Short movement breaks for desk-heavy days

1. Data controller

The controller responsible for processing personal data related to this website is:

• Name: Natureibeaut.ddd
• Address: Kongensgade 66, 2.TV, 5000 Odense, Denmark
• Email: hello@natureibeaut.world
• Phone: +45 22 55 96 01
• CVR (Denmark): 43982524

We do not appoint a Data Protection Officer (datatilsynsrådgiver) where not mandatory under Danish law; privacy enquiries are handled by the controller using the contact details above.

2. Categories of personal data

Depending on how you interact with us, we may process:

• Identity and contact data: name, email address, telephone number if you provide it, and message content when you use our contact channels.
• Technical and usage data: IP address, browser type and version, device category, operating system, referrer URL, date/time stamp, and pages requested, typically generated in server or security logs by our hosting provider.
• Consent and preference data: cookie and similar-technology choices (see our Cookie Policy), including timestamps where stored locally or, if we later log consents on a server, the category accepted and version of the consent interface.

We do not intentionally collect special categories of personal data within the meaning of GDPR Article 9 (for example health data) through this website. Please do not send clinical records or detailed health information by email; we cannot use the website as a secure channel for that purpose.

3. Purposes and legal bases (GDPR Article 6)

Under the GDPR and databeskyttelsesloven, we rely on the following purposes and legal bases:

Purpose	Legal basis
Operating, displaying, and securing the website; fraud prevention and abuse detection	Legitimate interests (Article 6(1)(f)), balanced against your rights; where strictly necessary cookies or security measures are mandated, also compliance with Danish electronic communications rules
Answering enquiries, sending requested materials (such as cue sheets), and customer administration	Legitimate interests (Article 6(1)(f)) and, where relevant, performance of a contract or steps prior to a contract (Article 6(1)(b))
Compliance with accounting, tax, or other statutory retention in Denmark	Legal obligation (Article 6(1)(c)), including rules under the Danish Bookkeeping Act (bogføringsloven) where applicable to our business records
Non-essential cookies, analytics, or marketing technologies	Consent (Article 6(1)(a)), in line with Danish cookie and marketing practice requirements
Direct electronic marketing (e.g. newsletters) if we introduce opt-in lists	Consent (Article 6(1)(a)) and, where permitted, the Danish Marketing Practices Act (markedsføringsloven) for business recipients

Where we rely on legitimate interests, you may object under Article 21 GDPR; we will stop processing unless we demonstrate compelling legitimate grounds. Providing contact data for a reply is voluntary, but without it we may be unable to respond.

4. Sources of personal data

We receive personal data directly from you (forms, email, telephone) and indirectly from your device and our hosting infrastructure (logs). We do not purchase marketing lists for this website.

5. Recipients, processors, and transfers

We use IT service providers (for example hosting, email, or analytics if you consent) who process personal data on our behalf as processors under Article 28 GDPR. We enter into written data processing agreements containing the elements required by Danish and EU law.

Processors may be established inside the EEA. If a transfer outside the EEA occurs, we ensure appropriate safeguards under Chapter V GDPR (for example EU Standard Contractual Clauses or an adequacy decision by the European Commission), supplemented by any requirements under databeskyttelsesloven and guidance from Datatilsynet on international transfers.

Public authorities may receive data only when Danish or EU law requires us to disclose it.

6. Retention periods

We retain personal data only as long as necessary for the purposes set out above, unless a longer period is required or permitted by Danish or EU law:

• Enquiries and ordinary email: typically up to 24 months after the last message unless a dispute or legal claim requires longer retention.
• Accounting material and invoices: where applicable, at least five years in accordance with the Danish Bookkeeping Act unless another statutory period applies.
• Server and security logs: according to hosting configuration, commonly between 30 and 90 days, unless extended for documented security investigations.
• Consent logs (if implemented server-side): for the period necessary to demonstrate valid consent under Danish and EU practice.

On the current static demonstration of forms, submissions may only appear in the browser’s address bar; no retention on our servers occurs until a production backend is configured. That deployment will be described in an updated Policy.

7. Your rights

Subject to the conditions and exceptions in the GDPR and databeskyttelsesloven, you have the right to:

• Access (Article 15) and obtain a copy of personal data we hold about you;
• Rectification (Article 16) of inaccurate data;
• Erasure (“right to be forgotten”, Article 17) where grounds apply;
• Restriction of processing (Article 18);
• Data portability (Article 20) where processing is based on consent or contract and is carried out by automated means;
• Object (Article 21), including to processing based on legitimate interests and to direct marketing (including profiling related to such marketing).

If processing is based on consent, you may withdraw consent at any time with future effect, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us using the details in section 1. We will normally respond within one month as required by Article 12 GDPR; that period may be extended by two further months where necessary, taking into account the complexity and number of requests, and we will inform you of any extension and reasons.

You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, website: datatilsynet.dk. You may also seek a remedy before the Danish courts or, where applicable, use other dispute channels offered under EU consumer law.

8. Automated decisions and profiling

We do not use automated decision-making, including profiling, which produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. If that changes, we will update this Policy and, where required, obtain a suitable legal basis.

9. Security and breach notification

We implement appropriate technical and organizational measures under Article 32 GDPR, including access controls, encryption in transit where offered by our providers, and instructions to anyone with access to personal data. No method of transmission over the Internet is completely secure.

In the event of a personal data breach likely to result in a risk to your rights, we will notify Datatilsynet without undue delay and, where required by Article 34 GDPR, communicate to you in a clear manner, in accordance with Danish practice.

10. Children

Our services are not directed at children. Under Danish law and the GDPR, processing of children’s data in the information society may require parental consent where consent is the legal basis and where services are offered directly to a child. If you believe we have collected a child’s data without an appropriate basis, please contact us and we will delete it.

11. Marketing and the Danish Marketing Practices Act

Electronic marketing addressed to consumers is sent only with prior consent or another valid legal ground under the Danish Marketing Practices Act (markedsføringsloven) and implementing guidance, including rules against misleading or aggressive practices and against unsolicited commercial email without consent. You may opt out of marketing at any time using the link in each message or by contacting us.

If we use third-party advertising or measurement tools (for example Google Ads or Meta), we configure consent signals and privacy choices as described in our Cookie Policy and only enable non-essential technologies after a valid consent or other permitted basis.

12. Changes to this Policy

We may update this Policy to reflect changes in processing, technology, or Danish and EU law. The “Last updated” date at the top will change accordingly. Where legally required, we will notify you of material changes (for example through a banner or email).