1. Data Controller

CMG1 ApS, trading as Copenhagen Merchandise Group (“CMG”), is the data controller for the processing of personal data described in this Privacy Policy.

CMG1 ApS
CVR No.: 3772 6660
Spangen 1A
4720 Præstø
Denmark

Email: cmgmerchandise@gmail.com
Phone: +45 3172 1137

2. What personal data we process

Depending on how you interact with CMG, we may process information such as:

• name
• company name
• email address
• telephone number
• billing and delivery information
• information contained in enquiries and correspondence
• quotation and order information
• information relating to products and projects
• logos, artwork and other materials supplied to us

When you use our website, we may also process technical information such as:

• IP address
• browser and device information
• pages visited
• referral information
• cookie and consent information
• analytics and advertising-related data

We only process personal data that is relevant to the purpose for which it was collected.

3. Enquiries and quotation requests

When you contact CMG or request a quotation, we process the information you provide in order to:

• respond to your enquiry
• prepare a quotation
• communicate with you
• assess your requirements
• take steps towards entering into an agreement with you

Depending on the circumstances, the processing is based on steps necessary before entering into a contract and/or CMG’s legitimate interest in handling business enquiries and communicating with potential customers.

4. Customers and orders

When you place an order with CMG, we process personal data necessary to manage the customer relationship and fulfil the order.

This may include processing for:

• order administration
• production
• artwork and proof approval
• customer communication
• invoicing and payment
• delivery and logistics
• customer service
• complaints and follow-up

The processing is carried out in order to fulfil our agreement with the customer and, where applicable, to comply with legal obligations.

5. Suppliers and manufacturers

CMG works with manufacturers, suppliers and other business partners in connection with the production of merchandise.

We only share personal data with suppliers or manufacturers where it is necessary to fulfil the relevant order.

As a general principle, only the minimum information necessary for the specific purpose should be shared.

CMG’s suppliers and manufacturers do not normally deliver directly to CMG’s customers.

6. Newsletter and marketing

Visitors may choose to sign up to receive future merchandise inspiration, ideas, offers and pricing updates from CMG.

Where electronic marketing is sent, the email address will only be used for marketing purposes where the required consent has been provided.

Consent may be withdrawn at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

CMG does not sell newsletter subscriber information to third parties.

Before publication: we should confirm exactly where newsletter signups are currently stored and that CMG can document when and how consent was given.

7. Cookies, analytics and advertising

CMG uses cookies and similar technologies on its website.

The current website setup may include services such as:

• Cookiebot for consent management
• Matomo via 10Web for website analytics
• Google Tag Manager
• Google Ads conversion tracking

Non-essential analytics and marketing technologies are used in accordance with the visitor’s cookie and consent choices.

Visitors can manage or withdraw their cookie choices through the website’s consent solution.

More detailed information about the cookies and technologies currently in use may be available through the website’s cookie banner or cookie settings.

8. Recipients of personal data

Where necessary, CMG may share personal data with relevant service providers and business partners, including:

• website and hosting providers
• IT and email providers
• analytics and advertising providers
• manufacturers and suppliers
• transport and logistics providers
• accountants and bookkeepers
• professional advisers
• public authorities where required by law

Personal data is only shared where there is a relevant business, contractual or legal reason to do so.

CMG does not sell personal data.

9. Transfers outside the EU/EEA

Some of CMG’s technical service providers may process personal data outside the European Union or European Economic Area.

Where personal data is transferred outside the EU/EEA, CMG will use an appropriate transfer mechanism in accordance with applicable data protection law.

This may include transfers to countries recognised as providing an adequate level of protection or the use of appropriate contractual safeguards.

Before publication: I would verify the current transfer arrangements used by Google, 10Web and any other relevant providers rather than naming a specific legal mechanism that may later change.

10. Retention and deletion

CMG does not keep personal data for longer than necessary for the purpose for which it was collected or for as long as required under applicable law.

The proposed retention periods are:

Enquiries that do not become customers:
Up to 12 months after the last contact.

General customer correspondence:
As a general rule, up to 24 months after the end of the customer relationship or completion of the relevant order, unless there is a specific reason for longer retention.

Accounting, invoicing and bookkeeping records:
Retained for the period required under applicable Danish bookkeeping and accounting rules.

Newsletter and marketing data:
Retained for as long as the marketing consent remains active and the processing continues to serve a relevant purpose.

Certain information may be retained for longer where this is necessary to establish, exercise or defend legal claims or to comply with legal obligations.

Important: the 12- and 24-month periods are the retention rules we proposed to CMG. I would get their explicit approval before we publish these as their actual company policy.

11. Security

CMG takes appropriate technical and organisational measures to protect personal data against:

• unauthorised access
• loss
• misuse
• alteration
• disclosure
• destruction

Access to personal data is limited to persons and service providers who need the information for a legitimate purpose.

12. Your rights

Subject to the conditions set out in applicable data protection law, you may have the right to:

• request access to your personal data
• request correction of inaccurate personal data
• request deletion of personal data
• request restriction of processing
• object to certain processing
• receive certain personal data in a portable format
• withdraw consent where processing is based on consent

If you wish to exercise any of these rights, you can contact CMG using the contact information above.

13. Complaints

If you are dissatisfied with the way CMG processes your personal data, you may contact CMG directly.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

14. Changes to this Privacy Policy

CMG may update this Privacy Policy when its processing activities, systems or legal obligations change.

The current version will be made available on the website together with its effective date.