments. However, no internet transmission is completely secure. We encourage you to use a strong, unique password for your account.

For privacy-related questions, contact our Data Protection Officer at privacy@Balad.dk or write to: Balad ApS, Nørrebrogade 47, 2200 Copenhagen N, Denmark. You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk if you believe we've mishandled your data.