Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

For privacy-related enquiries, contact us at the address above.

2. What Data We Collect & Why

Order & transactional data

When you place an order we collect your name, email address, shipping address, phone number, and order details (products, quantities, prices). Payment details are processed directly by Stripe and are never stored on our servers.

Customer service communications

If you contact us via the contact form or email, we store the content of your message and your contact details in order to respond to you.

Newsletter

If you subscribe to our newsletter, we store your email address and the date of your consent. You can unsubscribe at any time via the link in any newsletter email.

Technical & analytics data

Our hosting provider (Vercel) may process standard server log data (IP address, browser type, referring URL) as part of delivering the website. We use analytics only with your consent - see the Cookies section below.

3. Legal Bases (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)): Processing your order, arranging delivery, sending order confirmation, and handling returns and refunds.
• Legal obligation (Art. 6(1)(c)): Retaining order and invoicing records for 5 years as required by Danish bookkeeping law.
• Legitimate interest (Art. 6(1)(f)): Fraud prevention, website security, and responding to customer service enquiries.
• Consent (Art. 6(1)(a)): Sending marketing newsletters and loading optional analytics cookies - only when you have explicitly opted in.

4. Sub-Processors

We use the following third-party processors. Each is bound by a data processing agreement with us:

Sub-processor lists are reviewed periodically. Where a processor transfers data outside the EEA, Standard Contractual Clauses approved by the European Commission are in place unless an adequacy decision applies.

5. Retention Periods

• Order records & invoices: 5 years from the end of the financial year in which the transaction occurred, as required by the Danish Bookkeeping Act (Bogføringsloven).
• Customer service messages: Deleted within 2 years of the case being closed, unless retention is required for a legal claim.
• Marketing consent & newsletter subscription: Retained until you withdraw your consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Analytics data: Aggregated and anonymised; retained per the analytics provider's standard policy (typically 14 months).

6. Your Rights

Under the GDPR you have the following rights with respect to your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you. Submit a request via our contact form or by emailing inca@inca.dk. Alternatively, use our automated data export endpoint: /api/account/export.
• Right to rectification (Art. 16): If any data we hold about you is inaccurate, you may request correction by contacting us.
• Right to erasure (Art. 17): You may request deletion of your personal data where there is no overriding legal basis for us to retain it. Use our erasure request endpoint /api/account/delete or contact us directly. Note that we are required by law to retain certain order records for bookkeeping purposes.
• Right to data portability (Art. 20): You may request your data in a structured, machine-readable format via our data export endpoint or by contacting us.
• Right to object (Art. 21): You may object at any time to processing based on legitimate interest. If you object to marketing communications, you can unsubscribe via the link in any email or contact us.
• Right to lodge a complaint: You have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet): www.datatilsynet.dk, Carl Jacobsens Vej 35, DK-2500 Valby.

We will respond to all rights requests within 30 days as required by Art. 12 GDPR. Complex cases may be extended by a further 60 days; we will inform you if this applies.

7. Cookies

We use cookies to provide core functionality and, with your consent, to improve our service. A cookie consent banner is shown on your first visit. You may withdraw or change your preferences at any time by clicking "Cookie preferences" in the site footer.

Necessary cookies

These cookies are required for the cart, checkout, and admin login to function and cannot be disabled. No consent is required for these cookies (ePrivacy Directive, Art. 5(3) exception for technically necessary cookies). The specific cookies we set are:

• inca_cart - an HMAC-signed first-party cookie that stores the items currently in your shopping bag. Required for the cart to persist across pages and through checkout. Expires after 30 days.
• inca_admin - a session cookie set only when an authorised administrator signs in to the back office. Not used by customers. Expires after 8 hours.

Analytics cookies (consent required)

When you consent, we load privacy-friendly analytics (Vercel Analytics) to understand how visitors use the site in aggregate. These cookies do not track you across other websites and do not build advertising profiles.

Marketing cookies (consent required)

We do not currently place marketing or retargeting cookies. If we do so in the future, this policy and the consent banner will be updated accordingly.

Your consent choice is stored in a first-party cookie named cookie_consent for 12 months. You can clear it at any time by clearing your browser cookies.

8. Contact for Privacy Matters

For any privacy-related question or to exercise your rights, contact us at: inca@inca.dk