Terms and conditions, privacy policy and data processing

1. INTRODUCTION

1.1 Data Protection
1.1.1 In connection with the operation of a skincare and beauty clinic and webshop, Dare
to Care ApS processes personally identifiable information (personal data) about its customers, suppliers, and job applicants and has therefore adopted this data protection policy, which describes how your data is processed and what rights you have as a data subject.

1.1.2 To best protect your personal data, we assess the risk that our data processing may negatively affect your fundamental rights, and we process your personal data based on the following basic principles:
• Processing is done in a lawful, fair, and transparent manner in relation to you.
• Processing is subject to a purpose limitation.
• Processing is based on a principle of data minimization.
• Processing is based on a principle of accuracy, which ensures that the data we process about you is correct and up-to-date.
• Processing is based on a principle of storage limitation.
• Processing is based on a principle of integrity and confidentiality.

1.2 Data Controller
1.2.1 The data controller for the processing of your personal data is Dare to Care ApS, CVR-no. 42444790, which means that this company is responsible for ensuring that your personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) and applicable national legislation.
1.2.2 If you have questions regarding the processing of personal data within the company, please contact Line Friis at Line@klinikdaretocare.dk.

2. GENERAL INFORMATION ON THE PROCESSING OF PERSONAL DATA AT DARE TO CARE APS
2.1 Processing of personal data as part of our skincare treatment
2.1.1 At Dare to Care ApS, we process personal data about you as part of the advice and treatment we provide to you.

2.2 Types of Personal Data
2.2.1 In connection with carrying out our treatments, we process personal data about you, which may include:

General personal data:
• Name
• Address
• Email address
• Phone number
• Date of birth
• Booking history
• Purchase history
• Gender

Sensitive personal data:
• Any scanning images in connection with skin analyses
• Skin type
• Information about any allergies
• Information about any relevant diseases
• Information about any previous relevant treatments/operations
• Video material of your arrival at the clinic (during stay in the reception area/shop)
• Any use of medication
• Relevant information about your life situation, including work, family, children, and other circumstances that may influence your stress level and thus the condition of your skin

2.2.2 In connection with the operation of our webshop, we process personal data about you, which includes:

General personal data:
• Name
• Address
• Email address
• Phone number
• Purchase history
• Bank details
Sensitive personal data:
• Any health information, e.g., skin condition

2.2.3 In connection with our negotiations with a company as a supplier, we process personal data about you as a contact person, which includes:
General personal data:
• Name
• Email address
• Phone number
• Job title
2.3 Purpose of processing personal data, and the legal basis for it.

2.3.1 We collect and store your data for specific and legitimate purposes, for example
• When we register you as a customer in our booking system for ongoing correspondence, booking, and invoicing
• When we need to use the information to get an overview of your needs regarding skincare, and to create the best possible basis for advising you and providing the best possible skincare, and assessing your health condition.
• When we need to register your order on our webshop, and need the information to generate an order confirmation, provide delivery, send an invoice, and provide the best possible service in relation to previous purchases of products
• When you arrive as a customer at the clinic/shop, there is video surveillance of the shop area itself for security reasons. (These videos are deleted after 30 days)
• When you submit an solicited or unsolicited application to us, we store it for review and assessment of recruitment possibilities. If the application does not lead to employment, we delete the application no later than 6 months after receipt.
2.3.2 If we later need to use the information for a purpose other than the stated one, we will contact you and obtain your consent.
2.3.3 Our legal basis for processing your personal data will typically be:
2.3.3.1 For general personal data:

• Article 6(1)(a) of the GDPR: Consent
• Article 6(1)(b) of the GDPR: Performance of a contract
• Article 6(1)(f) of the GDPR: Legitimate interest
• Article 6(1)(c) of the GDPR
•: Legal obligation

2.3.3.2 For special (sensitive) personal data:
• Article 9(2)(a) of the GDPR: Consent

2.3.4 In connection with the collection of your personal data, you will be informed about the legal basis(es) for the processing.

2.4 Scope of data
2.4.1 Before we process your personal data, we examine whether it is possible to minimize the amount of personal data in relation to the purpose of the processing. We also examine whether some of the data types we use can be used anonymously or pseudonymously. This is possible if it does not negatively affect our obligations to public authorities or our daily operations.
2.4.2 We only collect, process, and store the personal data necessary to fulfill our intended purposes. In addition, it may be decided by law what type of data it is necessary to collect and store in relation to running a skincare clinic. The type and scope of the personal data we process may also be required to fulfill a contract or other legal obligation.

2.5 Control
2.5.1 We continuously check that your personal data is not inaccurate or misleading to the extent possible. In this regard, we ask you to inform us of relevant changes in your personal data. You can contact Line Friis at Line@klinikdaretocare.dk for notification of changes.

3. SECURITY
3.1 To protect you from unauthorized access to your personal data, we use IT solutions that automatically ensure that all data is only accessible to relevant individuals.
3.2 Furthermore, at Dare to Care ApS, we have adopted internal procedures and policies regarding information security. These procedures and policies contain instructions Page 5 and actions that protect your data from being destroyed, lost, altered, disclosed, and from unauthorized access or sharing.

4. DISCLOSURE OF PERSONAL DATA
4.1 As part of the operation of our skincare clinic, we use independent practitioners to varying degrees, who are thus independent legal entities and not a legal part of Dare to Care ApS. In cases where a customer is treated by an independent practitioner, we disclose the necessary personal data about the customer to the independent practitioner. We always ensure that we have the necessary legal basis before disclosing personal data to an independent practitioner, and we always inform the customer in question about the disclosure.

4.2 As part of our customer service, we may disclose information about your purchase history to a third party for gift purchases. We always ensure that we have the necessary legal basis before disclosing personal data to a third party for gift purchases. The necessary legal basis in this case is consent, which you can always withdraw by contacting the data controller.

4.3 Disclosure of personal data to a third party will always be legally justified and otherwise necessary to fulfill your legitimate interests.

4.4 As part of the operation of our skincare clinic, we use various data processors to the extent necessary. Our data processors consist of:
4.4.1 Our booking system
4.4.2 Our webshop provider
4.4.3 Our alarm system
4.4.4 Our independent bookkeeper
4.4 We have entered into the necessary data processing agreement with all our data processors.

5. CUSTOMER RIGHTS
5.1 Right of access
5.1.1 Upon request, you can gain insight into what personal data and categories of personal data we process about you and what the purpose of the processing is, if you have not already been informed. You can also gain insight into how long we store your personal data and who else has access to your personal data.

5.2 Right to object
5.2.1 You can object to the processing of your personal data at any time and withdraw a previously given consent for the processing of your personal data.

5.2.2 However, you should be aware that there will be certain personal data that we may process without your consent if we have a legitimate interest, and if the protection of your interests does not outweigh this interest.

5.3 Right to rectification
5.3.1 If you believe that the personal data we process about you is inaccurate or misleading, you have the right to have it corrected. In this regard, you should contact Line Friis at Line@klinikdaretocare.dk.

5.4 Right to restrict/erase personal data

5.4.1 As long as you are a customer of Dare to Care ApS and up to 5 years after the customer relationship has ended (when there has been no interaction with you as a customer for 12 months), we store your personal data for the purpose of fulfilling public obligations and for potential legal disputes. In some cases, however, we will have an obligation to erase your personal data sooner. This applies, for example, if you withdraw consent, or if the storage of your personal data is no longer necessary for the stated purposes.

5.4.2 If you request that your personal data be corrected or erased, we will investigate whether the conditions for this are met, and if so, we will make the necessary changes or deletions as soon as possible.

5.5. Right to data portability
5.5.1 If you request information about what personal data Dare to Care ApS processes about you, and the conditions for this are met, you are entitled to have us provide this in a structured, commonly used, and machine-readable format, and we cannot and will not prevent you from transmitting this information to a third party. If you request it, and it is technically possible, we will arrange to transmit the desired personal data directly from Dare to Care ApS to a third party.
5.6 Right to complain

5.6.1 If you believe that your personal data is being processed in violation of applicable law or other legal obligations, you have the right to lodge a complaint with the Danish Data Protection Agency (dt@datatilsynet.dk).