1. GENERALLY

1.1 This policy on the processing of personal data ("Personal Data Policy") describes how Kosmolet A/S, the company behind Nilens Jord, hereinafter referred to as ("Nilens Jord", "us", "our", "we") collects and processes information about you.

1.2 The Personal Data Policy applies to personal data that you provide to us in connection with your contact with Nilens Jord as a customer or partner. This may be the case if you purchase a product from Nilens Jord, contact Nilens Jord's Customer Service, use Nilens Jord's website, www.nilensjord.dk ("nilensjord.dk"), or when you are in dialogue with Nilens Jord's headquarters. Nilens Jord's Personal Data Policy is based in Denmark and is written in accordance with applicable Danish legislation.

1.3 Kosmolet A/S is the data controller for your personal data. All inquiries to Nilens Jord can be made via the contact information provided under point 7.

2. WHAT PERSONAL DATA DO WE COLLECT, FOR WHAT PURPOSES AND THE LEGAL BASIS FOR THE PROCESSING

2.1 When you visit Nilensjord.dk, we automatically collect information about you and your use of Nilensjord.dk. This information typically includes which type of browser you are using and what search terms you use on Nilensjord.dk. In addition, Nilens Jord's Cookie Policy applies when you use Nilensjord.dk.

2.1.1 The purpose is to optimize the user experience and the functionality of Nilens Jord, to generate useful and accurate statistics based on the information we receive from you via your use of Nilensjord.dk, and to conduct personalized marketing, including retargeting through platforms such as Facebook and Google. This processing of information is necessary for us to manage our interests in improving nilensjord.dk as well as showing you relevant offers.

2.1.2 The legal basis for the processing is your consent to our use of cookies and Article 6, paragraph 1, letter a of the Data Protection Regulation, as well as our legitimate interest in improving our website and being as relevant in our marketing as possible according to Article 6, paragraph 1 letter f of the Data Protection Regulation.

2.2 When you purchase a product or communicate with us regarding our products, we collect the information you provide. This can include name, address, email address, phone number, payment method, information about which products you purchase and possibly return, information about inquiries and complaints, delivery wishes, as well as information about the IP address from which the order is made, if the order is placed on Nilensjord.dk.

2.2.1 The purpose is that we can deliver the products you have ordered and otherwise fulfill our agreement with you, including to manage your rights to return and complain and, if necessary, to contact you regarding relevant information about the product you have purchased. We may also process information about your purchases in order to comply with legal requirements, including regarding product withdrawals, accounting, and bookkeeping. When purchasing on Nilensjord.dk, the IP address is collected for the purpose of protecting our interest in preventing fraud.

2.2.2 The legal basis for the processing is Article 6, paragraph 1, letters b, c, and f of the Data Protection Regulation.

2.3 When you sign up for our newsletter, we collect information about your name, email address, and possibly mobile number.

2.3.1 The purpose is to manage our interest in delivering newsletters to you.

2.3.2 The legal basis for the processing is your consent to receive our newsletter and Article 6, paragraph 1, letter a of the Data Protection Regulation.

2.4 When you visit any of our other locations (head office and warehouse), there may be CCTV surveillance installed. In that case, signage with a pictogram (with a camera image) will be placed in a visible location. The recordings are reviewed through spot checks, if there is specific suspicion or other irregularities, and are forwarded to the police if there is suspicion of a criminal offense.

2.4.1 The purpose of the CCTV surveillance is to allow Nilens Jord to prevent, detect, and document violations of the law in relation to both customers and staff (theft and other unauthorized access), irregularities in connection with cash transactions and similar matters, as well as to create a sense of security for the staff (robbery, assault, and disputes regarding payment).

2.4.2 The legal basis for the processing is Article 6, paragraph 1, letter f of the Data Protection Regulation, as Nilens Jord has a legitimate interest in preventing the types of crime mentioned in point 2.5.1 at Nilens Jord's locations.

2.5 When you visit Nilens Jord's Social Media platforms, e.g. Facebook, Instagram, and LinkedIn, Nilens Jord processes the information you have made available via settings on our social media, your reactions to our posts, and your sharing of these as well as any comments on our posts.

2.5.1 The purpose of Nilens Jord's processing of your personal data is to market Nilens Jord, to respond to your inquiry, and/or to allow you to participate in our competitions and to contact you if you win. When Facebook Inc. uses personal data collected on Nilens Jord's Facebook pages, e.g. to improve their advertising system, Facebook Inc. and Nilens Jord can be considered joint data controllers. We refer in this regard to Facebook's Data Policy (read more here).

2.5.2 The legal basis for this processing is Nilens Jord's legitimate interest in marketing Nilens Jord, responding to your inquiry, or allowing you to participate in a competition and contacting you if you win according to Article 6, paragraph 1, letter f of the Data Protection Regulation.

2.6 If you enter into a commercial relationship with us either as an individual or as an employee of a company we collaborate with, we process information about your name, email, phone number, company or private address, and any other information you provide us in connection with our relationship and your inquiry.

2.6.1 The purpose of Nilens Jord's processing is to manage our cooperative relationship and fulfill Nilens Jord's obligations in that connection.

2.6.2 The legal basis for this processing will normally be the agreement entered into between you and/or the company you represent and Nilens Jord, according to Article 6, paragraph 1, letter b of the Data Protection Regulation. Depending on the nature of the cooperation, the legal basis may also be another, typically Nilens Jord's legitimate interest in establishing and managing the relationship between you and/or the company you represent, according to Article 6, paragraph 1, letter f of the Data Protection Regulation.

3. RECIPIENTS OF PERSONAL DATA

3.1 Nilens Jord cannot access your IP address, but it is provided to our partner Google Analytics, which processes this to generate statistics on the use of our website. Google Analytics acts solely on behalf of Nilens Jord, and therefore may not use the information for its own purposes. Nilens Jord also has Facebook Pixels implemented on Nilensjord.dk to collect data for the optimization of our Facebook advertisements. In this context, Facebook receives information about your IP address and information about your device, the websites you visit, the purchases you make, the ads you see, and how you use Nilensjord.dk, including your web browser and which pages you visit. When Facebook Inc. uses personal data collected via Facebook Pixels on Nilensjord.dk, for example, to improve their advertising system, Facebook Inc. and Nilens Jord can be considered joint data controllers. We refer in this regard to Facebook's Data Policy (read more here).

3.2 In connection with the delivery of goods you have purchased from Nilens Jord, information about your name, address, email, phone number, as well as order number and specific delivery wishes will be forwarded to GLS or another carrier who will deliver the purchased goods to you. Furthermore, your information may be shared with partners who assist with our business activities.

3.3 When you complete payment transactions on Nilensjord.dk, this is done through Nilens Jord's PCI (Payment Card Industry – Data Security Standard) certified partner, Bambora. The information is stored in a secure PCI certified environment that meets international security standards. When you use a payment card on Nilensjord.dk, it is only Nilens Jord's PCI certified partner Bambora – and not Nilens Jord – that gains access to your information.

3.4 Information that Nilens Jord processes about you as part of a cooperative relationship will not be disclosed to third parties unless it is necessary for the purpose of the relationship, or it is necessary for us to safeguard a legitimate interest, e.g. in connection with disputes, where the information may be provided to authorities and legal entities.

3.5 Information may be entrusted to external partners who process the information on our behalf. We use external partners for, among other things, the technical operation of systems and improvements of Nilensjord.dk, sending out newsletters, handling complaints and other customer inquiries, as well as targeted marketing, including re-targeting marketing, and for your assessment of our business and products. These companies are data processors and operate under our instruction and process data for which we are the data controller. Data processors are not permitted to use the information for any purpose other than fulfilling the agreement with us and are subject to confidentiality regarding these. We have entered into written data processing agreements with all data processors that process personal data on our behalf.

3.6 Some of these data processors, e.g. Google Analytics v/Google LLC and Facebook Inc. are established outside the EU. The necessary guarantees for the transfer of information to data processors outside the EU are ensured by respecting valid transfer guarantees.

4. YOUR RIGHTS

4.1 In order to create transparency regarding the processing of your information, we must, as the data controller, inform you of your rights.

4.2 RIGHT OF ACCESS

4.2.1 You are always entitled to request information from us about, among other things, what information we have registered about you, what purpose the registration serves, what categories of personal data and recipients of information there may be, as well as information about where the information originates from.

4.2.2 You have the right to receive a copy of the personal data we process about you. If you wish to receive a copy of your personal data, you must send a written request to info@nilensjord.dk. You will be asked to document that you are who you claim to be.

4.3 RIGHT TO RECTIFICATION

4.3.1 You have the right to have incorrect personal data about yourself rectified by us. If you become aware that there are errors in the information we have registered about you, you are encouraged to make a written request to us so that the information can be corrected. You will be asked to document that you are who you claim to be.

4.4 RIGHT TO ERASURE

4.4.1 In certain cases, you have the right to have all or some of your personal data deleted by us, e.g. if you withdraw your consent, and we do not have another legal basis to continue processing. To the extent that continued processing of your information is necessary, e.g. for us to comply with our legal obligations, or for legal claims to be established, made, or defended, we are not obligated to delete your personal data. You will be asked to document that you are who you claim to be.

4.5 RIGHT TO RESTRICT PROCESSING TO STORAGE

4.5.1 You have the right, in certain cases, to obtain restriction of the processing of your personal data to merely storage, e.g. if you believe that the information we process about you is not correct.

4.6 RIGHT TO DATA PORTABILITY

4.6.1 You have the right, in certain cases, to obtain personal data that you have provided to us, in a structured, commonly used and machine-readable format and have the right to transfer this information to another data controller.

4.7 RIGHT TO OBJECT

4.7.1 You have the right to object at any time to our processing of your personal data, with a view to direct marketing, including the profiling that takes place in order to target our direct marketing, as this processing is carried out on the basis of your consent and/or our legitimate interests, referring to points 2.1, 2.2, 2.4, 2.5, and 2.6. If you do not wish us to use your personal data for direct marketing and profiling, you must also delete your cookies, as mentioned in point 5.1 below.

4.8 RIGHT TO WITHDRAW CONSENT

4.8.1 You have the right at any time to withdraw your consent, which you have given us for a specific processing of personal data, including for sending newsletters. If you wish to withdraw a consent, you must contact info@nilensjord.dk.

4.9 RIGHT TO COMPLAIN

4.9.1 You have the right at any time to file a complaint with the Data Protection Agency regarding our processing of your personal data. Complaints can be submitted, among other things, by email to dt@datatilsynet.dk or by phone: +45 3319 3200.

5. DELETION OF PERSONAL DATA

5.1 Information collected about your use of Nilensjord.dk according to point 2.1 will be deleted according to the rules in Nilens Jord's Cookie Policy. The cookies that Nilens Jord offers will be deleted no later than one year after your last visit to the site, while third-party cookies have varying expiration dates. The individual expiration dates are listed in Nilens Jord's Cookie Policy, where you can also read more about how you can delete your cookies whenever you wish.

5.2 Information collected in connection with your purchases, returns, and inquiries to Nilens Jord in connection therewith, according to point 2.2, will generally be deleted a little over 5 years after your purchase according to invoicing requirements and accounting legislation. However, information may be kept longer if we have a legitimate need for longer storage, e.g. if it is necessary for establishing, asserting, or defending legal claims.

5.3 Information collected in connection with your subscription to our newsletter according to point 2.3 will be deleted when your consent to the newsletter is withdrawn, unless we have another basis for processing the information.

5.4 Information derived from CCTV surveillance according to point 2.4 will automatically be deleted no later than 30 days after the recording took place, unless the information is part of an investigation of a specific case. If your information is part of an investigation of a specific case, it will be deleted when the case is concluded and the purpose of the processing is no longer present.

5.5 Information you provide on Nilens Jord profiles on Social Media according to point 2.5 will generally remain on these profiles as part of the site's history. You can always delete your information on Nilens Jord profiles on Social Media whenever you wish. The information Nilens Jord processes about you as a result of your participation in competitions, and which in that context is copied to Nilens Jord's own systems, is deleted after 12 months. 5.6 Information derived from a cooperative relationship according to point 2.6 is stored as long as it is relevant in relation to the existing or potential cooperative relationship and during a subsequent period, as long as it is necessary for Nilens Jord to document the relationship.

6. SECURITY

6.1 We have implemented appropriate technical and organizational security measures against the accidental or unlawful destruction, loss, alteration, or degradation of personal data as well as against unauthorized access or misuse.

6.2 Only employees who have a genuine need to access your personal data to perform their work have access to the information. These employees are instructed in how personal data is handled responsibly.

7. CONTACT INFORMATION

7.1 GRÆNN A/S, CVR no: 10305403 is the data controller for the personal data collected by Nilens Jord.

7.2 If you have questions or comments regarding this Personal Data Policy or wish to exercise one or more of your rights described in point 4, you can contact: GRÆNN A/S Hvedemarken 12 3520 Farum Phone: +45 4495 8000 Email: info@nilensjord.dk

8. CHANGES TO THE PERSONAL DATA POLICY

8.1 This Personal Data Policy is updated continuously. The applicable version is the one that can be found here on Nilensjord.dk at any time.

9. VERSIONS

9.1 This is version 2 of Nilens Jord's personal data policy dated November 02, 2020.