Last updated: 29 September 2026. Here you can read how Villa Bianca processes information about visitors, customers, delivery recipients and contact persons. You can contact us about your information on info@villabianca.dk.
Data Controller
The data controller for the webshop is Villa Bianca ApS, CVR 46656970, address Stockholmsgade 34, 8200 Aarhus N. Contact: info@villabianca.dk, phone +45 52409701.
What data do we process?
We process name, address, e-mail, telephone number, order and delivery information, payment status and relevant customer service correspondence. When visiting, we also process IP address, technical information and cookie choices. When consenting to analysis, information about the use of the site, device and purchases is processed. When signing up for newsletters, e-mail, possibly name, and registration and consent information are processed. The regular order form does not ask for a civil registration number or date of birth. The age verification takes place at the payment provider as described below.
Why do we use the information?
Purchase and customer account: We use contact, order, payment and delivery information to complete your order, handle payment and refunds and help you with your agreement. If you create an account, we also use your account information for login and order history. The basis is GDPR Article 6(1)(b) on the performance of the agreement with you.
Bookkeeping and statutory documentation: Necessary invoice, order and payment information is processed in accordance with Article 6(1)(c) in order to comply with the Bookkeeping Act and relevant VAT and tax rules. Statutory handling of consumer rights is based on the same provision in conjunction with the Sale of Goods Act and the Consumer Contracts Act.
Enquiries and contact persons: General questions and contact with a company's employees are handled in accordance with Article 6(1)(f). Our legitimate interest is to respond to inquiries and administer the specific business relationship. In the event of specific disputes, we process necessary documentation in accordance with the same provision in order to establish, exercise or defend legal claims.
Security and operation: IP address and technical logs are used for troubleshooting, stable operation and prevention and investigation of misuse. The basis is Article 6(1)(f) and our legitimate interest in protecting the webshop, customers and transactions.
Newsletters and analytics: Newsletters and consent-based analytics are processed in accordance with Article 6(1)(a). The newsletter contains news, inspiration and offers from Villa Bianca. The analysis is used to understand visits, product interest and purchase progress. Google Signals may be included when you also provide the separate marketing consent. Proof of consent is processed to document the consent given, cf. Article 6(1)(c) in conjunction with Article 7(1).
Necessary and voluntary information
Fields marked as mandatory at the time of ordering are necessary to process the selected order, payment and delivery. Without the necessary information, we cannot complete the purchase or the selected delivery. Optional fields are marked as optional. Newsletter sign-up and consent to optional cookies are not a condition for purchasing from us.
Age verification when buying wine
When buying wine, the buyer must be at least 18 years old. We send the order's age requirement to PensoPay, which carries out the age verification during the payment process. The verification is based on Article 6(1)(c) in conjunction with the rules on age verification for distance selling in the Act on the Prohibition of the Sale of Tobacco and Alcohol to Persons Under 18 Years of Age. The webshop registers the age requirement on the order and the payment status. The identity check takes place in the provider's solution, not by entering the CPR number in our order form. See PensoPay's description of the age verification.
The age and payment control has automatic steps. If the age requirement cannot be confirmed, the purchase of wine cannot be completed during the payment process. If you believe that an error has occurred, you can contact us to have the matter investigated by a person and present your comments. Such an investigation does not remove the statutory age requirement.
When information comes from others
If a buyer specifies you as the delivery recipient, we receive your name, delivery address and any contact details from the buyer. We use them for delivery and contact about the shipment. The basis is Article 6(1)(f) and our legitimate interest in delivering the ordered goods to the specified recipient. Similarly, for contact persons at business customers, the information may come from the employer or a colleague.
We also receive payment status and transaction references from the payment provider as well as delivery status from the shipping providers. The information is used for the order, delivery and accounting purposes described above on the basis stated. You can contact us to find out the specific source of information about you.
Recipients and data processors
We use the following suppliers and recipient categories for the purposes described: Hetzner Online GmbH for hosting the webshop and database; PensoPay and Clearhaus for payment and transaction information; PensoPay for age verification; Shipmondo and the carrier you choose when ordering for name, address, contact and shipping information; Dinero for invoice, order and accounting information; Microsoft 365 for email and customer correspondence; Microsoft Azure Translator for translation of website text; MailPoet for newsletter subscriptions; CookieYes for cookie selection; and Google for consent-based analysis of visits and purchases. Hosting, mail, accounting and other operating providers process information on our behalf in their function as data processors. Payment, identity and transport companies may also process information as independent data controllers for their own legal obligations and services. We also disclose information to authorities when required by law.
International suppliers and transfers
We use Google for analytics and Microsoft 365 for email and customer correspondence, as well as Azure Translator for translation of website text. The suppliers' processing and support may include transfer to countries outside the EU/EEA, including the USA. The transfer grounds below are separate from the grounds for the processing itself, which are described above.
Google, including Google LLC in the US: According to Google's published terms for analytics and advertising services, data is transferred from the EU/EEA to Google LLC in the US on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework, cf. GDPR Article 45. Google states that Google LLC and its US subsidiaries are certified. The decision applies only to the recipients and data covered by the certification, and is not a general approval of all transfers to the US. See Google's transfer basis and link to the certification.
Microsoft 365 and Azure, including Microsoft Corporation in the United States: Microsoft's published terms for its online services set out the European Commission's Standard Contractual Clauses (SCCs) as the basis for transfers that require safeguards under GDPR Article 46(2)(c). The provisions are part of Microsoft's Data Protection Addendum and set out the recipient's obligations and your rights. Microsoft is also DPF certified, but states that the certification is not used as a portability basis for these services. Storage in the EU does not in itself exclude access from support personnel outside the EU/EEA. See Microsoft's description of the portability basis and the data protection addendum with the guarantees.
Other countries and onward transfers: Google describes the use of adequacy decisions under Article 45 and, where a transfer is not covered by such a decision, Standard Contractual Clauses under Article 46. Microsoft's contractual guarantees also cover relevant onward transfers to sub-processors. This does not mean that all suppliers' processing countries have an adequacy decision. See also Google's sub-processors. CookieYes is used locally for cookie selection and is not connected to a CookieYes cloud account.
You can read the warranties and transfer terms in the Google Data Processing Terms, Microsoft's Standard Contractual Clauses Information. Please contact info@villabianca.dk for information on specific recipients and a copy of the relevant warranties.
Storage
Accounting records: Necessary personal data in the accounting records is stored for five years from the end of the financial year to which the material relates, according to the Bookkeeping Act. This does not mean that all information about you must be stored for five years.
Orders, returns and complaints: Information outside the accounting records is stored while the order or case is being handled, and to the extent that it is necessary as documentation within the relevant complaint or limitation period. In the event of a specific dispute, the time of the final conclusion of the case is also included in the assessment.
Account and general enquiries: Account information is used while the account exists. You can request that the account be deleted. Order and accounting material are assessed separately. In the case of enquiries unrelated to an order, the criteria are whether the question has been answered, whether follow-up has still been agreed and whether the correspondence is necessary in a specific case.
Newsletter: Information is used for mailing until you unsubscribe. Limited documentation of consent, unsubscribing and previous mailings can be retained for documentation of legality and handling specific complaints or legal claims. Unsubscribing means that the mailings cease, not that all information is immediately deleted.
Technical information and consent choices: The storage is assessed based on the need for troubleshooting, investigation of specific security incidents and documentation of choices. Cookie lifespan and storage of information with an analysis service are not the same. You can contact us about the specific storage of information about you.
Information is deleted or anonymized when the relevant purpose and any statutory documentation needs have ceased.
Newsletter
Newsletters are only sent if you have given a separate consent. We use MailPoet to manage registrations. You can always unsubscribe via the link in the email or by contacting us.
Cookies and tracking
See our cookie policy and cookie settings. Google Analytics is loaded after your consent for statistics. Google Signals also requires consent for marketing. You can change or withdraw the consent at any time via the cookie settings. This does not change the lawfulness of the processing that has already taken place on the basis of the consent. Newsletters are unsubscribed via the link in the email or by contacting us.
Overall traffic statistics without cookies
We also count views of public pages directly on our own server to see which pages are being used. This counter does not use cookies, local storage or fingerprinting of your device. The statistics only store the date, the path of the page and a total number of views. It does not store IP addresses, visitor IDs, information about your browser or referring website. Search texts and other parameters in the URL are omitted. The information is used for our own overview and is not sent to Google Analytics.
The statistics show page views, not unique people, and are not linked to customers or orders. It is separate from the technical operational and security logs mentioned above.
Your rights
Insight and correction: You can gain insight into information about you and have incorrect information corrected.
Deletion and restriction: Under the terms of the GDPR, you can have information deleted or the processing restricted. Deletion does not apply unconditionally, e.g. when information is to be retained under the Bookkeeping Act or is necessary in a specific legal case.
Data portability: In the case of automated processing based on consent or agreement, you may, under the terms of the rules, receive the information you have provided to us in a structured, commonly used and machine-readable format and have it transmitted to another data controller.
Objection: Due to your particular situation, you can object to processing based on our legitimate interests. We will then assess whether the processing should cease. You can always object to direct marketing, including associated profiling; the information may then not be used for this purpose.
Contact info@villabianca.dk to exercise your rights. We will respond without undue delay and no later than one month after receipt. If the complexity or number of requests makes it necessary, the deadline can be extended by up to two months. You will then be notified and a reason before the end of the first month. This is generally free of charge. In case of reasonable doubt about the identity, we may ask for the additional information necessary to verify it.
If we are unable to comply with your request, we will explain why and inform you of the possibility of appealing and bringing the matter before the courts.
Changes in treatment
If we want to use your information for a new purpose, we will provide you with information about the purpose and the relevant basis before the new processing begins. Significant changes will be notified in a manner that is relevant to the affected individuals.
Appeal
You can complain to the Danish Data Protection Agency if you believe that we are processing your personal data in violation of the rules. You do not need to contact us first to be able to complain.
Ad and campaign measurement from 30 September 2026
After your consent to statistics, we store campaign codes (source, media, campaign and content) in the cookie vb_mkt_attribution for up to 30 days and associate them with any order. WooCommerce's sbjs_ cookies describe referral and session. They are only activated with statistics consent.
Following a separate, current consent for marketing, we use the Meta Pixel and Conversions API to measure visits, product views, cart, checkout and purchases, and assess the effectiveness of our ads on Instagram. Meta Platforms Ireland Limited receives event information, product ID, amount and currency, and browser/click identifiers (_fbp and _fbc). Pixel calls also include technical browser information and IP address. Meta may associate the information with your Meta account. From 4 October 2026, we will also use automatic advanced email matching following a new, current marketing consent. Meta Pixel can read email as you enter it into the online store and converts it into a hash before being uploaded to Meta. The hash is a pseudonym and can be used by Meta to link events to your Meta account. This setup only selects email for advanced matching; name, phone, address, date of birth and payment information are not selected. We do not upload customer lists. Purchases via the Conversions API continue to use only the separately accepted browser/click identifiers as well as products and purchase value. Hashing does not make the information anonymous.
Meta cookies usually have a lifespan of up to 90 days. The cookie vb_meta_notice document for up to one year that your choice has been made based on this information. Thank you page purchase events may be briefly in a technical queue; they are removed after successful transfer and no later than seven days. If you reject or withdraw marketing consent, new pixel events will be stopped and these marketing cookies will be removed. Information already collected may continue to be processed by Meta on its terms. You can change your choice at any time in the cookie settings.
The basis for this tracking and disclosure is GDPR Article 6(1)(a). Meta processes data in accordance with Meta's Privacy Policy and Business Tools Terms. Data may be processed outside the EU/EEA; read Meta's information on international transfers and guarantees. You can contact us for more information and use the rights described in the Privacy Policy.
We also calculate the total order value and repurchases internally based on the order history. Matching takes place by email or customer account, and the dashboard only receives total figures without customer identity. The purpose is to understand the store's sales and profitability; the basis is our legitimate interest according to Article 6(1)(f). The numbers are not used for automated decisions about you or to send marketing without separate consent. You can object by contacting info@villabianca.dk.