Privacy policy
1. Information about the processing of personal data
Your data security is important to us. We therefore take great care to ensure that your personal data is handled responsibly. Below you can read how Karup Design A/S (hereinafter “Karup Design”, “we”, “us” or “our”) processes personal data about you when we act as data controller. You can also read about your rights in relation to this processing.
2. Karup Design’s role as data controller
In connection with the operation of our business, we process certain personal data in order to serve you in the best possible way. We mainly collect and process general (non-sensitive) personal data.
If you have any questions regarding our processing of your personal data, please contact Karup Design:
Karup Design A/S
CVR no. (Danish company registration number): 11 21 19 33
Lollandsvej 4E, 7400 Herning, Denmark
Phone: +45 97 10 20 00
Email: mail@karupdesign.com
3. What personal data do we collect and why?
We process personal data about you in a number of different situations, described below.
3.1. Visitors to Karup Design’s website and users of Karup Design’s online services
When you visit Karup Design’s website (e.g. www.karupdesign.com) or use our other online services (e.g. on Facebook, Instagram, LinkedIn, YouTube, Pinterest or TikTok), Karup Design may process your IP address as well as information about your computer, device and browser.
We also process information about your visit, e.g. how you access and navigate our websites, which pages and content you view, your searches and the advertisements you have seen. This data is collected through cookies, log files and other technologies. Cookies that are not strictly necessary are only placed with your consent, which you can refuse or withdraw at any time as easily as you gave it. You can read more in our cookie policy.
We also process personal data that you provide to us when you use the website or our online services, e.g. via our online chat or contact form: name, address, phone number, email address, product interests and any other information you provide to us.
We use your personal data to make relevant products, supplies, benefits and services (“Services”) available to you and to improve your experience of our websites, online services and Services. We also use it to show you content on our own and other websites based on your activities and preferences, and to limit the number of times you see the same content.
Legal basis: our legitimate interest in making our website and online services available to you (Article 6(1)(f) GDPR) or your consent (Article 6(1)(a) GDPR, Article 82 of the French Data Protection Act (Loi Informatique et Libertés) and Section 3 of the Danish Executive Order on Cookies).
Retention period: personal data collected in connection with your visit to our website is stored for up to 2 years.
3.2. Customers of Karup Design
When you are a customer of Karup Design and make a purchase in our webshop, Karup Design processes the following data: your name, address, email address, purchases, payment information, any returned products, inquiries and complaints, delivery preferences, the IP address from which the order was placed and any other information you provide to us. Data marked as mandatory during checkout is necessary to enter into and perform the contract; without it, we cannot process your order.
We process this data in order to perform the contract with our customers, provide the Services, issue invoices, keep statistics and perform quality management, as well as to maintain our customer records and provide customer service, marketing and sales to our customers.
Legal basis: the contract with you (Article 6(1)(b) GDPR), compliance with our legal accounting obligations (Article 6(1)(c) GDPR) or our legitimate interest in managing your information as a customer (Article 6(1)(f) GDPR).
Retention period: customer data is stored for up to 5 years after the end of the financial year in which the purchase was made, in accordance with invoicing requirements and Danish accounting legislation.
3.3. Recipients of marketing communications
When you receive marketing communications from Karup Design, including newsletters, we process the following data: name, address, phone number, email address, job title and product interests. We also process information about your use of our communications (e.g. whether you have opened an email, whether it has been read and which links you have clicked), as well as any other information you provide to us.
We process your data to market our company and Services and to set up and manage your subscription. Data about your preferences and usage helps us understand how customers receive our messages and improve our communications.
We only send you marketing communications by email, text message or other electronic means with your prior consent, unless you are already a customer and the communications concern products or services similar to those you have purchased. In all cases, you can unsubscribe at any time, free of charge, via the link in each message or by contacting us.
Signing up for our newsletter is optional. Our marketing communications are intended for persons aged 15 or over; if you are under 15, you may only sign up with the joint consent of a parent or legal guardian (Article 45 of the French Data Protection Act).
With your consent, we also use your data to show you content on our own and other websites based on your activities and preferences, to limit the number of times you see the same content and to measure the effectiveness of our content and marketing. For this purpose, we may upload your email address to advertising tools, e.g. those of Google or Meta (Facebook), in order to send you targeted marketing messages.
Legal basis: your consent (Article 6(1)(a) GDPR and Article L. 34-5 of the French Postal and Electronic Communications Code) or, if you are already a customer, our legitimate interest in informing you about similar products (Article 6(1)(f) GDPR).
Retention period: data about recipients of marketing communications is stored for up to 1 year.
3.4. Participants in competitions
When you participate in a competition, we process the following data: your answers to the competition, email address, phone number, address, name and profile name.
We process this data in order to manage competitions, select the winners and contact them.
Legal basis: our legitimate interest in running the competition and contacting the winner (Article 6(1)(f) GDPR).
Retention period: data collected in connection with the organisation of competitions is stored for 30 days.
3.5. Business partners and/or suppliers to Karup Design
When you are a business partner or supplier to Karup Design, or a contact person at one of them, we process the following data: your name, company name, job title, business address, work phone number, email address, publicly available information and any other information you provide to us.
We process this data for the purposes of contract management, receiving goods and services from our suppliers and business partners and, where relevant, fulfilling our agreements with our customers.
Legal basis: the contract with you (Article 6(1)(b) GDPR) or our legitimate interest in managing the relationship with you or the company you represent (Article 6(1)(f) GDPR).
Retention period: data about business partners and/or suppliers is stored for 1 year.
3.6. Visitors to our social media pages
We have public pages on Facebook, Instagram, LinkedIn, YouTube, Pinterest and TikTok. When you visit these pages, react to our posts or send us a message, we process the information you make visible or provide to us (e.g. your profile name, comments and messages), as well as the page statistics provided by the platform.
For the statistics on our pages, Karup Design and the platform concerned are joint controllers within the meaning of Article 26 GDPR. For Facebook and Instagram, Meta makes the essence of the joint controller arrangement available here. You can exercise your rights with us as well as with the platform concerned. However, we have no control over the processing that the platforms carry out for their own purposes; for more information, please see their privacy policies.
Legal basis: our legitimate interest in communicating with you and maintaining our online presence (Article 6(1)(f) GDPR).
Retention period: messages you send us are stored for as long as necessary to handle your inquiry.
3.7. Profiling and automated decision-making
We use certain data (e.g. your purchases, your browsing on our website and your interactions with our emails) to identify your interests and personalise our communications and advertising (profiling). This profiling is based on your consent or our legitimate interest, as described in sections 3.1 and 3.3, and you can object to it at any time.
We do not make any decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
4. Disclosure of your personal data to others
We only disclose your personal data to the extent necessary for the purposes described in this policy. The categories of recipients are:
• Hosting and webshop: Shopify
• Newsletters and marketing communications: Klaviyo
• Advertising, social media and analytics: Meta (Facebook, Instagram), Google (including YouTube), LinkedIn, Pinterest and TikTok
• Payment: our payment service providers, including Klarna. If you choose a Klarna payment method, Klarna may carry out an identity and credit check as an independent data controller; for more information, please see Klarna’s privacy policy
• Delivery: our carriers
• Other: our IT suppliers, accountant and legal advisers
Karup Design may also disclose your personal data to a public authority where we are specifically obliged to do so under legislation or reporting obligations to which we are subject.
We try to limit the disclosure of information that can identify you personally.
Karup Design also discloses your personal data to data processors. Our data processors only process your personal data on our behalf and under our instructions.
5. Transfer of personal data to countries outside the EU/EEA
In connection with our processing of your personal data, we may transfer it to countries outside the European Union and the European Economic Area (third countries).
Your personal data may be transferred to countries for which the European Commission has determined that the level of data protection is adequate and equivalent to that in the EU/EEA.
We may also transfer your personal data to third countries that are not covered by such an adequacy decision. In that case, the transfer is based on the Standard Contractual Clauses adopted by the European Commission, which are specifically designed to ensure an adequate level of protection. We assess the adequacy of these safeguards and, where necessary, adopt additional measures to ensure an adequate level of protection.
Some of our providers, including Shopify, Klaviyo, Google, Meta, LinkedIn, Pinterest and TikTok, are established in the United States or belong to groups whose parent company is established outside the EU/EEA, which means your data may be transferred there. Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023. Otherwise, it is based on the Standard Contractual Clauses mentioned above.
You can read more about transfers of personal data outside the EU/EEA on the European Commission’s website. If you would like further information about our transfers, or a copy of the appropriate safeguards, please contact us.
6. Storage, data integrity and security
When your personal data is no longer needed, we ensure that it is deleted securely.
It is our policy to protect personal data by taking appropriate technical and organisational security measures.
We have implemented security measures to protect all personal data that we process, and we regularly check internally that our policies and measures are adequate and complied with.
7. Your rights
As a data subject, you have certain rights under the General Data Protection Regulation (GDPR) and the French Data Protection Act. To exercise your rights, please contact us using the details in section 2. We will respond to your request within one month; this period may be extended by two further months if the request is complex, in which case we will inform you.
You may withdraw your consent unconditionally and at any time by sending us an email (see address above). Withdrawing your consent will not have any negative consequences for you, but it may mean that we can no longer meet certain requests from you. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal, nor processing based on another legal basis.
Your right to object
You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 6(1)(f) GDPR), including profiling based on that provision. We will then stop the processing unless we have compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of legal claims.
You may also object at any time, without giving reasons, to the processing of your data for direct marketing purposes, including profiling related to such marketing. Your data will then no longer be used for these purposes.
Your rights also include the following:
• Right of access: you have the right to access the personal data we process about you.
• Right to rectification: you have the right to have inaccurate or incomplete personal data about you rectified.
• Right to erasure (“right to be forgotten”): in certain cases, you have the right to have your data erased before the time when we would normally delete it.
• Right to restriction of processing: in certain cases, you have the right to have the processing of your data restricted. We may then only process your data, apart from storing it, with your consent, for the establishment, exercise or defence of legal claims, or to protect another person or important public interests.
• Right to object: in certain cases, you have the right to object to our processing of your data, and you can always object to processing for direct marketing purposes.
• Right to data portability: in certain cases, you have the right to receive your data in a structured, commonly used and machine-readable format and to have it transferred to another data controller.
• Instructions regarding your data after your death: in accordance with Article 85 of the French Data Protection Act, you may give instructions regarding the storage, erasure and disclosure of your personal data after your death.
• Right to lodge a complaint: you may at any time lodge a complaint about our processing of your personal data with the French data protection authority, Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the Danish Data Protection Agency, Datatilsynet (www.datatilsynet.dk), which is the supervisory authority for Karup Design.
Opting out of telephone marketing: if you do not wish to receive marketing calls, you can register free of charge on the French telephone marketing opt-out list, Bloctel (www.bloctel.gouv.fr), in accordance with Article L. 223-2 of the French Consumer Code.
8. Updates of our privacy policy
From time to time it may be necessary to update this privacy policy. We review it regularly to ensure that it is up to date, valid and in accordance with current legislation and the principles for processing personal data. New versions will be published on our website.
Version no. 1 – valid from 20 October 2026.