Privacy Policy
Here you can read what information we process about you, why, for how long, and what rights you have.
Last updated: 12 October 2026- Data controller
- Information
- Purposes and retention
- Recipients
- Countries outside the EU/EEA
- Cookies
- Your rights
Data controller and contact
Ditur.dk ApS, CVR-nr. 35636919, is the data controller for the processing of your personal data when you visit ditur.dk, shop with us or contact us. This policy explains what information we process, why, for how long, and what rights you have.
Ditur.dk ApS
Elmegårdsvej 38, 8361 Hasselager, Denmark
E-mail: kontakt@ditur.dk
Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
What information we process
We only process the information that is necessary for the purposes described below. This typically includes:
- Contact and customer details: name, address, e-mail, telephone number and information in your customer account.
- Purchase and payment details: items, time, order history, delivery address and payment method. Card details are processed by the payment provider and are not stored by us.
- Enquiries: the content of your messages to customer service, complaints, returns and repairs.
- Marketing and preferences: consents, newsletter subscription, interests and your interaction with our e-mails.
- Visit data: IP address, device, browser, pages you view and purchasing behaviour on ditur.dk, collected via cookies and similar technologies.
Why we process your information
We only use your information for the purposes stated here, and only when we have a valid legal basis.
| Purpose | Data | Legal basis (GDPR Art. 6(1)) | Retention |
|---|---|---|---|
| Purchase, payment and delivery | Name, telephone, e-mail, address, item, time, payment details | Point (b) (the contract) | The order is automatically anonymised after 5 years; accounting records are kept for 5 years after the end of the financial year (the Danish Bookkeeping Act), and for sales to consumers in other EU countries under the OSS VAT scheme, for 10 years |
| Complaints, returns and repairs | Contact details, purchase, content of the case | Points (b) and (c) (legal obligation) | 3 years after the case is opened, or for as long as the complaint period and warranty apply, if that is longer |
| Customer service | Name, purchase history, content of the enquiry | Points (b) and (f) | 180 days after last contact |
| Customer account | Contact details, order history, consents | Point (b) | For as long as the account exists; deleted 5 years after your last purchase or login |
| Club Ditur (customer club and points) | Name, e-mail, gender, purchase history, points and membership level | Point (b) (the membership agreement) | For as long as the membership lasts; points expire 12 months after your last purchase; the profile is deleted 5 years after your last purchase or login |
| Gift cards | Purchaser's contact details, gift card number, value and validity | Point (b) (the purchase agreement) | The gift card is valid for 2 years and can be paid out for up to 12 months after expiry; accounting records 5 years after the end of the financial year |
| Newsletters and electronic marketing | Name, e-mail, opens and clicks | Point (a) (consent) | Deleted after 5 years without activity, also after unsubscribing |
| Personalised content and tailored marketing (profiling) | Purchase and visit history, interests, cookie data | Point (a) (consent) | Until you withdraw your consent |
| Campaign measurement at Google and Meta (Facebook and Instagram) | Hashed identifiers (e-mail, telephone) | Point (a) (consent) | Stored for 14 months |
| Competitions | Name, e-mail, competition details | Points (b) and (f) | Winners 3 months after the prize has been handed over; other participants as for newsletters |
| Competitions on social media | Username, comments, posts and messages | Points (b) and (f) | Winners 3 months after the prize has been handed over; other participants as for newsletters |
| Market research | Responses and contact details | Point (a) (consent) | Until the survey has ended |
| Statistics, development and secure operation | Traffic, purchase and behaviour data, preferably anonymised | Point (f) | Anonymised or deleted on an ongoing basis |
| Job applications | Contact details, application, CV and any references | Point (b) (steps taken at your request before entering into employment) and point (f) | 3 months after the recruitment process has ended |
Where we rely on legitimate interests (point (f)), our interest is to be able to answer your enquiries efficiently, run competitions, and improve and secure our website. We always weigh our interest against your rights, and you can object.
You are not obliged to give us your information. However, without the information we need for purchase and delivery, we cannot complete your order, and without your consent we cannot send you marketing or personalised content.
Who receives your information
We only disclose information when it is necessary for one of the purposes above, or when the law requires it. Recipients fall into three groups:
- Processors process information on our behalf, following our instructions and a written data processing agreement. These are, for example, providers of web shop, hosting and IT operations, payment, returns and complaints, customer service, e-mail distribution, marketing analytics, AI tools and transport.
- Independent controllers decide for themselves how to use the information. This applies to advertising networks such as Google Ads, Meta Ads, Microsoft Advertising, Pinterest Ads and OpenAI, which receive hashed identifiers (e-mail, telephone number) for campaign measurement, only if you have given consent. It also applies to the financing partners Klarna, ViaBill and Anyday, if you choose them at checkout, as well as auditors, lawyers, banks, public authorities and our partners.
- Partners: If you buy an item from a partner via ditur.dk, the partner is the data controller for the purchase, and we act as processor for the partner.
Transfers to countries outside the EU/EEA
We transfer information to suppliers and advertising partners outside the EU/EEA, including Google, Meta, Microsoft, Pinterest, OpenAI, Triple Whale, Klaviyo, Anthropic and OpenRouter in the USA. We only transfer information there when there is a valid transfer mechanism:
- a decision by the European Commission that the country ensures an adequate level of protection (applies, for example, to the United Kingdom)
- the recipient's certification under the EU-US Data Privacy Framework
- the European Commission's standard contractual clauses with supplementary safeguards
You can get a copy of the transfer mechanism by writing to kontakt@ditur.dk.
Retention
We delete or anonymise your information when it is no longer necessary for the purpose for which it was collected. The specific periods are set out in the table above. Withdrawing consent stops further processing, but does not affect processing carried out before the withdrawal.
Your rights
You can write to kontakt@ditur.dk when you want to exercise your rights. We reply within 30 days.
- AccessYou can find out what information we process about you, and how.
- RectificationYou can have incorrect information corrected.
- ErasureYou can have your information deleted when we no longer need it or have a lawful reason to keep it.
- RestrictionIn certain cases you can ask us to only store your information and not use it.
- Data portabilityYou can receive the information you have given us in a structured, machine-readable format.
- ObjectionYou can at any time object to processing based on legitimate interests, and to direct marketing, without giving a reason.
- Withdrawal of consentYou can always withdraw a consent, for example via the unsubscribe link in the newsletter.
If you believe that we process your information in breach of the rules, you can complain to the supervisory authority in the country where you live. In Ireland, this is the Data Protection Commission (DPC), www.dataprotection.ie. We hope, however, that you will contact us first.
Changes to this policy
We update the policy when our processing or the rules change. The latest version is always available at ditur.dk. In the event of material changes, we will notify you, for example by e-mail.
Last updated: 12 October 2026.