Privacy policy
- Cookie and Privacy Policy
Last updated: 01/10 2026
1. Who we are
Gry & Sif ApS (“Gry & Sif”, “we”, “us”) is the data controller for the personal data we process when you visit www.gryandsif.com, shop with us or contact us.
Address: Søgade 16, 2, 4100 Ringsted, Denmark
Email: hello@gryandsif.com
Telephone: +45 70 20 31 18
This policy explains how we use your personal data and how you can exercise your rights.
2. Information we collect
Depending on how you interact with us, we collect:
- Contact and account details: your name, email, telephone number, addresses and account preferences.
- Order information: purchases, delivery details, payment status, returns and refunds. Our payment providers process the payment details you submit.
- Correspondence: information you provide when contacting customer service.
- Technical information: IP address, browser and device details, pages requested, access times and error logs.
- Consent and marketing information: your subscription status, privacy choices and records of consent.
- Analytics and advertising information: where you consent, cookie identifiers, approximate location, referral information and browsing or purchase activity.
We receive information directly from you and from our platform, payment and delivery providers. If someone purchases a gift for you, we receive your delivery details from that purchaser.
Please do not send sensitive personal information unless it is necessary for your enquiry.
3. Why we use your information
We process personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):
| Purpose | Legal basis |
|---|---|
| Processing orders, payments, delivery, returns and requested account services | Performance of a contract or steps requested before entering a contract — Article 6(1)(b) |
| Keeping accounting and other legally required records | Compliance with legal obligations — Article 6(1)(c) |
| Answering general enquiries, maintaining security, investigating fraud and handling legal claims | Our legitimate interests in supporting customers, protecting our business and exercising our rights — Article 6(1)(f) |
| Handling enquiries about an existing order | Performance of a contract — Article 6(1)(b) |
| Using gift-recipient details and managing business contacts who are not personally parties to a contract | Our legitimate interests in fulfilling delivery instructions and managing business relationships — Article 6(1)(f) |
| Sending newsletters and promotional emails | Consent — Article 6(1)(a) |
| Optional analytics, personalised advertising, audience matching and related profiling | Consent — Article 6(1)(a) |
We also retain records needed to demonstrate compliance with consent requirements and respect opt-outs. Depending on the record and purpose, this is based on our legal obligations or legitimate interests in demonstrating compliance and preventing unwanted communications.
Where we rely on legitimate interests, we assess those interests against your rights and freedoms.
Information required to process your order must be provided for us to complete your purchase. You can unsubscribe from marketing at any time using the link in our emails or by contacting us. Necessary order and service messages are separate from marketing.
4. Cookies and your choices
We use cookies and similar technologies, including pixels and local storage.
Strictly necessary technologies support functions such as your basket, checkout, security and privacy preferences. These do not require cookie consent where the legal exemption applies.
Optional technologies support preferences, analytics and advertising. We request your consent before using them where consent is required. Rejecting optional cookies does not prevent you from shopping with us.
We use Consentmo to manage cookie choices. You can accept, reject or select optional categories through the cookie banner. You can change your choices or withdraw consent at any time using the Cookie preferences control on our website.
Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent. You can also delete or block cookies through your browser, but this does not replace our consent controls.
Our Cookie declaration lists the technologies used, their providers, purposes and lifetimes. Cookie expiry periods are separate from the retention periods for personal data collected through those technologies.
5. Who we share information with
We share relevant personal data with:
- Shopify, which provides our ecommerce platform and related services.
- Uniconta and our integration provider, for order, customer and accounting records.
- Payment providers, including Shopify Payments and PayPal, to process payments and refunds.
- Delivery partners, to fulfil orders.
- IT, communications and customer-support providers, to operate and support our business.
- Consentmo and active analytics or advertising providers, for consent management and any tracking you have agreed to.
- Professional advisers and public authorities, where necessary to meet legal obligations or establish, exercise or defend legal claims.
Some providers act as processors under our instructions. Others, including certain payment and advertising providers, act as independent controllers for some activities.
Where we jointly determine processing with another provider, we make the relevant information about responsibilities and your rights available.
6. Shopify’s use of information
Shopify processes personal data on our behalf to operate the store. For some services, Shopify acts as a controller in its own right.
We use Shopify Enhanced Services. These services may combine information about your interactions and purchases on our store with information from other merchants and Shopify to provide analytics, personalised experiences and advertising. Processing requiring consent is subject to your consent choices.
See Shopify’s Consumer Privacy Policy for details. You can exercise rights relating to Shopify’s own processing through Shopify’s privacy portal.
For processing for which Gry & Sif is responsible, contact us using the details above.
7. International transfers
Some providers process personal data outside the European Economic Area (EEA), including through hosting, support and subcontractors.
Where this happens, an applicable transfer mechanism must protect the data. These mechanisms include European Commission adequacy decisions, Standard Contractual Clauses and approved Binding Corporate Rules, with additional safeguards where necessary.
Shopify describes its use of adequacy decisions and Standard Contractual Clauses in its international-transfer information. PayPal uses approved Binding Corporate Rules for applicable transfers within its group.
Contact us for information about the safeguards applicable to your personal data and how to obtain a copy, subject to necessary redactions to protect confidential information.
8. How long we keep information
We retain personal data only for as long as needed for its purpose or to meet legal obligations.
| Information | Retention |
|---|---|
| Accounting records | Normally five years from the end of the relevant financial year, subject to applicable legal exceptions |
| Order and customer-service records | For fulfilment, returns and complaints, and for the applicable period needed to establish or defend legal claims |
| Account information | While needed to provide your account service; records required for other lawful purposes are retained separately |
| Marketing information | Until you unsubscribe or your subscription ends under our retention rules |
| Consent and opt-out records | Limited records retained as needed to demonstrate compliance, handle claims and respect your choices |
| Security logs | Retained as needed to detect and investigate security incidents, or resolve related legal claims. |
| Analytics and advertising data | Retained as needed to analyse website performance and measure campaigns, then deleted or anonymised. Periods vary by service. |
| Cookies | As specified in our Cookie declaration |
Relevant information may be retained longer where necessary to resolve an ongoing dispute or comply with a legal requirement.
9. Your rights
Depending on the circumstances, you have the right to:
- Access your personal data and obtain a copy.
- Correct inaccurate or incomplete information.
- Request deletion or restriction of processing.
- Receive eligible data in a portable format.
- Withdraw consent at any time.
- Object to processing based on legitimate interests for reasons relating to your situation.
- Object to direct marketing, including related profiling, at any time.
To exercise your rights, email hello@gryandsif.com.
We respond without undue delay and normally within one month. Where legally permitted, we may extend this by up to two further months because of the complexity or number of requests. We will explain any extension within the first month.
Requests are normally free. We may request proportionate information to verify your identity.
You can complain to Datatilsynet, the Danish Data Protection Agency, or the competent supervisory authority where you live, work or believe an infringement occurred. You do not need to contact us first.
10. Automated decisions and profiling
With your consent, we may use your browsing or purchase activity to infer your interests and show you relevant advertisements.
Gry & Sif does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
11. Security and external websites
We use technical and organisational measures appropriate to the risks to protect your personal data. No system can guarantee absolute security.
Our shop is intended for adult purchasers. Please contact us if you believe a child has provided personal data that should not have been collected.
External websites have their own privacy policies. This does not remove our responsibility for personal data we share with them.
12. Changes to this policy
We update this policy when our services, data practices or legal requirements change. The latest revision date appears above.
We provide additional notice where required and request new consent where necessary. Updating this policy does not itself constitute your consent to a new use of your data.