Last updated: 3 November 2026
Privacy Policy – Mit Nissebrev
This page explains what personal data we process when you use mitnissebrev.dk, why we do it, and what rights you have. We have tried to keep it simple. Danish law and the EU General Data Protection Regulation (GDPR) apply.
In short:
- A parent (or other adult) always creates the profile – never the child.
- We only collect what is needed to make the calendar.
- Everything about your child is deleted automatically on 31 December, unless you actively choose "Keep profile".
- No chat, no ads, no selling of data.
- Newsletters only if you have said yes.
1. Controller
AKopensky & Co. (Danish sole proprietorship) CVR: 38205374 Address: Sluseholmen 37, 2450 København SV Email: kontakt@mitnissebrev.dk
We are the controller for the data described here.
2. What data, why, and on what legal basis
2.1 About you as a parent (customer)
| Data | Purpose | Legal basis |
|---|---|---|
| Email, language, PIN code (stored only hashed, i.e. one-way encrypted – we cannot see it) | Create and protect your profile, deliver the calendar, send the order confirmation and the Christmas Book | Performance of the contract with you – GDPR Art. 6(1)(b) |
| Order data (product, price, time, discount/gift/referral code, payment status) | Complete the purchase, handle refunds and complaints | GDPR Art. 6(1)(b) |
| The same order data | Meet bookkeeping obligations | Legal obligation – GDPR Art. 6(1)(c), Danish Bookkeeping Act (bogføringsloven) |
| Messages to us (email) | Answer you and solve problems | GDPR Art. 6(1)(b) and (f) (our interest in being able to help you) |
| Technical data (IP address, logs) | Security, troubleshooting and preventing misuse | Legitimate interest – GDPR Art. 6(1)(f) |
| Email for newsletters | Send offers and news | Your consent – GDPR Art. 6(1)(a) and section 10 of the Danish Marketing Practices Act (markedsføringsloven) |
2.2 About your child
| Data | Purpose | Legal basis |
|---|---|---|
| Child's first name, age group, name of teddy/nickname | Personalise the letters | Legitimate interest – GDPR Art. 6(1)(f): delivering the personal calendar you, as a parent, ordered for your family. We protect the child by collecting only what is necessary and deleting it on 31 December. |
| Child's replies (drawings and short texts) that you upload | Show the replies in the calendar and send them to you in the Christmas Book on 24 December | As above |
| The same data after 31 December | Keep the profile for next year if you choose "Keep profile" | Your separate consent – GDPR Art. 6(1)(a) |
Children do not create an account and do not give consent themselves. You as the parent decide what is entered. Please enter a first name only – not surname, address, photos of the child, or information about health, religion or similar. We never use your child's data for marketing, profiling or automated decisions.
2.3 Party Pack and Father Christmas visits (Denmark only)
| Data | Purpose | Legal basis |
|---|---|---|
| Name, phone, email, address, date and wishes; possibly children's first names and ages | Make an offer, plan and carry out the visit/party, invoice | GDPR Art. 6(1)(b) (and (f) for the children's first names) |
| Invoice | Bookkeeping | GDPR Art. 6(1)(c), Danish Bookkeeping Act |
2.4 Referral codes
When a new customer uses your referral code, we record which code was used on the order. We never email your friends and do not receive their contact details from you.
2.5 Cookies and statistics
Statistics are used only if you consent in the cookie banner. Read more in our cookie policy.
3. How long we keep data
| Data | Deleted |
|---|---|
| Your child's data and replies | Automatically on 31 December, unless you have chosen "Keep profile". If you withdraw consent, we delete them as soon as possible. Backups are overwritten within [30] days. |
| Your profile (email, language, PIN) | When you delete the profile. If you have not logged in for [24] months, we delete it. |
| Order and accounting data | 5 years from the end of the financial year they relate to (Danish Bookkeeping Act). |
| Party Pack/Father Christmas data (other than the invoice) | [30] days after the event. |
| Newsletter consent | Until you unsubscribe. Proof of consent is kept for [2] years after that. |
| Messages to us | [12] months after the matter is closed. |
| Logs | [30] days. |
The Christmas Book is sent to your own email. That copy is in your inbox and under your control – it is not deleted when we delete our data.
4. Who we share data with
We never sell data and do not share it with advertisers. We use these providers:
| Recipient | Role | Location |
|---|---|---|
| Vercel Inc. (hosting, EU-region Frankfurt), Neon (database, Frankfurt) og Cloudflare R2 (filer, EU) | Website and database hosting (processor) | EU |
| Resend (e-mail, EU-region Irland) | Sending emails (processor) | EU (Ireland/Germany) |
| Stripe Payments Europe Ltd. | Card and MobilePay payments. Stripe is our processor and an independent controller for e.g. fraud prevention and its own legal obligations | Ireland/EU; data may be transferred to the USA (see section 5) |
| Plausible Analytics (uden cookies) | Visitor statistics – only with consent | EU (Ireland/Germany) |
| [BOGFØRINGSSYSTEM / REVISOR] | Bookkeeping and accounts | EU |
| Vores eget CRM-system (hostet hos Vercel/Neon) | Customer service and order management (shared by our Danish and Swedish sites) | EU |
| Freelancers (DJ, photographer, Father Christmas) | Party Pack/Father Christmas visits only: they receive the data needed to do the job | Denmark |
| Authorities | Where required by law (e.g. the Danish Tax Agency) | Denmark |
We have data processing agreements with our processors.
5. Transfers outside the EU/EEA
We try to keep all data in the EU. If a provider (e.g. Stripe) transfers data to a country outside the EU/EEA, this only happens on a lawful basis, such as a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework) or the EU standard contractual clauses. Contact us to learn more.
6. Your rights
You have the right to:
- access the data we hold about you and your child,
- have incorrect data corrected,
- have data deleted,
- have processing restricted,
- object to processing based on legitimate interest,
- receive your data in a common format (data portability),
- withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
You can do many things yourself in your profile (e.g. delete your child's replies or the whole profile). Otherwise, email kontakt@mitnissebrev.dk. We reply within one month.
Some rights have exceptions – for example, we must keep accounting data for 5 years even if you ask for deletion.
7. Complaints to the Danish Data Protection Agency
You can complain about our processing of personal data to:
Datatilsynet (Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark – datatilsynet.dk, dt@datatilsynet.dk
If you live in another EU country, you can also complain to the data protection authority there.
8. Security
We use encrypted connections (HTTPS), store PIN codes hashed, give access only to those who need it, and choose providers with appropriate security. If we discover a security breach that puts you at risk, we will tell you.
9. About GDPR Article 8
Article 8 GDPR concerns children giving consent to online services themselves. With us, children do not create accounts or give consent. All agreements and consents are given by an adult.
10. Changes
If we change this policy significantly, we will say so on the website and – if you have a profile – by email.