Privacy policy

LILLESAGA ApS is the data controller for the processing of the personal data we receive about you. We make sure that your personal data is processed in accordance with applicable law.

CVR: 46833856 Kirkegårdsvej 10, 4. tv, 2300 København S Email: kontakt@lillesaga.dk Website: www.lillesaga.dk

We collect and process the following types of personal data:

• Contact details: Name, email address, delivery address (for physical delivery)

• Payment details: Processed directly by Stripe - we do not store card numbers

• Order details: Selected products, the child's name, appearance choices (gender, hair colour, hairstyle), selected story

• Technical information: IP address, browser type, device information (for security and troubleshooting)

To detect and fix errors in the designer, checkout and order flow, we receive limited technical error reports on our own server. They contain the error category, the time, the part of the website affected and, where applicable, the line number in the code file. The reports do not contain form content, the child's name, personal messages, payment details or the full page address. The feature does not use cookies or local storage and is not used for marketing or to track your activity. Aggregated error records in the error database are deleted after 30 days. Ordinary server logs and operational emails have separate retention periods with our hosting and email providers.

We collect the child's first name and appearance choices (gender, hair colour, hairstyle) solely for the purpose of producing the personalised book. This information is provided by the parent or the adult buyer.

We process this information on the basis of Article 6(1)(b) of the GDPR (performance of a contract). The child's information is not disclosed to third parties for marketing purposes.

We process your personal data for the following purposes:

• Processing and delivering your order - GDPR Art. 6(1)(b), performance of a contract

• Producing the personalised book (the child's name/appearance) - GDPR Art. 6(1)(b), performance of a contract

• Payment handling via Stripe - GDPR Art. 6(1)(b), performance of a contract

• Customer service and communication - GDPR Art. 6(1)(b), performance of a contract

• Bookkeeping and accounting - GDPR Art. 6(1)(c), legal obligation (the Danish Bookkeeping Act, bogføringsloven)

• Fraud prevention - GDPR Art. 6(1)(f), legitimate interest

• Newsletter and marketing - GDPR Art. 6(1)(a), consent

• Analysing and improving the website - GDPR Art. 6(1)(a), consent (via cookie consent)

We exchange data with the following data processors and recipients in order to deliver our product:

• Stripe (Stripe Inc., USA) - payment handling. Stripe encrypts all payment details and is PCI DSS Level 1 certified. We never store your full card details. Transfer mechanism: EU-US Data Privacy Framework.

• Vercel (Vercel Inc., USA) - hosting of the website, plus Web Analytics and Speed Insights after consent to analytics. Data is processed in the EU region (Frankfurt). Transfer mechanism: EU-US DPF + SCCs.

• Cloudinary (Cloudinary Ltd.) - image delivery (CDN) for the book illustrations.

• Google Ireland Limited - web analytics (Google Analytics 4). Used only after your consent to analytics cookies.

• Mouseflow - recordings of clicks, mouse movements, scrolling and navigation, plus heatmaps on our EU account, only after analytics consent. The child's name, personal messages, personalised book views and form/contact details are masked in the browser before sending. Private wish links and administration pages are not recorded.

• Meta Platforms Ireland Limited - ad targeting and conversion measurement (Meta Pixel and Conversions API). Used only with your consent to marketing. Transfer mechanism: EU-US Data Privacy Framework.

• Google Customer Reviews (Google LLC and Google Ireland Limited) - after your purchase, we offer you the option of Google sending you a short survey about your experience. If you say yes, Google receives your order number, your email address, the delivery country and the expected delivery date, so the survey can be sent once the book has arrived. Your answer counts towards LILLESAGA's store rating on Google. Google is an independent data controller for the survey and may set and read cookies in connection with it. Google's opt-in is only loaded once you have consented to marketing or have chosen to receive the survey yourself. Transfer mechanism: EU-US Data Privacy Framework.

• Ønskeskyen (GoWish) - if you choose to share a personalised book, we send the link to Ønskeskyen. The linked page contains the child's first name, the chosen book and appearance, along with a personalised cover and the price, which Ønskeskyen can retrieve for the wish list. Others with the link can open the same design. Your personal message is not included. Sharing happens at your request; ordinary use of our site does not contact Ønskeskyen.

• Brevo (Brevo SAS, France) - sending transactional emails (e.g. order confirmation). Receives your name and email address.

• Amazon Web Services (AWS, EU region) - secure storage of print files for book production.

• Our printer - receives the child's first name and your delivery address in order to print and send the book.

We have entered into data processing agreements with all our data processors in accordance with Article 28 of the GDPR.

We do not disclose your personal data to third parties for marketing purposes without your explicit consent.

Some of our data processors are based outside the EU/EEA, primarily in the USA. For all such transfers, we rely on one or more of the following transfer mechanisms (GDPR Art. 44-49):

• EU-US Data Privacy Framework (DPF) - for US-based providers certified under the framework

• Standard Contractual Clauses (SCCs) - the European Commission's standard contractual clauses (2021/914)

We keep your personal data for as long as is necessary for the purposes it was collected for:

• Order details: Up to 5 years after purchase (under the Danish Bookkeeping Act)

• The child's personalisation: Deleted after the product has been delivered, unless you have an active account

• Newsletter subscription: Until you unsubscribe

• Technical log files: Max. 12 months

Under the GDPR, you have the following rights:

• Right of access (Art. 15) - you can find out what data we process about you

• Right to rectification (Art. 16) - you can have inaccurate information corrected

• Right to erasure (Art. 17) - you can ask us to delete your data (subject to legal retention requirements)

• Right to restriction (Art. 18) - you can ask us to restrict the processing

• Right to data portability (Art. 20) - you can receive your data in a machine-readable format

• Right to object (Art. 21) - you can object to processing based on legitimate interest

• Right to withdraw consent - you can withdraw your consent at any time

Contact us at kontakt@lillesaga.dk to exercise your rights. We will respond to your request within 30 days (Art. 12).

We have adopted internal rules and procedures for information security that protect your personal data against unauthorised access, alteration, deletion or disclosure. We use TLS encryption across the whole website, and payments are handled securely via Stripe.

In the event of a security breach that poses a high risk to you, we will notify you and the Danish Data Protection Agency (Datatilsynet) without undue delay, in accordance with Articles 33-34 of the GDPR.

We use cookies and similar technologies on lillesaga.dk. A cookie is a small text file that is stored on your device when you visit our website.

Essential cookies (do not require consent) These cookies are needed for the website to work properly. They are used for session management, the basket, theme preference and payment handling (Stripe).

Analytics cookies (require consent) We may use anonymised web analytics to understand how visitors use the website and to improve the user experience. These cookies are only set after you have given your consent.

Marketing cookies (require consent) We may use marketing cookies to show relevant ads. These cookies are only set after you have given your consent.

Traffic sources With consent to analytics or marketing, we remember the campaign source for up to 90 days and link it to any purchases. Ad click IDs require marketing consent. We do not send the child's name or personal message as analytics events.

Opting out of cookies You can change your cookie consent at any time via our cookie banner or by deleting cookies in your browser settings. Please note that opting out of essential cookies may affect how the website works.

If you believe that we are not meeting our obligations regarding the processing of your personal data, you are welcome to contact us at kontakt@lillesaga.dk.

You also have the right to lodge a complaint with:

Datatilsynet (the Danish Data Protection Agency) Carl Jacobsens Vej 35 2500 Valby Email: dt@datatilsynet.dk Website: www.datatilsynet.dk

We process your email address, order number, credit code, amounts, usage and expiry to administer your credit. For gift cards, we also process the sender and recipient names, delivery email and personal message supplied by the buyer. Purchases, gift cards and credit are administered to fulfil the agreement under GDPR Article 6(1)(b).

When you activate credit by answering how you found LILLESAGA, the selected answer category is stored with the activation and order. We use it for our own statistics about how customers find us. This processing relies on our legitimate interest in understanding and improving our business under Article 6(1)(f). Your answer does not consent to cookies, advertising or tracking. The email consent that activation requires relies on Article 6(1)(a) and section 10 of the Danish Marketing Practices Act. We store when and where you gave it and the text you saw, so we can document it. You can withdraw it at any time without losing your credit.

The answer is kept with the credit activation. The retention criteria and rights above apply here too. Contact kontakt@lillesaga.dk about access, objections or deletion. We assess which records remain necessary for your balance, accounting or legal claims.