Privacy Policy

1. Who are we?

Værftets Madmarked A/S, CVR no. 38490621, Ny Kronborgvej 2, 3000 Helsingør, Denmark (hereinafter referred to as "we" or "us") is the data controller for the processing of your personal data as described in more detail in this personal data policy.

If you have any questions about this policy or our processing of your personal data, you are always welcome to contact us by email: info@vaerftetsmadmarked.dk.

2. We process your personal data

We process personal data for various purposes, which you can read more about below.

We store/disclose personal data only for as long as/when necessary to fulfill the purposes for which the personal data was collected, or if necessary to comply with our legal obligations.

2.1 Purchase of goods and services at the Shipyard Food Market

When you make a purchase using electronic payment, we process transaction information about you in order to complete the purchase, cf. Article 6(1)(b) of the General Data Protection Regulation.

To the extent necessary for the operation of the business, we disclose such personal data to other partners, suppliers, etc., including, for example, transaction systems, NETS, Mobilepay, IT suppliers, freight companies, auditors, and lawyers.

We store the information for 5 years after the end of the relevant financial year in accordance with the Accounting Act.

2.2 Atmospheric images and videos

We occasionally take atmospheric photos and videos of guests to promote and share Værftets Madmarked and our many wonderful activities.

In this context, we process ordinary personal data in the form of image and video material of persons appearing in the material. We do this because we have a legitimate interest in promoting ourselves and our events and activities at Værftets Madmarked, and because we assess that your interest in this processing not taking place does not outweigh this, cf. Article 6(1)(f) of the General Data Protection Regulation.

We always review the material before it is published and make every effort to ensure that the people featured do not feel exposed or offended. If we publish such images or videos of you, you have the right to object. In such cases, we will always do our best to remove the images/posts. You can read more about your right to object in section 4, and if you wish to object, you can contact us using the contact details provided in section 1.

We pass on atmospheric images and video material to our IT suppliers, whom we use for storage and data processing.

In addition, we pass on the material to partners if it relates to an event or activity organized in collaboration with others.

Finally, we publish the material on our website and/or our social media profiles, including Facebook, Instagram, Pinterest, LinkedIn, and TikTok.

We process the material until it is no longer relevant, i.e. it can be deleted after 10 years, or if it is material related to recurring regular events and occasions, until we stop holding the event/occasion in question. However, we will delete the material if we receive an objection to its storage.

2.3 Newsletters and direct marketing

If you sign up for our newsletter, we will process your personal data in order to send you the newsletter and manage your subscription.

In this context, we only process general personal data in the form of your name, email address, and interaction data, which includes information about whether and when you have opened our newsletters. This processing is based on your consent, which you have given by subscribing to our newsletter, cf. Article 6(1)(a) of the General Data Protection Regulation.

You can read more about consent in section 3, and if you wish to withdraw your consent, please contact us using the contact details provided in section 1.

We disclose personal data to our IT suppliers, whom we use for storage, data processing, and sending newsletters.

We process your information for the purpose of sending you the newsletter for as long as you have given us your consent to do so, i.e. until you withdraw your consent.

2.4 Contacting us via email

If you contact us via our contact form or by email, we will process your personal data. We do this in order to handle and respond to your inquiry. As a general rule, we will process standard personal data, including your name, email address, billing information, and any other personal data you have included in your inquiry to us.

Depending on the inquiry, our basis for processing will be as follows:

To fulfill an agreement or contract with you, cf. Article 6(1)(b) of the General Data Protection Regulation. This may be the case, for example, if you contact us regarding an agreement to hold an event with us.
To pursue a legitimate interest that we consider to be more important than your interest in us not processing your data, cf. Article 6(1)(f) of the General Data Protection Regulation. This may be the case, for example, if you contact us with questions or feedback. In this context, you have the right to object to our assessment, which you can read more about in section 4.
To comply with a legal requirement, cf. Article 6(1)(c) of the General Data Protection Regulation. This may be the case, for example, if you contact us to exercise your rights under the General Data Protection Regulation.

If you include health information in your inquiry to us, e.g., to ask about allergens, disabilities, or similar, we consider this as consent to process the sensitive information in question, cf. Article 9(2)(a) of the General Data Protection Regulation.

We disclose this personal data to software and IT suppliers and data processors who are necessary to handle your inquiry.

In addition, depending on the content of your inquiry, we may disclose your personal data to relevant partners, suppliers, insurance companies, the police, and/or lawyers.

As a rule, we store your inquiry for three years after the case has been closed or the matter you have contacted us about has been dealt with, unless there is a specific need to store the personal data for a longer period.

2.5 Users of our website

When you visit our website, we process general personal data about you in the form of, for example, your IP address, which pages you visit on our website, and other digital footprints using cookies and cookie-like technology.

We use this technology to manage, develop, and administer our website, generate visitor statistics, and market ourselves based on visits. You can read more about our cookies in our cookie policy.

Depending on which cookies are used, our legal basis for processing will be as follows:

Processing via necessary cookies, on the other hand, is based on our legitimate interest in ensuring that our website functions as intended, which we have assessed to outweigh your interest in the information not being processed, cf. Article 6(1)(f) of the General Data Protection Regulation.

In this connection, you have the right to object to our assessment, which you can read more about in section 4.

Processing via preference cookies, statistical cookies, and marketing cookies is based on your consent, cf. Article 6(1)(a) of the General Data Protection Regulation.

To the extent that you consent to third-party cookies, we will disclose your personal data to these third parties. You can read more about third-party cookies in our cookie policy. In addition, we may disclose your information to relevant suppliers and partners, including, for example, software suppliers, marketing agencies, and other data processors.

How long we process your personal data for these purposes depends on which cookies you consent to.

You can change your consent settings or withdraw your consent at any time and delete the cookies you have previously consented to by following the instructions in our cookie policy. You can also click on the icon at the bottom of our website to change your consent.

2.6 Interaction with Værftets Madmarked via social media

When you visit and interact with us via our social media profiles, we process general personal data about you in the form of, for example, your (user) name, profile picture, and other personal data contained in your interaction with us.

We process this personal data in order to handle your inquiry, generate statistics on the impact of our social media activities, and optimize our social media marketing.

Depending on the inquiry, our basis for processing will be as follows:

To fulfill an agreement or contract with you, cf. Article 6(1)(b) of the General Data Protection Regulation. This may be the case, for example, if you contact us on social media regarding an agreement to hold an event with us.
To pursue a legitimate interest that we consider to be more important than your interest in us not processing your data, cf. Article 6(1)(f) of the General Data Protection Regulation. This may be the case, for example, if you contact us with questions or feedback, or if you comment on, like, or share our posts.

In this connection, you have the right to object to our assessment, which you can read more about in section 4.

To comply with a legal requirement, cf. Article 6(1)(c) of the General Data Protection Regulation. This may be the case, for example, if you contact us to exercise your rights under the General Data Protection Regulation.

We disclose this personal data to software and IT suppliers and data processors who are necessary to handle your inquiry.

In addition, we are responsible for the processing of your personal data via social media in conjunction with the provider of the social media in question. You can find more information in their privacy policies:

Meta Platforms Inc. and Meta Platforms Ireland Limited ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland (https://www.facebook.com/privacy/policy/)
TikTok Information Technologies UK Limited, 4 Lindsey Street, Barbican, London, EC1A 9HP, UK (“TikTok UK”) and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (“TikTok Ireland”) (https://www.tiktok.com/legal/page/eea/privacy-policy/da)
LinkedIn Ireland Unlimited Company, Gardner House, Wilton Plaza, Wilton Place, Dublin 2, Ireland (https://www.linkedin.com/legal/privacy-policy)
Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (https://policy.pinterest.com/da/privacy-policy)

In addition, depending on the content of your inquiry, we may disclose your personal data to relevant partners, suppliers, insurance companies, the police, and/or lawyers.

As a rule, we will store your inquiry until you delete it yourself on social media or until we remove the post with which you have interacted.

2.7 Contact persons at partners and suppliers

For the purpose of managing the company's operations, we process the following general categories of personal data about contact persons at our partners and suppliers: General personal data such as name, contact details, job title, employer, and other CRM-related personal data.

We process this personal data on the following legal basis:

In order to fulfill our contracts with the relevant partners and suppliers, cf. Article 6(1)(b) of the General Data Protection Regulation.
To pursue our legitimate interest in operating the Shipyard Food Market, which outweighs your interest in the information not being processed, cf. Article 6(1)(f) of the General Data Protection Regulation.

To the extent necessary for the operation of the business, we disclose such personal data to other partners, suppliers, etc., including, for example, software and IT suppliers, freight companies, auditors, and lawyers.

As a general rule, we store the above-mentioned personal data for as long as the collaboration/supplier relationship exists, or until the contact person in question is no longer employed by our partner, supplier, etc. Personal data registered in connection with sales, delivery, invoicing, etc. is stored for 5 years after the end of the relevant financial year in accordance with the Danish Bookkeeping Act.

2.8 Request for a stall at the Shipyard Food Market

In order to handle and administer requests from potential stallholders, we process the following general categories of personal data about the stallholder or their contact persons: General personal data such as name, contact details, CVR number, address, employer, and other personal data relevant to the possible rental of a stall to a potential stallholder.

We process this personal data in order to pursue our legitimate interest in being able to handle and administer requests for market stalls, as well as to pursue the stallholder's interest in renting a market stall, cf. Article 6(1)(f) of the General Data Protection Regulation. In addition, the personal data will subsequently be processed in order to fulfill the relevant contract with the stallholder when a stall is rented out to a stallholder, cf. Article 6(1)(b) of the General Data Protection Regulation.

As a general rule, we store the above-mentioned personal data for five years after the termination of the tenancy in accordance with section 2.6, if the request is granted. If we do not grant a request for a market stall, the request will be stored for 3 years after the request has been rejected. Personal data registered in connection with invoicing, etc., will be stored for 5 years after the end of the financial year to which the material relates, in accordance with the Danish Bookkeeping Act.

2.9 Recruitment of employees for the Shipyard Food Market

For the purpose of recruiting new employees for Værftets Madmarked, we process the following personal data about you if you apply for a job with us:

General personal data such as name, contact details, CV and application details, experience, skills, recommendations, etc.
Confidential personal information, including, for example, your social security number and academic transcript.
Information about criminal offenses, including any criminal convictions, if we request a criminal record check.
Sensitive personal data, including, for example, health information.

We process this personal data in order to comply with our obligations under labor law, cf. Section 12 of the General Data Protection Regulation. In addition, we process it to pursue our legitimate interest in being able to administer the recruitment process and to find the most suitable candidate for the position, cf. Article 6(1)(f) of the General Data Protection Regulation. Furthermore, the personal data will subsequently be processed in order to fulfill the relevant employment contract with the employee once they have been hired, cf. Article 6(1)(b) of the General Data Protection Regulation.

We process your CPR number so that legal claims can be asserted and determined, cf. Section 11(2)(4) of the Danish Data Protection Act, cf. Section 7(2).

Information about criminal offences is processed if necessary to safeguard our legitimate interest in avoiding and preventing crime at our company and if this interest clearly outweighs your interests, cf. Section 8(3) of the Danish Data Protection Act.

If you have included health information or other sensitive personal data in your application, we consider this as consent for us to process the information in question, cf. Article 9(2)(a) of the General Data Protection Regulation, or to enable us to assert legal claims on your behalf in order to ensure that the work can be organized in such a way that the necessary consideration is given to this, cf. Article 9(2)(f) of the General Data Protection Regulation.

To the extent necessary for the operation of the business, we disclose such personal data to partners, suppliers, etc., including, for example, software and IT suppliers, freight companies, auditors, and lawyers.

As a rule, we store your application for six months after the recruitment process has been completed. If you consent to us extending the storage of your application for future positions, we will store your application in accordance with this agreement with you.

If you are hired by us, we will process your information in accordance with our internal privacy policy for employees.

3. If you wish to withdraw your consent

If we process your personal data on the basis of your consent, you may withdraw your consent at any time by contacting us as indicated above in section 1 or by following the instructions on our website, in newsletters, etc.

If you withdraw your consent, please note that this does not affect the lawfulness of our processing up to the point at which you withdraw your consent, and that in certain circumstances we may be entitled to continue processing your personal data, e.g. in order to defend ourselves against any legal claims.

4. If you wish to object to the processing of your personal data

In some cases, we base our processing of your personal data on the so-called balancing of interests rule, cf. Article 6(1)(f) of the General Data Protection Regulation.

If our processing of your personal data is based on the balancing of interests rule, the processing takes place because we have assessed that our or a third party's legitimate interest(s) in processing your personal data outweigh your interest in the personal data not being processed, and that the processing is necessary to safeguard the legitimate interests.

You have the right to object to our processing of your personal data at any time on the basis of the balancing of interests rule, after which we will reconsider the processing of your personal data on the basis of your objection.

You can object by contacting us as described above in section 1.

5. Transfer of personal data to third countries

To the extent necessary to fulfill the purposes of processing your personal data, we may transfer personal data to international organizations or companies established in countries outside the EU/EEA. We only make such transfers if we have a legal basis for doing so, including, for example:

If the European Commission has assessed that the security in the third country in question is sufficient in accordance with Article 45 of the General Data Protection Regulation,
If, moreover, the necessary safeguards for security are in place, including, for example, the conclusion of the European Commission's standard contracts in accordance with Article 46 of the General Data Protection Regulation, or
If one or more of the exceptions in Article 49 of the General Data Protection Regulation apply.

You can contact us as specified in section 1 if you would like a copy of the basis for the transfer of your personal data.

6. Your rights

When we process your personal data, you have the following rights in relation to us. If you wish to exercise these rights, you are always welcome to contact us as described above in section 1.

Access. You have the right to access and obtain a copy of the personal data we process about you.
Correction. If we have recorded incorrect information about you, you are generally entitled to have such incorrect personal data about you corrected.
Deletion. In special cases, you have the right to have the personal data we process about you deleted.
Restriction of processing. In certain circumstances, you have the right to have the processing of your personal data restricted to storage.
Objection. In certain circumstances, you have the right to object to our processing of your personal data.
Data portability. In certain circumstances, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have this personal data transferred from one data controller to another without hindrance.

You can read more about your rights on the Danish Data Protection Agency's website: www.datatilsynet.dk.

7. Appeal options

You have the right to lodge a complaint with the Data Protection Authority if you are dissatisfied with the way we process your personal data. However, we hope that you will always contact us first so that we can find a reasonable solution.

You can find the Danish Data Protection Agency's contact details and complaints procedure at www.datatilsynet.dk.

Version 2 of 07/10/2024.