Privacy policy

Last updated: October 6, 2026

This is a translation provided for convenience. The Danish version of this text is the one that applies, and Danish law governs any purchase.

At Verdevin we look after your personal data. This policy sets out what data we process, why we do it, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

1. Data controller

Verdevin
Ørstedvej 50 C, st. tv.
4130 Viby Sjælland
Company reg. no. (CVR): 34284431
Country: Denmark
E-mail: admin@verdevin.com

If you have questions about how we process your personal data, you are always welcome to contact us.

2. What data do we process?

We process only the data necessary for the purposes described below:

• Cookies: Visiting the site sets a few necessary cookies (age confirmation, session/shopping cart and your language choice). We set no cookies for statistics, measurement or marketing, and load no third-party scripts. See details in our Cookie policy.
• Server logs: For operational and security reasons our web host records technical information about visits, including IP address, time and which pages are requested.
• Enquiries: If you write to us — either by e-mail or through the form on the Contact — we process the information you give us (name, e-mail address and the content of your message). The message is forwarded to our e-mail address so that we can reply; we do not store it anywhere else.
• Purchases in the shop: When you buy from us we process your name, address, e-mail address, phone number if given, and details of your order and payment. Payment card details are entered directly with our payment provider and never come into our possession.
• Newsletter: If you subscribe to our newsletter we process your e-mail address on the basis of your consent. The subscription only takes effect once you have confirmed it through the link in the confirmation mail we send (double opt-in). We store the time of subscription and confirmation as evidence of consent. You may withdraw your consent at any time through the unsubscribe link at the bottom of every mail — your address is then removed from the newsletter list immediately. A technical dispatch log may contain a pseudonymised form of the address for up to 90 days, after which it is deleted.
• Customer account: If you create an account we process your name, e-mail address, phone number and address if given, plus an encrypted (hashed) version of your password and a list of your orders. To confirm that the e-mail address is yours we send a six-digit code that must be entered before the account can be used. The account is optional — you can always shop without one.
• Log in with Google: If you choose to log in with Google, Google sends us your e-mail address, your name and an ID number identifying your Google account with us. We do not receive your Google password. We use the information to create or find your account with us. Google also processes your login under its own privacy policy. You can always choose an ordinary login with e-mail and password instead.
• Passkey: If you choose to sign in with a passkey, we store the public half of a key pair, a random identifier for the key, the device name you give it yourself, when it was created and last used, and whether the key syncs between your devices. The private half never leaves your device, and we receive neither your fingerprint, your face nor your PIN — those are checked by the device alone. We also store a random account identifier that your device uses to find the right key; it contains no personal data. Passkeys are deleted together with the account.
• Withdrawal: If you use the withdrawal function we process the name, e-mail address and order number or description of the purchase that you write yourself, any indication of which items it covers, and the time of submission. We send you a receipt by e-mail and keep the declaration as evidence that, and when, you withdrew. You do not need an account.

3. Purposes and legal basis

• Completing purchases (order handling, delivery, payment): GDPR art. 6(1)(b) (performance of a contract).
• Bookkeeping and accounts: GDPR art. 6(1)(c) (legal obligation under the Danish Bookkeeping Act).
• Newsletter: GDPR art. 6(1)(a) (your consent).
• Operation and security (server logs, preventing abuse): GDPR art. 6(1)(f) (our legitimate interest in running a secure and stable website).
• Age verification: We sell alcohol and therefore confirm that you are 18 or over before you use the site. The confirmation itself is stored only as a cookie in your browser.
• Withdrawal: GDPR art. 6(1)(c) (legal obligation under section 20 a of the Danish Consumer Contracts Act, which requires us to accept and acknowledge a withdrawal) and (f) (our legitimate interest in being able to document that, and when, a withdrawal was made).

4. Recipients and processors

We do not pass your data to third parties for their own purposes. We use the following categories of recipient and processor:

• Web hosting (Simply.com A/S, Denmark) — running the website and storing data.
• Payment provider (PensoPay A/S, Denmark, with Clearhaus A/S as acquirer) — processing card payments when the shop is live. Card details are entered in PensoPay's payment window and are processed solely by the payment provider and the acquirer.
• Google (login) — if you use "Log in with Google", information is exchanged with Google LLC to confirm who you are. We receive your e-mail address, your name and an ID number for your Google account. The legal basis is GDPR art. 6(1)(b), as the processing is necessary to give you access to your account. If you do not choose Google login, no exchange takes place.
• Carriers — name, address and phone number if given are passed to the carrier delivering your order.
• E-mail (Google Workspace) — our e-mail service. Enquiries, order messages and withdrawals that the site sends to our e-mail address, and our replies to you, are kept in our inbox at Google.

5. Transfers to third countries

Images and fonts on the site are hosted on our own server in Denmark, so an ordinary visit involves no transfer of data outside the EU/EEA.

If you use "Log in with Google", your data — e-mail address, name, Google account id and technical data such as your IP address — is transferred to Google LLC in the USA. This happens today. The transfer is made under the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and in the alternative under the Commission's standard contractual clauses (GDPR art. 46(2)(c)). You can obtain a copy of the safeguard by writing to us at admin@verdevin.com.

Our e-mail service (Google Workspace) processes mail, including attachments, at Google, which may do so in the USA and other countries outside the EU/EEA. The transfer is made under the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and in the alternative under the standard contractual clauses in Google's data processing agreement (GDPR art. 46(2)(c)).

Apart from Google login and our e-mail service, no data is transferred out of the EU/EEA. The site loads no scripts, fonts or images from any server but our own.

6. Storage and deletion

• Order and accounting material: Kept for five years from the end of the financial year the material relates to, as required by the Danish Bookkeeping Act, after which it is deleted.
• Enquiries: Deleted once they are no longer needed to answer and document the exchange — as a rule no later than two years after the last contact.
• Cookies: See the retention periods in the Cookie policy.
• Newsletter: Your e-mail address is processed until you unsubscribe. Evidence of your consent is kept for as long as it is required.
• Customer account: Kept until you delete the account yourself. You can delete your account and all account data at any time with the "Delete my account and my data" button on the account page — deletion is immediate. Order and accounting data remain subject to the five-year period above and are only deleted when it expires.
• Withdrawals: Kept together with the order for five years from the end of the financial year they relate to — the same period as order material. A withdrawal that could not be linked to an order is kept for as long.
• Orders that were not paid: When you go to pay we save the order so that it can be matched to the payment. If it was never paid, it is deleted after 30 days at the latest.

7. Your rights

Under the GDPR you have a number of rights in relation to our processing of your data:

• The right of access to the data we process about you.
• The right to rectification of inaccurate data.
• The right to erasure ("the right to be forgotten").
• The right to restriction of processing.
• The right to data portability (receiving your data in a commonly used format).
• The right to object to processing based on legitimate interest and to direct marketing.
• The right to withdraw consent at any time — this applies to the newsletter, which you can unsubscribe from using the link at the foot of every mail. Withdrawal does not affect the lawfulness of processing carried out beforehand.

You can exercise your rights by contacting us at admin@verdevin.com. We reply as soon as we can and no later than one month after your enquiry.

8. Complaining to the Danish Data Protection Agency

You have the right to lodge a complaint with Datatilsynet, the Danish Data Protection Agency, if you are unhappy with the way we process your personal data:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Phone: 33 19 32 00
www.datatilsynet.dk

9. Changes to this policy

We update this privacy policy when necessary, for example when our processing or the law changes. The current version is always available on this page, and the date at the top shows when it was last changed.