Privacy
Policy

1. About this policy

This Privacy Policy describes how Slipp ApS ("Slipp", "we", "us") processes personal data when you use our marketing site (slipp.app), our attendee app, our vendor app, or any related services (together, the "Services").

We process personal data as a data controller under Regulation (EU) 2016/679 (the "GDPR") and the Danish Data Protection Act (Databeskyttelsesloven). This policy fulfils our duty to inform you under GDPR Articles 13 and 14.

2. Who is the data controller

Slipp ApS, CVR no. 46359070, is the data controller for personal data processed through the Services.

Registered office: Denmark. Public company information: cvrapi.dk/virksomhed/dk/slipp-aps/46359070.

Privacy contact: privacy@slipp.dk. General support: support@slipp.dk.

3. Data Protection Officer

Slipp has not appointed a Data Protection Officer. We are not required to appoint one under GDPR Article 37(1): we do not carry out large-scale systematic monitoring of data subjects, we do not process special categories of data on a large scale, and we are not a public authority.

For any data-protection question or request, contact privacy@slipp.dk.

4. What personal data we process

We try to keep what we collect to a minimum. The categories are:

We do not collect or process Danish CPR numbers (Personnummer). Slipp does not require CPR for any service.

5. Lawful basis for processing

Each category of processing has a lawful basis under GDPR Article 6:

6. Who receives your personal data

We share personal data only with parties that need it to provide the Services. The recipients are:

• Vendors you place orders with see your email address and order details for the duration of the order. This is necessary so they can serve and contact you about that order.
• Service providers acting as processors on our behalf (see the sub-processor list below).
• Stripe, which acts as an independent controller for payment data, not as our processor.
• Public authorities where we are required by law to disclose information (e.g. tax authorities, courts, police on valid legal request).

7. Sub-processors and other recipients

We use a small number of vetted providers. International transfers outside the EU/EEA rely on the EU-US Data Privacy Framework ("DPF") and/or Standard Contractual Clauses ("SCCs").

8. International transfers

Some of our sub-processors are based outside the EU/EEA, primarily in the United States. Where transfers occur, they are protected by the EU-US Data Privacy Framework (where the recipient is certified) and/or by the European Commission's Standard Contractual Clauses, with supplementary measures where appropriate.

You can request a copy of the transfer safeguards by writing to privacy@slipp.dk.

9. How long we keep your data

We keep personal data only for as long as needed for the purpose it was collected for, plus any period required by law:

10. Your rights

Under the GDPR you have the following rights:

• Right of access — get a copy of the personal data we hold about you (Art. 15).
• Right to rectification — correct inaccurate or incomplete data (Art. 16).
• Right to erasure — ask us to delete your data, within the limits of legal retention (Art. 17).
• Right to restriction — ask us to pause processing while a dispute is resolved (Art. 18).
• Right to data portability — receive your data in a structured, machine-readable format (Art. 20).
• Right to object — object to processing based on legitimate interests (Art. 21).
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
• Right not to be subject to a decision based solely on automated processing (Art. 22).

To exercise any of these rights, write to privacy@slipp.dk. We will respond within one month, in line with GDPR Article 12(3). We may need to verify your identity before acting on a request.

11. Right to lodge a complaint

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet):

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark. Tel.: +45 33 19 32 00. Email: dt@datatilsynet.dk. Website: datatilsynet.dk.

We would appreciate a chance to address your concern first — please reach out to privacy@slipp.dk.

12. Minimum age

Slipp is intended for users aged 18 and over. We require an 18+ confirmation at signup. The age threshold is set on the basis of Danish contractual capacity (Værgemålsloven §§ 1, 42), not as a special-category processing matter.

Restricted-goods enforcement (alcohol under Restaurationsloven, tobacco under Tobaksforbudsloven) is the responsibility of the vendor at the point of delivery.

If you become aware that someone under 18 has created an account, please contact privacy@slipp.dk and we will close it.

13. Automated decision-making

Slipp does not make decisions producing legal or similarly significant effects about you based solely on automated processing within the meaning of GDPR Article 22.

Stripe may run automated fraud checks as part of its payment processing under its own controller relationship; Stripe's privacy policy applies.

14. No CPR numbers

Slipp does not collect, process or store Danish CPR (Personnummer). Processing CPR is restricted under Databeskyttelsesloven § 11 to specific scenarios that do not apply to Slipp.

15. No marketing emails

Slipp does not send marketing emails. The only emails we send are transactional (order confirmations, authentication codes, service notices). We will not opt you in to marketing communications without separate, explicit consent.

16. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. For material changes that affect your rights, we will give reasonable notice and, where required, ask for renewed consent.

Previous versions are available on request from privacy@slipp.dk.