Protecting your personal data matters to us. Below we explain which data we process when you visit our online shop at byravn.com and when you place an order, for which purposes, on which legal basis, and what rights you have.

1. Controller

byRavn ApS
Storedamvej 20
DK-6640 Lunderskov, Denmark
Telephone: +45 42 55 07 37
E-mail: byRavn@byRavn.dk
Director: Peter Ravn

We have not appointed a data protection officer, because the statutory conditions for having to do so are not met. For any question about data protection, please use the contact details above.

2. General information about our processing

Legal bases. We process personal data on the basis of Article 6(1) of the General Data Protection Regulation (GDPR): point (a) (consent, for example for the newsletter and marketing cookies), point (b) (performance of a contract, for example processing your order), point (c) (legal obligation, for example retention for accounting purposes) and point (f) (legitimate interests, for example the secure operation of the website). Where we store information on your device or read information already stored there (cookies), we additionally rely on the national rules implementing the EU ePrivacy Directive, which require your consent for anything that is not strictly necessary.

Retention periods. We keep personal data only for as long as it is needed for the purpose concerned. Order data is kept under the Danish Bookkeeping Act (bogføringsloven) for five years from the end of the financial year in which the order was placed, and is deleted afterwards. Data from enquiries is deleted once the matter has been dealt with and no statutory retention obligation stands in the way. Processing that rests on consent ends when you withdraw that consent.

Recipients and transfers to third countries. We pass data only to the service providers named in this policy, which act for us as processors (Article 28 GDPR) or as controllers in their own right. Where data is transferred to countries outside the European Economic Area, this takes place on the basis of an adequacy decision of the European Commission (for example Canada, the United Kingdom, or the EU-US Data Privacy Framework for certified US companies) or on the basis of the EU Standard Contractual Clauses.

3. Hosting and shop system (Shopify)

Our online shop runs on the Shopify platform. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, acting as our processor. Shopify stores the data the shop needs (customer, order and usage data) on servers inside and outside the EU, including with its parent company Shopify Inc., 151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada (covered by an adequacy decision of the European Commission), and in the United States on the basis of the EU-US Data Privacy Framework and the Standard Contractual Clauses. Further information: shopify.com/legal/privacy.

When you open our website, server log data is processed automatically: IP address, date and time, the page requested, the referrer URL, browser type and version, operating system and device. This processing serves to provide and secure the website (Article 6(1)(f) GDPR). Log data is deleted after a short period.

4. Orders and performance of the contract

To handle your order we process your name, billing and delivery address, e-mail address, telephone number, the products ordered and – for personalised products – the text you enter and the files you upload (Article 6(1)(b) GDPR). Without this information we cannot perform the contract.

In order to perform the contract we pass data to the following service providers:

• Payment: Pensopay A/S, Roms Hule 4, 3., 7100 Vejle, Denmark, as payment service provider for card payments (Visa, Mastercard), and Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, where you pay with Klarna. The payment service providers process your payment data under their own responsibility; we never receive full card details.
• Shipping: Webshipper ApS, Vestergade 38, 8600 Silkeborg, Denmark, which produces the shipping labels, and the carrier handling your parcel (for example DHL or DPD), to the extent this is necessary for delivery. We pass your e-mail address or telephone number to the carrier only so that you can be notified about the delivery.
• Accounting and invoicing: Visma e-conomic A/S, Langebrogade 1, 1411 Copenhagen K, Denmark, and Storebuddy ApS, Købmagergade 22, 1150 Copenhagen K, Denmark (Article 6(1)(c) GDPR). Invoices are produced with the Shopify app “Simple Invoice”.
• Personalisation: Zepto Apps, the provider of the Shopify app “Product Personalizer” (productpersonalizer.com), which renders the preview and passes your texts and files to our workshop. Under the Shopify app terms, Zepto Apps is bound by the data protection requirements of the GDPR.

5. Customer account

You can create a customer account with us. We then store your login details and your order history (Article 6(1)(b) GDPR). You can ask us to delete the account at any time by writing to byRavn@byRavn.dk; order data remains stored for as long as the statutory retention obligations require.

6. Contacting us

If you contact us by e-mail, telephone or contact form, we process the information you give us in order to deal with your enquiry (Article 6(1)(b) or point (f) GDPR). The data is deleted once your matter has been dealt with.

7. Newsletter

With your consent (Article 6(1)(a) GDPR) we send you our newsletter with information about products and offers. When you sign up, we record the time of your sign-up so that we are able to demonstrate your consent. You can unsubscribe at any time using the unsubscribe link in every e-mail, or by writing to byRavn@byRavn.dk. We use Shopify Email (Shopify International Limited, see above) to send the newsletter. We analyse whether and which newsletters are opened and which links are clicked, so that we can improve our content.

8. Cookies and consent

Our website uses cookies and similar technologies. Strictly necessary cookies (for example for the shopping basket, login, language setting and security functions) are used on the basis of our legitimate interest in a functioning website (Article 6(1)(f) GDPR); the consent requirement for storing information on your device does not apply to them. All other cookies – for statistics and marketing – are used only with your consent (Article 6(1)(a) GDPR), which you can give or refuse in our cookie banner the first time you visit. You can change or withdraw your choice at any time through the “Cookie settings” link in the footer. We manage consent with the cookie banner built into Shopify (Shopify International Limited, see above); your consent is stored in a cookie.

9. Web analytics

Shopify Analytics. We use the statistics functions built into Shopify to analyse how our shop is used (for the provider, see section 3).

Reaktion. To analyse orders and the effectiveness of our advertising we use the Reaktion service provided by Reaktion.com ApS, Vestre Paradisvej 9, 2840 Holte, Denmark, as our processor. The data is processed on servers in the EU. The legal basis is Article 6(1)(f) GDPR (analysis of order data), or your consent where cookies are set.

Google Analytics 4. With your consent we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the website (page views, time spent, approximate location, device). IP addresses are truncated by Google and are not stored. The data is normally transferred to servers of Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is Article 6(1)(a) GDPR, and the data is deleted after 14 months. You can withdraw your consent at any time in the cookie settings. Further information: policies.google.com/privacy.

Server-side tagging (Stape). The data for the services named in sections 9 and 10 is routed through a server container under our control (Google Tag Manager Server-Side), hosted in the EU by Stape Europe OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. This means that only the data you have consented to is passed on to the services concerned.

10. Marketing and retargeting

With your consent (Article 6(1)(a) GDPR) we use the following services to show you interest-based advertising on other websites and in social networks, and to measure how our advertisements perform:

• Meta Pixel and Custom Audiences provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Facebook and Instagram). For the collection and transmission of this data, we and Meta are joint controllers (Article 26 GDPR); the arrangement between us is available at facebook.com/legal/controller_addendum. Data may be transferred to Meta Platforms, Inc. in the United States (EU-US Data Privacy Framework). Privacy information: facebook.com/privacy/policy.
• Google Ads conversion tracking and remarketing provided by Google Ireland Limited (see above). Privacy information: policies.google.com/privacy. Ad settings: adssettings.google.com.

You can withdraw your consent at any time in the cookie settings.

11. Customer reviews (Judge.me)

For product reviews we use the Judge.me service provided by Judge.me Ltd, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom (covered by an adequacy decision of the European Commission), as our processor. Reviews you submit are published in our shop together with your name (abbreviated on request) and the text of your review (Article 6(1)(a) GDPR). You will only receive an e-mail inviting you to leave a review after your purchase if you expressly agreed to this during the order process; for that purpose we pass your name, your e-mail address and the products ordered to Judge.me. Privacy information: judge.me/privacy.

12. Social networks

Our website contains links to our profiles on Instagram and Facebook. When you click such a link you are taken to the network in question, and your data is only processed by that provider once you are there. Embedded social network content is loaded only after you have given your consent in the cookie banner.

13. Your rights

You have the following rights against us in respect of your personal data:

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to withdraw a consent you have given, with effect for the future (Article 7(3) GDPR)

Right to object (Article 21 GDPR). Where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you may object at any time without giving a reason. Please send your objection to byRavn@byRavn.dk.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk. If you live in another EU country, you can also take your complaint to the supervisory authority of that country.

14. Data security

Data is transmitted on our website in encrypted form using TLS/HTTPS. We apply technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

15. Changes to this privacy policy

We update this privacy policy whenever the legal position or our data processing changes. The version published on this page at any given time is the one that applies.

Last updated: 27 August 2026