Privacy Policy
1. General
1. This privacy policy describes how Kauza ApS (“Kauza”, “we”, “us”) collects and processes the personal data that you provide to us, or that we collect about you, when you visit Kauza’s website, www.whatibuy.dk (“the Website”) or use our app, WhatIBuy (“WhatIBuy”) or Kauza’s other digital platforms (collectively referred to as “Services”, “the Service”).
2. Kauza processes your personal data as described in this Privacy Policy and in accordance with applicable legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data etc. (“GDPR”) and the Danish Data Protection Act, Act no. 502 of 23 May 2018, which supplements the GDPR, as well as any amendments thereto and other legislation that supplements these rules.
2. Contact details of the data controller
1. Kauza is the data controller for the personal data that is collected.
2. Kauza is a joint data controller with Facebook for personal data collected using Facebook’s analytics tool ”Facebook Page Insights” when you visit our Facebook page. Read more under section 3.2.
3. If you have questions or comments regarding this privacy policy, or if you wish to exercise one or more of your rights described in section 6, you may contact:
Kauza ApS
Rosenborggade 17, 4th floor
1130 Copenhagen K
CVR no.: 41 02 42 16
Email: info@whatibuy.dk
3. Which personal data we collect, the purposes for which we process it, and the legal basis for processing
1. When you use our Services we collect information about how you use them, e.g. about which type of browser you use and its settings, which search terms you use, your IP address, including your network location, and information about the device you use. The information is collected through the use of cookies or similar technologies, among other means. Read more about this in our Cookie Policy.
2. The purpose is
1. to prepare statistics so that we can analyse how our users use our Services, and optimise the user experience as well as features,
2. to improve the security of our Services, including tracking any illegal activities and misuse of our Services.
3. The legal basis for the processing of your personal data in connection with cookies is our legitimate interest pursuant to Article 6(1)(f) GDPR. On your first visit to our Service, you will be asked to choose which categories of cookies you consent to.
1. When you visit our Facebook page, you should be aware that we use Facebook’s analytics tool ”Facebook Page Insights”, in order to obtain statistics on visitors and to gain insight into users’ behaviour on our Facebook page, including the number of likes, information about who has liked the page, the number of page views and interactions with the page, unlikes and reach of posts etc.
2. In this connection Facebook and Kauza collect this information as joint controllers. When you visit our Facebook page, you will get access to information about this processing. You can get more information here: https://www.facebook.com/legal/terms/information_about_page_insights_data
3. We and Facebook have entered into an agreement on joint controllership. You can read the agreement here: https://www.facebook.com/legal/terms/page_controller_addendum.
4. When you create a user profile in WhatIBuy, you will be asked to enter your email address and a password. You can also use your Facebook or Apple account to register as a user. If you do so, you give us permission to collect and store your email address; we do not get access to your password. In addition, you will be asked to enter your postcode, number of people in your household, age, gender and your budget amount. It is voluntary whether you wish to share your budget with us; if you do not enter one yourself, it is set to DKK 5,000, because the feature cannot function without a budget amount. To verify that it is you logging into your account, we use Firebase Authentication, which collects your IP address and stores it temporarily.
1. The purposes are:
1. to be able to create your user account and deliver our Service to you,
2. to administer our contractual relationship with you,
3. to comply with legal requirements imposed on us.
2. The legal basis for the processing is Article 6(1)(b) GDPR as the processing is necessary for us to perform our contract with you. Processing of information that is necessary for us to comply with legal requirements takes place pursuant to Article 6(1)(c) GDPR.
5. When you connect a “third-party service” in WhatIBuy via the feature “Store login”, you will be asked to provide your login details for this third-party service (typically username and password). We always request the same information as is required by the third party in order to log in. Via your login, we collect transaction information from your digital receipts issued by the third party, including what you have purchased, when and at what price, and generate a digital copy of it (“Receipt Information”).
1. The purpose is to obtain information about your digital receipts from the third-party service so that we can deliver our Service to you, including:
1. Overview: A summary of your total spending and savings, your organic spending, money spent on carrier bags, deposit items etc.
2. Spending: WhatIBuy’s Budget service, which allows you to set an overall spending goal and gives you an overview of your spending compared with your budget
3. Purchases: WhatIBuy’s Purchases service, which allows you to track which categories of goods and services you purchase, across the third-party services you have added.
4. Statistics and analyses: To prepare anonymised statistics and analyses on the basis of your and our other users’ spending patterns, which we have derived from our users’ Receipt Information. The statistics make it possible for you and other users of WhatIBuy to compare your spending with that of other users.
2. The legal basis for the processing is your consent pursuant to Article 6(1)(a) GDPR and the Danish Payments Act section 125(2). When you connect third-party services to your user profile, we will ask you to expressly indicate your consent to the processing of your login details and your Receipt Information for the third-party services you choose to connect.
6. When you contact Kauza for support relating to your use of WhatIBuy, Kauza may access the personal data that we have registered about you via your user profile, including your email address, names of the third-party services you have added in WhatIBuy, information about which features you use in WhatIBuy and how you use them, event logs, such as login times, error messages, Receipt Information etc. The purpose is:
1. to provide support and resolve any issues you may experience in connection with your use of WhatIBuy.
2. The legal basis for the processing is Article 6(1)(f) GDPR, so that we can pursue our legitimate interest in responding to your enquiries and supporting your use of our services as best as possible.
7. We may make aggregated or otherwise irreversibly anonymised reports about purchases and spending patterns, etc. available to companies and organisations, either free of charge or for a fee, for use in analysing specific markets and trends, measuring the effectiveness of marketing and campaigns, as well as optimising sales strategies, etc. The information will not identify you and cannot be linked to you or your household. We have a legitimate interest in carrying out this anonymisation for the purpose of operating our business and the legal basis for the anonymisation is Article 6(1)(f) GDPR. We have balanced our legitimate interests in preparing anonymised statistics and analyses of spending patterns against your interests, rights and freedoms, to ensure that your interests or fundamental rights or freedoms do not override our interests. If you would like more information about this balancing assessment, you may contact us at the address stated under section 2.
4. Recipients of personal data
1. The personal data that Kauza collects is generally not disclosed to third parties.
2. Your personal data may, however, be disclosed to public authorities if we are obliged to do so by law, or to the police where criminal activity is suspected, or as part of the investigation of specific criminal offences.
3. Information may be shared with external service providers that process it on our behalf. We use external partners for purposes including hosting, technical operation and improvements of the WhatIBuy website and app. These companies are data processors and sub-processors and are subject to our instructions and process the information solely on our behalf. The data processors and sub-processors may not use the information for any purpose other than fulfilment of the agreement with us, and are subject to confidentiality obligations. We have entered into data processing agreements with all such processors in accordance with Article 28 GDPR.
5. Transfers to third countries
1. We do not transfer your personal data to recipients outside the EU or EEA, unless we have ensured compliance with GDPR, Chapter V.
2. Some of our suppliers are established outside the EEA, including in the USA, so their processing of your personal data will entail a transfer of data outside the EEA. To ensure that your personal data is afforded an adequate level of protection, we have ensured that safeguards have been implemented that provide a lawful basis for the transfer, including where the EU Commission has determined that the third country in question has an adequate level of protection; or by using the EU Commission’s approved Standard Contractual Clauses (”SCCs”), which give personal data a level of protection essentially equivalent to that guaranteed within the EEA.
3. If you would like further information about our data processors that are established outside the EEA, and the safeguards used to enable such transfers of personal data, you may send your enquiry to us at info@whatibuy.dk.
6. Your rights
1. To ensure transparency regarding the processing of your information we, as data controller, must inform you of your rights. If you wish to exercise your rights, you may contact us. You will find our contact details under section 2.
2. The right of access
1. You are entitled at any time to request information about what personal data we hold about you, the purposes for which the data is processed, the categories of personal data concerned, the recipients or categories of recipients, and the source of the data.
2. You have the right to be provided with a copy of the personal data that we process about you. If you would like a copy of your personal data, you must send a written request to us via the contact details stated under section 2. You may be asked to document that you are who you claim to be.
3. The right to rectification
1. You have the right to have inaccurate personal data about yourself rectified. If you become aware that there are errors in the information we have registered about you, we encourage you to contact us in writing so that the information can be rectified.
2. You can correct the information that we have collected in connection with your user registration, by logging into your WhatIBuy account.
4. The right to erasure
1. In certain cases, you have the right to have all or some of your personal data erased by us, e.g. if you withdraw your consent and we do not have another legal basis to continue the processing. To the extent that continued processing of your information is necessary, e.g. for us to comply with our legal obligations, or for a legal claim to be established, exercised or defended, we are not obliged to erase your personal data.
5. The right to restrict processing to storage
1. In certain cases, you have the right to have the processing of your personal data restricted to storage only. In that case we may only process the information with your consent or for the purpose of establishing, exercising or defending a legal claim.
6. The right to data portability
1. In certain cases, you have the right to receive personal data that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this information to another data controller.
7. The right to object
1. You have at any time the right to object to our processing of your personal data for the purpose of direct marketing, including any profiling that is carried out in order to target our direct marketing. You also have the right, at any time, on grounds relating to your particular situation, to object to the processing of your personal data that we carry out on the basis of our legitimate interests.
8. The right to withdraw consent
1. At any time, you have the right to withdraw consent you have given us to a particular data processing activity. If you withdraw one or more of your consents, you should be aware that you may lose access to some or all of the Service’s features.
2. You can withdraw your consent to processing of Receipt Information in the app, by deleting a specific store login, your profile in the WhatIBuy app (in which case all store logins and other personally identifiable data associated with your account are deleted) or by contacting Kauza, using the contact details stated under section 2, and specifying which consent you wish to withdraw. You can also change your password at the third-party service.
3. You can withdraw your consent to receive marketing, either via the app or by sending an email to info@whatibuy.dk.
4. If you withdraw your consent, it does not affect the lawfulness of the processing that has already taken place on the basis of the consent.
9. The right to complain
1. If you wish to complain about Kauza’s processing of your personal data, please contact us at info@whatibuy.dk.
2. You have the right to complain to your local supervisory authority if you are dissatisfied with how we process your personal data. In Denmark you can complain to the Danish Data Protection Agency (Datatilsynet) – you can see more here: https://www.datatilsynet.dk/borger/klage/saadan-klager-du.
7. Erasure of personal data
1. Your personal data will be erased when Kauza no longer has a legitimate purpose for processing them.
2. If you delete your user profile, we will automatically erase or anonymise the information collected when your profile was created, as well as Receipt Information collected from the third-party services you have connected, pursuant to sections 3.2–3.3.
3. Information may, however, be stored in non-anonymised form for up to 10 years if we have a legitimate need for longer storage, e.g. if it is necessary for a legal claim to be established, exercised or defended, or if storage is necessary for us to comply with legal requirements.
8. Security
1. We have implemented appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration or deterioration, as well as unauthorised disclosure or misuse.
2. Only employees or data processors who have a genuine need to access your personal data in order to perform their work have access to it. All of Kauza’s employees are subject to a duty of confidentiality.
9. Changes to the privacy policy
1. Kauza reserves the right to make changes to this Privacy Policy without prior notice. Changes take effect upon publication of the policy on Kauza’s website and Services.
2. If we make changes to the Privacy Policy, we will notify you via the email address you have associated with your user profile or via push notifications in the WhatIBuy app.
10. Version
1. This is version 2 of Kauza’s Privacy Policy dated 9 September 2022