Privacy Policy

## 1. Data Controller PriceFolk is the data controller responsible for processing your personal data. If you have questions about how we handle your data or wish to exercise your rights, you can contact us at: PriceFolk Email: GDPR@pricefolk.dk We are subject to Danish data protection law and supervised by Datatilsynet (the Danish Data Protection Agency). ## 2. Personal Data We Collect We collect and process the following categories of personal data: Account data: Your name and email address, collected during registration via our authentication provider Clerk. Profile data: Date of birth, gender, city, and country, which you provide voluntarily when completing your profile. Preference data: Product interests, price preferences, and category selections that you make while using the platform. Technical data: Locale preference and cookie consent choices, stored locally on your device. We collect personal data directly from you when you create an account, complete your profile, express interest in products, or adjust your settings. We do not collect data from third-party sources. ## 3. Purpose and Legal Basis for Processing We process your personal data for the following purposes, each with a specific legal basis under GDPR Article 6(1): Account creation and service delivery: We process your name, email, and profile data to provide you with access to the PriceFolk platform and its features. Legal basis: Performance of a contract (Art. 6(1)(b)). Anonymized demand aggregation: We anonymize and aggregate your product interests and price preferences to negotiate group deals with suppliers. When we approach suppliers, we share only aggregated, anonymized data such as "4,200 users want this product at an average price of DKK 2,500." Your name, email, or any personally identifiable information is never included in these negotiations. Legal basis: Legitimate interest (Art. 6(1)(f)). Our legitimate interest is to enable collective purchasing power for our users. Cookie and preference management: We store your cookie consent choices and language preference on your device to ensure the site functions correctly and respects your choices. Legal basis: Consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for strictly necessary cookies (Art. 6(1)(f)). Optional communications: If you opt in to receive deal alerts, newsletters, or community updates, we process your email address to send these communications. Legal basis: Consent (Art. 6(1)(a)). You can withdraw consent at any time from your profile settings. ## 4. Our Core Privacy Promise PriceFolk will never sell your individual personal data. This is a foundational principle of our platform. Our architecture is designed so that your personally identifiable information (name, email, account details) is kept separate from your behavioral and preference data (product interests, price preferences). When we negotiate with suppliers, only anonymized, aggregated data is used. No supplier, partner, or third party receives information that could identify you as an individual. ## 5. How We Anonymize Data Before any data is shared with suppliers for deal negotiation, we apply the following safeguards: Aggregation: Individual preferences are combined into group-level statistics (e.g., total demand count, average target price, geographic distribution by region). De-identification: All personal identifiers (name, email, user ID) are stripped from the data before it is used in any negotiation or shared externally. Minimum thresholds: We do not share aggregated data for product groups with fewer users than our minimum threshold, to prevent the possibility of re-identification. The result is that suppliers see market demand signals, not individual user profiles. ## 6. Data Recipients and Third-Party Processors We share personal data only with the following categories of recipients: Clerk (authentication provider): Clerk Inc. processes your name, email, and authentication credentials to manage your account login. Clerk acts as a data processor on our behalf. For more information, see Clerk's privacy policy at clerk.com/legal/privacy. Hosting provider: Our application database is hosted on servers within the European Union. The hosting provider processes data solely on our instructions and under a data processing agreement. Suppliers and partners: Receive only anonymized, aggregated data as described in sections 4 and 5 above. They never receive personal data. We do not sell, rent, or otherwise share your personal data with advertisers, data brokers, or any other third parties. ## 7. International Data Transfers Your primary account data (product interests, profile information, preferences) is stored on servers located within the European Union. Clerk, our authentication provider, is based in the United States. Clerk is certified under the EU-US Data Privacy Framework (DPF), which the European Commission has recognized as providing an adequate level of data protection (adequacy decision of 10 July 2023). This means Clerk's processing of your authentication data (name, email, login credentials) in the United States is covered by appropriate safeguards under GDPR Article 46. If we introduce any additional international transfers in the future, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) and update this policy accordingly. ## 8. Data Retention We retain your personal data for as long as your account is active and you continue to use the PriceFolk platform. Account and profile data: Retained until you delete your account. Upon account deletion, your personal data is permanently removed from our systems within 30 days. Anonymized aggregated data: Because this data cannot be linked back to you, it may be retained indefinitely for statistical and negotiation purposes. Cookie data: Cookie consent preferences (pf-consent) and locale preferences (pf-locale) are stored on your device for up to 1 year. Authentication session cookies expire at the end of your browser session. Communication preferences: Retained until you withdraw consent or delete your account. If we are required by law to retain certain data for a longer period (e.g., for tax or legal compliance), we will do so only for the minimum period required. ## 9. Your Rights Under GDPR As a data subject, you have the following rights under GDPR Articles 15 through 22: Right of access (Art. 15): You can request a copy of the personal data we hold about you. You can view most of your data directly in your profile settings. Right to rectification (Art. 16): You can correct inaccurate personal data at any time through your profile settings, or by contacting us. Right to erasure (Art. 17): You can delete your account and all associated personal data through the "Privacy & Data" section in your profile settings. You can also contact us to request deletion. Right to restriction of processing (Art. 18): You can request that we restrict the processing of your data in certain circumstances. Right to data portability (Art. 20): You can request your personal data in a structured, commonly used, and machine-readable format. Right to object (Art. 21): You can object to processing based on our legitimate interests. If you object, we will cease processing unless we have compelling legitimate grounds. Rights related to automated decision-making (Art. 22): PriceFolk does not use automated decision-making or profiling that produces legal or similarly significant effects on you. Our aggregation process is used solely for collective negotiation and does not result in individual decisions about you. To exercise any of these rights, contact us at GDPR@pricefolk.dk. We will respond to your request within 30 days. If your request is complex, we may extend this period by up to two additional months, in which case we will inform you of the extension. ## 10. Right to Lodge a Complaint If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Danish Data Protection Agency: Datatilsynet Carl Jacobsens Vej 35 2500 Valby, Denmark Email: dt@datatilsynet.dk Website: datatilsynet.dk You also have the right to lodge a complaint with the supervisory authority in the EU/EEA member state where you reside or work. ## 11. Cookies We use a limited number of cookies, primarily for authentication and essential site functionality. We do not currently use analytics or marketing cookies. For a complete list of cookies, their purposes, and how to manage them, please see our Cookie Policy at pricefolk.dk/cookie-policy. You can manage your cookie preferences at any time by clicking "Cookie Settings" in the footer of our website. ## 12. Data Security We implement appropriate technical and organizational measures to protect your personal data, including: Encrypted data transmission (HTTPS/TLS) for all connections to our platform. Authentication managed by Clerk, an industry-standard identity provider with robust security practices. Architectural separation of personally identifiable information from behavioral/preference data. Access controls limiting who within PriceFolk can access personal data, on a need-to-know basis. Regular review of our security practices and data processing procedures. No security measure is absolute. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR Articles 33 and 34. ## 13. Children's Data PriceFolk is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at GDPR@pricefolk.dk. ## 14. Changes to This Policy We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will: Post the updated policy on this page with a new "Last updated" date. Notify you through the platform (e.g., a banner or notification) if the changes are significant. We encourage you to review this policy periodically. Your continued use of PriceFolk after changes are posted constitutes your acknowledgment of the updated policy. ## 15. Contact For any questions, concerns, or requests related to this privacy policy or your personal data, please contact us at: PriceFolk Email: GDPR@pricefolk.dk We aim to respond to all inquiries within 30 days.