This Privacy Policy explains how Tom Kenny Mose Larsen, operating dibi buns from Nygade 9, 8850 Bjerringbro, Denmark ("dibi buns", "we", "us"), collects, uses, shares and protects personal data when you visit dibibuns.com or place an order. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data processed through the Service.
1. Data we collect
Information you provide: name, email address, shipping address, billing address, phone number, order contents and any messages you send us.
Payment information: processed directly by Stripe. We receive from Stripe only a transaction reference, the last 4 digits and brand of the card, country and the authorization result. We never see or store full card numbers, expiry dates or CVC.
Automatically collected: IP address, browser type and version, device identifiers, referring URL, pages viewed, time stamps and basic interaction events. These are collected through cookies and similar technologies as described below.
2. Why we use it and legal bases (GDPR)
- To fulfil your order, deliver products and provide support — performance of a contract with you (Art. 6(1)(b) GDPR).
- To process payments and prevent fraud — performance of a contract and our legitimate interest in preventing financial loss (Art. 6(1)(b) and (f) GDPR).
- To comply with legal obligations such as tax, accounting and consumer-protection requirements — Art. 6(1)(c) GDPR.
- To improve our Service and analyze usage — our legitimate interest in operating and improving the Service (Art. 6(1)(f) GDPR).
- To send marketing emails about our products — your consent, which you may withdraw at any time (Art. 6(1)(a) GDPR).
3. Who we share it with
We share personal data only with trusted service providers acting as our processors:
- Stripe — payment processing, fraud prevention, tax calculation.
- Shipping carriers — to deliver your order (name and address only).
- Email and hosting providers — to send order confirmations and host the Service.
- Analytics providers — to understand aggregate usage of the Service.
- Professional advisors and authorities — where required by law.
We do not sell your personal data and we do not share it for cross-context behavioural advertising.
4. International transfers
Some of our providers (including Stripe) may process data in countries outside the European Economic Area. Where this occurs we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and adequacy decisions.
5. How long we keep it
Order, invoicing and tax records are retained for the period required by Danish and EU law (currently up to 5 years from the end of the relevant accounting year). Support correspondence is retained for up to 3 years. Marketing data is retained until you withdraw consent or unsubscribe. Cookie data is retained for the durations stated in our cookie banner.
6. Cookies
We use a minimal set of cookies and similar technologies: strictly necessary cookies (cart contents, language preference, session), and aggregated analytics. You can control non-essential cookies through your browser settings.
7. Your rights (EU/EEA and UK)
You have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten") subject to legal retention;
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or another EU supervisory authority.
To exercise these rights, email hello@dibibuns.com. We respond within one month.
8. Security
We use HTTPS/TLS in transit, restricted-access systems, and rely on PCI-DSS-certified processors for payments. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.
9. Children
The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with data, please contact us.
10. Changes
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision.
11. Contact / Data Controller
Tom Kenny Mose Larsen (dibi buns)
Nygade 9, 8850 Bjerringbro, Denmark
Phone: +45 50 65 74 69
hello@dibibuns.com