Your Basket

Your cart is empty.

Privacy Policy

Last updated: 4 July 2025

At Mediterranean Boutique I/S, we prioritize data privacy and security. This Privacy Policy explains how we collect, use, and protect your personal information when you use our webshop.

1. Data Controller (Dataansvarlig)

Mediterranean Boutique I/S is the data controller responsible for the personal data collected through this website.

  • Company: Mediterranean Boutique I/S
  • CVR: 45706435
  • Address: Ørestads Boulevard 42A, 3. tv., 2300 Copenhagen S, Denmark
  • Email: info@medboutique.dk
  • Phone: +45 55 23 57 28

We have not appointed a Data Protection Officer (DPO) as we are not required to do so under GDPR.

2. What Personal Data We Collect and Why

Order Fulfillment

When you purchase our products, we collect your name, shipping address, email address, phone number, and payment details.

  • Purpose: To deliver your order, send order confirmations, and handle customer service inquiries.
  • Legal Basis: Processing is necessary for the performance of a contract (GDPR Article 6(1)(b)).

Technical Operation and Security

We may collect your IP address and browser type for technical purposes.

  • Purpose: To improve our webshop, troubleshoot technical issues, and prevent fraud.
  • Legal Basis: Legitimate interest in operating our service (GDPR Article 6(1)(f)).

We use essential cookies only. We do not use analytics, advertising, or any third-party tracking cookies. See our Cookie Policy for details.

3. Who We Share Your Data With

We do not sell your personal data. We only share your data with trusted third-party partners (Data Processors) who help us run our business:

  • Shipping Partner: We share your name, address, email, and phone number with PostNord so they can deliver your package and send tracking updates.
  • Payment Gateways: When you pay, your payment details are securely processed by our payment providers, Stripe and MobilePay (Vipps MobilePay AS). We do not store your full credit or payment card details on our servers.
  • IT & Hosting: Our website is hosted on our own servers. Customer data is stored securely and accessed only by authorised personnel.

Transfers outside the EU/EEA: Stripe Inc. is a US company. The transfer of payment data to Stripe is made on the basis of the European Commission's Standard Contractual Clauses (SCCs), which ensure an adequate level of protection under GDPR. MobilePay (Vipps MobilePay AS) is a Nordic company and processes data within the EU/EEA.

4. Data Retention (Opbevaring af data)

We only keep your personal data for as long as necessary to fulfil the purposes outlined above.

  • Accounting Laws: Under the Danish Bookkeeping Act (Bogføringsloven), we are legally required to store all accounting records and order documentation (which includes your name, address, and order details) for 5 years from the end of the financial year to which the records relate.
  • After this period, your personal data will be safely deleted or anonymised.

5. Your Rights (Dine rettigheder)

Under the GDPR, you have the following rights regarding your personal data:

  • Right to Access: You can ask us what personal data we hold about you.
  • Right to Rectification: You can ask us to correct inaccurate or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): You can ask us to delete your personal data, unless we are legally required to keep it (e.g. for bookkeeping purposes).
  • Right to Restrict Processing: You can ask us to limit how we use your data.
  • Right to Data Portability: You can request a copy of your data in a structured, commonly used format.
  • Right to Object: You can object at any time to the processing of your data based on legitimate interest (GDPR Article 6(1)(f)).
  • Right not to be subject to automated decision-making: We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

To exercise any of these rights, please contact us at info@medboutique.dk. We will respond within 30 days.

6. Complaints

If you believe that we are handling your personal data incorrectly, we hope you will contact us first so we can resolve the issue. However, you also have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet) at www.datatilsynet.dk.

7. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website. Significant changes will be communicated clearly.