Privacy Policy

Last updated on 27 October 2026

Data controller

Berry Denmark is owned and operated by Popcorn Media, which is the data controller responsible for the processing of personal data described in this policy.

Popcorn Media / Berry Denmark
Business registration number (CVR): 38312162
Industriparken 34
9560 Hadsund
Denmark

Email: hello@berrydenmark.dk
Phone: +45 20 89 50 01

This policy describes how we process personal data when you visit our online store, shop with us, use your customer account, receive a gift card, contact us or participate in our marketing activities and collaborations.

Personal data we process

Depending on your interactions with us, we may process:

Your name, email address, phone number, billing address and delivery address.
Your order number, purchased products, product selections, amounts, payment status, delivery information and purchase history.
Information about your customer account, membership, discounts, gift cards and any points.
Messages, images and other information you provide in connection with enquiries, returns or complaints about products.
Your IP address, browser, device, language, approximate geographical location and technical identifiers.
Information about visits, searches, product views, shopping carts, checkout, purchases and referrals from advertisements or partners.
Consent records, marketing preferences and relevant information about your interactions with our communications.

We only process information that is relevant to the specific purpose.

Where personal data comes from

Information primarily comes from you when you shop, create an account, complete a form or contact us.

Technical information and information about website use are collected through the online store, cookies, pixels and similar technologies.

We may also receive relevant information from payment providers, carriers, Shopify, advertising platforms, review services and partners.

If someone orders a gift for you or sends you an eGift Card, we may receive your name, email address, delivery address and any personal message from the purchaser.

Purchases and delivery

We use your information to receive and process orders, handle payments, produce and deliver products and provide access to your order status.

Relevant information may be shared with our production partner in Lithuania and with carriers. This may include your name, address, contact details, order number and the products or personal customisations to be produced and delivered.

Payments are processed through the selected payment provider. We process information including payment status and transaction details to complete purchases, maintain accounting records and handle refunds.

The legal basis is Article 6(1)(b) of the General Data Protection Regulation (GDPR), concerning entering into and performing a contract. Processing for accounting purposes is based on Article 6(1)(c), concerning legal obligations.

You must provide the information necessary for payment and delivery for us to complete your purchase.

Customer service and handling claims

We process relevant information to respond to enquiries and handle cancellations, returns, complaints about products, refunds and disputes.

The legal basis is Article 6(1)(b) where processing relates to the purchase agreement, and Article 6(1)(c) where processing is necessary to comply with a legal obligation.

We may also process information under Article 6(1)(f). Our legitimate interests are documenting cases, preventing misuse and establishing, exercising or defending legal claims.

Customer accounts and membership

Information about your account, orders and any membership benefits is used to provide access to the features you have chosen to use.

Processing is based on Article 6(1)(b) where necessary to provide the relevant feature or membership benefit.

Necessary security measures, troubleshooting and prevention of misuse are based on Article 6(1)(f). Our legitimate interest is protecting customers, accounts and the online store.

eGift Cards

When you purchase an eGift Card, we process information about the purchaser, the gift card’s contents, gift code, payment and redemption.

If the gift card is sent directly to another person, we process the recipient’s email address and any name or message to deliver and administer the gift.

The purchaser’s information is processed under Article 6(1)(b) and (c). Recipient information provided by the purchaser is processed under Article 6(1)(f). Our legitimate interest is delivering the purchased gift and administering the gift card.

Receiving a gift card does not automatically subscribe the recipient to marketing.

Newsletters and marketing

When you subscribe to marketing, we process your email address, any name provided, preferences and records of your consent.

We use services including Shopify and Klaviyo to manage subscriptions, forms and communications.

Where covered by your consent, we may use information about product interests, purchases and interactions with messages to personalise content and measure marketing performance. This may include recording email opens and clicks.

Consent-based processing relies on Article 6(1)(a). You can withdraw your consent at any time using the unsubscribe link in the message or by contacting hello@berrydenmark.dk.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Necessary messages about matters such as orders, delivery and complaints about products do not depend on your consent to marketing.

Cookies and technical operation

The online store uses cookies and similar technologies for purposes including shopping carts, login, security, language selection, consent management, analytics and marketing.

We use Cookiebot to manage cookie preferences.

Strictly necessary cookies may be used without cookie consent. Personal data processing necessary for operation and security is based on Article 6(1)(b) or (f), depending on the function. Our legitimate interest is providing and protecting a functioning online store.

Non-essential cookies and similar tracking for analytics or marketing require consent where required by law. The associated consent-based processing relies on Article 6(1)(a).

You can change or withdraw your cookie preferences through the website’s cookie settings. Deleting cookies in your browser does not automatically delete information already recorded in other systems.

Analytics and behavioural analysis

We use analytics tools to understand how the online store is used and to improve navigation, product presentation and the purchasing process.

Google Analytics may process information about visits, devices, traffic sources, product views, shopping carts and purchases.

Hotjar, which is part of Contentsquare, may be used to analyse clicks, scrolling, navigation and user journeys through features including heatmaps and session recordings. A session recording is a technical reconstruction of activity on the website, not a camera or microphone recording.

Analytics requiring consent are carried out under Article 6(1)(a).

Advertising and affiliate referrals

We use Google Ads and Meta technology to measure advertising and, where there is a valid legal basis, display relevant advertisements and create audiences.

Information may include technical identifiers, visits, product interests and purchases. Where the relevant features are used and covered by consent, contact details in a transformed form may also be used for matching on advertising platforms. Such transformation does not necessarily make the information anonymous.

We use impact.com and Shopify Collabs for relevant affiliate and creator collaborations. Referral and order information may be processed to identify which partner a purchase can be attributed to, calculate commission and prevent fraud.

Tracking and advertising requiring consent are based on Article 6(1)(a). Necessary settlement and monitoring of collaborations may be based on Article 6(1)(b), (c) or (f), depending on the relationship and information involved. Our legitimate interests are accurate settlement and preventing documented misuse.

Reviews and social media content

Reviews and information you choose to submit may be processed to publish your review and handle questions about it. We use services including Trustpilot for review features.

The online store also includes integrations displaying content from Instagram. When external content loads, the relevant provider may receive technical information about your connection and device. Consent is obtained where required.

The legal basis depends on the function and is Article 6(1)(a) or (f). Our legitimate interests are managing customer reviews and displaying relevant content about our products.

Recipients and service providers

Relevant information may be processed by:

Shopify, which provides the online store, checkout, customer accounts and related features.
Payment providers and financial institutions.
Production and delivery partners and carriers.
Klaviyo and providers of communication and form features.
Cookiebot, Google, Meta and Hotjar/Contentsquare for the purposes described.
impact.com and Shopify Collabs for relevant collaborations and referrals.
Trustpilot and providers of review features.
IT providers supporting functions including search, product selection, geographical customisation and external content display.
Bookkeepers, auditors, legal advisers and public authorities where necessary and lawful.

Information is shared according to the specific need and legal basis. Not all recipients receive every category of information.

Providers processing information on our behalf are data processors. Other recipients may act as independent or joint data controllers for certain processing activities.

Shopify

Shopify processes information on our behalf to provide the online store.

For certain services of its own, such as Shop and Shop Pay, and certain other features, Shopify may act as an independent data controller. Shopify’s processing depends on the services and features you use.

You can read more about Shopify’s processing and how to exercise your rights here:

https://www.shopify.com/legal/privacy/consumers

Transfers outside the EU/EEA

Our use of international providers may result in information being processed outside the EU/EEA, including in the United States and Canada.

Transfers must take place on a valid legal basis for international transfers. Depending on the recipient, this may be an adequacy decision, the European Commission’s Standard Contractual Clauses or approved Binding Corporate Rules.

An adequacy decision covering a particular framework is only relied upon where the recipient and transfer fall within that framework. Supplementary safeguards are applied where necessary.

You can contact hello@berrydenmark.dk for further information about relevant transfers and safeguards.

Retention and deletion

Information is retained according to its purpose and deleted or anonymised when it is no longer necessary.

Accounting
Accounting records are generally retained for five years after the end of the financial year to which they relate. This does not mean that all customer information is retained for the same period.

Orders, complaints about products and customer service
Information is retained for as long as necessary to complete the purchase and handle the specific matter. Further retention may be necessary due to a legal obligation or a specific need for documentation relating to claims and disputes.

Customer accounts and membership
Relevant information is retained for as long as necessary for the account and selected features. When an account is closed, we assess which information can be deleted and which must still be retained for other lawful purposes.

Marketing
Information is used for consent-based marketing until consent is withdrawn or processing ends. Necessary documentation of consent and unsubscribing may be retained separately to demonstrate compliance and respect your decision to opt out.

Gift cards
Relevant information is retained while the gift card can be used or its value claimed for payout, and afterwards to the extent required by accounting obligations or specific legal claims.

Cookies and analytics
Cookie lifetimes vary depending on the technology and provider. A cookie’s lifetime on your device is not necessarily the same as the retention period for information in an analytics or marketing system.

Google Analytics user and event data are retained according to the selected system settings and Google’s applicable rules. Aggregated reports may have a different retention period. For other analytics tools, the period depends on the data type, features used and relevant agreement.

We do not apply one common retention period to all cookies, analytics data and customer profiles.

Job applications

If you submit a job application, we process your contact details, application, CV and any other information you choose to provide.

Processing is based on Article 6(1)(b), concerning steps taken before entering into a possible contract, and Article 6(1)(f) where there is a legitimate interest in retaining necessary documentation of the recruitment process.

Applications relating to a completed recruitment process are generally retained for no more than six months after its conclusion, unless a specific need or legal obligation justifies otherwise. Retention for future vacancies requires a separate legal basis, such as your consent.

Your rights

Under data protection law, where the applicable conditions are met, you may have the right to:

Access your personal data.
Have inaccurate information corrected.
Have information erased.
Restrict processing.
Object to processing based on legitimate interests.
Receive or transfer information in a structured format.
Withdraw consent.

You can object at any time to processing for direct marketing, including profiling related to such marketing.

The right to erasure is not absolute. For example, we may be required to retain accounting records or information necessary for a specific legal claim.

Contact hello@berrydenmark.dk to exercise your rights. We may request information necessary to verify your identity.

We respond to requests without undue delay and generally within one month. If the deadline is lawfully extended, we will inform you within the first month.