Privacy policy

Privacy and Cookie Policy

Last updated: 23 July 2026

This policy explains how CollexyLux collects, uses, shares, stores and protects personal data when you visit collexylux.dk, use our customer account, make a purchase, subscribe to marketing or contact us.

The policy also explains our use of cookies and similar technologies. The current technical overview of the specific cookies and technologies is available in our Cookie Statement, which is generated and updated through Pandectes.

Purchases and communication through Cardmarket are also subject to Cardmarket’s own privacy terms and the legal information on CollexyLux’s Cardmarket profile.

1. Data controller

The data controller for the processing described in this policy is:

Laursen Digital Ventures ApS
Registered secondary name: CollexyLux ApS
Danish company registration number (CVR): 41672935
VAT number: DK41672935
Nedertoften 29, ground floor right
2720 Vanløse
Denmark

Email: contact@collexylux.dk
Telephone: +45 60 55 66 40

In this policy, CollexyLux is used as the trading name of Laursen Digital Ventures ApS.

Pandectes is our technical provider of consent, cookie and privacy functionality. Our use of Pandectes does not change the fact that Laursen Digital Ventures ApS is the data controller for CollexyLux’s processing.

2. What personal data do we process?

Depending on your interaction with CollexyLux, we may process the following categories of personal data:

  • name, delivery address, billing address and country,
  • email address and telephone number,
  • customer account, login and profile information,
  • order, product, price, discount, payment and transaction information,
  • selected delivery method, tracking information and delivery status,
  • written delivery instructions and delivery documentation, including any photograph of the parcel and the delivery location when Premium Delivery is completed without personal receipt,
  • information about withdrawal, returns, refunds and claims concerning defective or non-conforming goods,
  • correspondence by email, contact form, customer account or customer service,
  • consents, cookie preferences and marketing choices,
  • IP address, browser, device, operating system and technical identifiers,
  • information about pages visited, searches, cart activity, checkout and interaction with the online store,
  • information required for accounting, VAT, tax, documentation and the establishment, exercise or defence of legal claims.

CollexyLux does not receive your full payment card details. Card and payment information is processed by Shopify and the payment provider used for the relevant payment.

3. Where does the information come from?

We primarily receive information:

  • directly from you when you visit the online store, place an order, create an account, subscribe, contact us or provide written delivery instructions,
  • from CollexyLux when we document a Premium Delivery with a limited photograph of the parcel and the agreed delivery location,
  • from Shopify, Shopify Payments, Shop Pay, MobilePay/Vipps or another selected payment provider,
  • from the carrier used for your order, such as DAO or GLS,
  • from Pandectes in connection with consent, cookie preferences and privacy requests,
  • from Klaviyo in connection with subscriptions and email marketing,
  • from Google and other analytics or marketing tools when the relevant processing is permitted,
  • from technical security, error-tracking and operational providers,
  • from public authorities or other parties where relevant and lawful.

4. Purposes and legal bases for processing

Performance of a contract

We process information under Article 6(1)(b) of the GDPR where necessary to:

  • receive, check and fulfil your order,
  • process payment and send order communications,
  • pack, dispatch, deliver or prepare the order for collection,
  • administer your customer account,
  • handle cancellation, withdrawal, returns, refunds and claims concerning defective or non-conforming goods,
  • answer questions about an order, delivery or product.
Legal obligation

We process information under Article 6(1)(c) of the GDPR where necessary to comply with, among other things:

  • accounting, tax and VAT rules,
  • consumer, product and e-commerce rules,
  • valid requirements from courts, police, tax authorities or other public authorities.
Legitimate interests

We may process information under Article 6(1)(f) of the GDPR where necessary for legitimate interests such as:

  • operating, securing, maintaining and troubleshooting the online store,
  • preventing fraud, misuse and unauthorised access,
  • documenting orders, customer service and the sequence of events,
  • documenting correct Premium Delivery, including the customer’s written delivery instruction and a limited documentary photograph,
  • preventing and handling delivery discrepancies, fraud, payment disputes and unjustified claims,
  • establishing, exercising or defending legal claims,
  • internal and aggregated analysis of sales, inventory, operations and customer service,
  • improving the online store, product range and user experience where the processing does not require consent.

Where processing is based on legitimate interests, we balance our interests against your rights and reasonable expectations.

Delivery documentation for Premium Delivery

If an order with a total value below DKK 1,000 after discounts and excluding delivery charges is left without personal receipt following the customer’s express written instruction, CollexyLux may take a documentary photograph of the parcel at the agreed delivery location.

The purpose is to document that the order was placed in accordance with the customer’s instruction and to handle questions, delivery discrepancies, payment disputes and legal claims. The processing is based on Article 6(1)(f) of the GDPR and our legitimate interest in secure delivery and documentation.

As far as possible, the photograph is limited to the parcel and the relevant delivery location. We aim to avoid capturing people, the interior of the home, nameplates and other unnecessary personal data.

Consent

We process information under Article 6(1)(a) of the GDPR where you have given consent, including for:

  • non-essential cookies, pixels and similar technologies,
  • statistics, personalisation and targeted marketing where consent is required,
  • email marketing and newsletters.

You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

5. Shopify and Shopify Network Intelligence

The online store is hosted and operated on Shopify. Shopify processes personal data when you visit the online store, use the customer account or checkout, and make a purchase.

In many contexts, Shopify acts as a processor for CollexyLux. For certain services and purposes, Shopify may also process information as an independent controller.

CollexyLux has enabled Shopify Network Intelligence. This means that Shopify may use customer data together with data from other Shopify merchants and Shopify to provide what Shopify calls Enhanced Services. These services may be used for purposes including:

  • a more personalised experience in the online store,
  • improving Shopify’s and the online store’s products and features,
  • analysing how customers interact with the online store and advertisements,
  • more relevant advertising and marketing where the required consent has been obtained.

Information about your activity may in this connection be shared with Shopify and relevant third parties, which may be established in other countries.

You can read more in Shopify’s Consumer Privacy Policy.

You can manage certain Shopify-related privacy choices, withdraw consent or object to Shopify’s processing through Shopify’s privacy portal.

6. Cookies and similar technologies

We use cookies, pixels, local storage, session storage and similar technologies in the online store, customer account and related Shopify features.

CollexyLux uses Pandectes GDPR Compliance as its consent management platform to:

  • display and manage the cookie banner,
  • record and document your cookie preferences,
  • communicate your consent choices to Shopify and integrated services,
  • block or allow relevant technologies in accordance with your choices,
  • display a dynamic Cookie Statement.
Essential technologies

Essential technologies are used for purposes such as security, customer login, cart, checkout, payment, language, currency, market selection and consent preferences. They may be used without consent where they are necessary to provide the service or function you have expressly requested.

Functional technologies

Functional technologies may remember choices and provide enhanced or personalised features that are not strictly necessary for the basic operation of the online store.

Analytics and performance

Analytics and performance technologies help us understand how the online store is used, measure traffic, identify technical errors and improve functionality and content.

Marketing and targeting

Marketing technologies may be used to measure campaigns, build audiences, limit the repetition of advertisements, and display or measure more relevant marketing.

Functional, analytics and marketing technologies are activated only in accordance with your choices where applicable rules require consent.

The current list of registered technologies, their purposes, providers, domains, types and retention periods is available in our Cookie Statement.

You can change or withdraw your consent at any time through Cookie Settings.

7. Marketing

We send electronic marketing only where we have a valid legal basis, such as your consent.

Klaviyo may be used for newsletters, subscription forms, segmentation and analysis of marketing communications. Depending on your consent, we may process information about matters such as subscription, delivery, opens, clicks and purchases in connection with relevant flows.

You can unsubscribe using the unsubscribe link in each email or by contacting us. A purchase does not automatically subscribe you to marketing.

8. Who do we share information with?

We share or provide access to personal data where necessary to the following categories of recipients:

  • Shopify, Shopify Payments, Shop Pay and other selected payment providers,
  • Pandectes as the provider of consent and privacy functionality,
  • Klaviyo and other approved communication or marketing providers,
  • Google and other analytics or advertising providers where the relevant processing is permitted,
  • the carrier used for the order, such as DAO or GLS,
  • hosting, security, error-tracking, email and IT providers,
  • bookkeepers, auditors and legal or technical advisers,
  • public authorities where disclosure is legally required or necessary.

Recipients receive only the information necessary for their relevant task.

Delivery photographs are not routinely disclosed. They may be shown to the customer or shared with a relevant payment provider, adviser, insurer or public authority where necessary to investigate or document a specific delivery discrepancy, payment dispute, suspected fraud or legal claim.

We do not sell personal data as a traditional commercial product. However, certain forms of data sharing and targeted advertising may be defined as “sale”, “sharing” or “targeted advertising” under some non-EU privacy laws. Where such rules apply, Shopify and Pandectes provide the relevant privacy choices.

9. Transfers outside the EU and EEA

Some of our providers and their subprocessors may process personal data outside the EU and EEA.

Where data is transferred to a country without an adequacy decision, a valid transfer mechanism is used, such as the European Commission’s Standard Contractual Clauses, together with relevant supplementary safeguards where required.

A stated hosting location in the EU does not necessarily mean that all processing by every provider takes place exclusively in the EU.

10. How long do we retain information?

We retain personal data only for as long as necessary for the purposes for which it was collected or for as long as we are legally required to do so.

  • Accounting and transaction records are generally retained for five years from the end of the relevant financial year.
  • Order, return, claim and customer service information is retained for as long as necessary to perform the contract, handle enquiries and document or defend legal claims.
  • Customer account information is retained while the account is active and afterwards to the extent that the information remains necessary or legally required.
  • Marketing information is retained until you unsubscribe, the consent ceases to apply or the information is no longer necessary. We may continue to retain limited documentation of consent and unsubscribing.
  • Cookie and consent logs are retained for as long as necessary to document your choices and comply with applicable rules.
  • Written delivery instructions and documentary photographs from Premium Delivery are generally retained for up to 180 days after delivery. If a complaint, payment dispute, fraud investigation or legal claim arises before that period expires, the material may be retained for longer for as long as necessary to handle and document the matter.

When information is no longer necessary, it is deleted or anonymised.

11. Your rights

Under data protection law, you have a number of rights in relation to our processing of information about you. Depending on the circumstances, you may have the right to:

  • receive information about our processing,
  • access the information we process about you,
  • have inaccurate or incomplete information corrected,
  • have information erased,
  • have processing restricted,
  • object to processing based on legitimate interests,
  • object to direct marketing,
  • receive certain information in a structured, commonly used and machine-readable format,
  • withdraw consent.

These rights are not absolute. For example, we may be required to retain certain order and accounting information even if you request erasure.

You can submit a request through our contact form or by emailing contact@collexylux.dk.

We may request the information necessary to verify your identity and protect the information against unauthorised disclosure.

Rights relating to Shopify’s own processing and Enhanced Services can also be managed through Shopify’s privacy portal.

12. Automated processing

CollexyLux does not itself make decisions that produce legal effects or similarly significantly affect you solely through automated processing.

Automated security, fraud or risk indicators may be used as support, but relevant decisions may be reviewed manually.

13. Security

We use appropriate technical and organisational security measures, including access restrictions, secure platforms, account controls and relevant procedures, to protect information against loss, misuse, unauthorised access, alteration or disclosure.

No electronic processing can be guaranteed to be entirely risk-free. In the event of a personal data breach, we follow the applicable rules on assessment, documentation and any required notification to the authority or communication to affected individuals.

14. Complaints to the Danish Data Protection Agency

Please contact us first if you have questions or are dissatisfied with our processing.

You also have the right to lodge a complaint with:

Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby
Denmark
Telephone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk

You may also contact the data protection authority in the EU or EEA country where you live or work.

15. Changes to this policy

We may update this policy when our processing activities, providers, features or applicable rules change.

The current version and update date are published on this page.

If you have questions about this policy, please contact us at contact@collexylux.dk.