In our privacy policy, you can read about how we (Kanpla ApS) process the personal information we obtain.

Our privacy policy applies when we are the data controller for the personal information we process about you. "Personal information" in our privacy policy refers to any form of information about an identified or identifiable natural person. In other words, it means any information that can be directly or indirectly attributed to you.

1. PURPOSE AND LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION

1.1. Completion of purchases

We process personal information about the following categories of registered individuals in connection with the completion of purchases:

• Customers
• Individuals physically collecting the food, including children

The personal information is collected from you and from partners. We process the following types of personal information in connection with the completion of purchases:

Name Phone number Email address Information about credit/payment card number and expiration date Dietary information Grade level The personal information is processed for the purpose of:

Delivering agreed products and services Communicating with our customers - for example, answering questions, inquiries, complaints, or other requests Administering user accounts/profiles Our processing is limited to the personal information necessary to fulfill the above purposes.

The legal basis for our processing of your personal information is as follows:

Processing of the personal information is necessary for the performance of one or more contracts in which you are a party, pursuant to Article 6(1)(b) of the General Data Protection Regulation.

The processing of the personal information is necessary for the performance of pre-contractual measures taken at your request, pursuant to Article 6(1)(b) of the General Data Protection Regulation.

1.2 Marketing

We process personal information about the following categories of registered individuals for marketing purposes:

Customers Visitors to our website/app Individuals physically collecting the food, including children The personal information is collected from you and from public authorities. We process the following types of personal information for marketing purposes:

• Name
• Phone number
• Email address
• Grade level
• Purchase habits

The personal information is processed for the purpose of:

• Sending marketing material
• Conducting other marketing initiatives
• Customizing and optimizing our service
• Our processing is limited to the personal information necessary to fulfill the above purposes.

The legal basis for our processing of your personal information is as follows:

You have given consent to the processing of your personal information for one or more specific purposes, pursuant to Article 6(1)(a) of the General Data Protection Regulation.

The processing of the personal information is necessary for us or a third party to pursue a legitimate interest, and your interests or fundamental rights and freedoms do not override this interest, pursuant to Article 6(1)(f) of the General Data Protection Regulation. The legitimate interest(s) pursued is the ability to optimize our services based on our customers' behavior and the need to conduct direct marketing. Your interests and rights are not deemed to outweigh the legitimate interest(s) because our processing does not significantly impact the rights and freedoms of the data subject.

1.3 Use of our website/app

We process personal information about the following category of registered individuals in connection with the use of our website/app:

• Visitors to our website/app

The personal information is collected from you.

We process the following types of personal information in connection with the use of our website/app:

• Information about
• IP address
• Information about login
• User behavior

The personal information is processed for the purpose of:

• Optimizing and managing the use of our website/app
• Generating statistics about the use of our website/app
• Customizing and optimizing our service

Our processing is limited to the personal information necessary to fulfill the above purposes.

The legal basis for our processing of your personal information is as follows:

The processing of the personal information is necessary for us or a third party to pursue a legitimate interest, and your interests or fundamental rights and freedoms do not override this interest, pursuant to Article 6(1)(f) of the General Data Protection Regulation. The legitimate interest(s) pursued is the ability to optimize our services based on our customers' behavior. Your interests and rights are not deemed to outweigh the legitimate interest(s) because our processing does not significantly impact the rights and freedoms of the data subject.

2. WHO HAS ACCESS TO YOUR INFORMATION?

We disclose or transfer your personal information to:

• Data processors
• Public authorities
• Collaboration partners

When our data processors process personal information on our behalf, they do so strictly under our instructions. This means, among other things, that they are not allowed to use the personal information for their own purposes.

3. DELETION

Your personal information provided in connection with orders will be anonymized six months after the order has been placed, and your personal information provided in connection with the creation of a user account will be deleted no later than 3 years after the last placed order unless we are legally obligated to retain them for a longer period. We only retain personal information for as long as there is a legitimate need for it. This includes, among other things, that personal information is not retained longer than necessary in relation to the purpose for which the information was collected.

4. YOUR RIGHTS

Under the General Data Protection Regulation, you have a number of rights regarding our processing of your personal information.

You have the right to access the information we process about you, as well as a range of additional information.

Furthermore, you have the right to request the correction of inaccurate information about you. In certain cases, you will have the right to request the deletion of information about you. Additionally, in certain cases, you may request that the processing of your personal information be restricted. Moreover, in certain cases, you will have the right to object to our otherwise lawful processing of your personal information.

Finally, in certain cases, you have the right to data portability, which means the right to receive your personal information in a structured, commonly used, and machine-readable format and to have this personal information transferred from us to another data controller.

You can read more about your rights in the Danish Data Protection Agency's guidance on the rights of data subjects, available on the Danish Data Protection Agency's website.

You can contact us if you wish to exercise your rights as described above, if you wish to lodge a complaint, or if you have any questions about our privacy policy by contacting:

Kanpla ApS
Søndergade 44, 3rd floor
8000 Aarhus C
Phone number: +45 3939 3009
Email: support@kanpla.dk

You can also lodge a complaint with the Danish Data Protection Agency regarding our processing of your personal information. You can read more about this on the Danish Data Protection Agency's website.

If our processing of your personal information is based on your consent, you may withdraw your consent at any time by contacting us using the contact information provided above.

If you withdraw your consent, it does not affect the lawfulness of our processing of your personal information based on your previously given consent up until the time of withdrawal. Therefore, if you withdraw your consent, it will only take effect from that point forward.

5. CHANGES TO OUR PRIVACY POLICY AND LATEST UPDATE

Our privacy policy is regularly updated. As a user, you agree to be bound by the applicable terms and conditions. It was last updated on August 18, 2020.