Privacy Policy

Last Updated: October 12, 2026

This Privacy Policy describes how personal information is collected, used, stored, shared, and protected when individuals visit https://kobca.shop, place orders, communicate with customer support, or interact with services made available through the website.

We recognize the importance of protecting personal information and maintaining transparency about our data handling practices.

Personal data is processed in accordance with applicable privacy and data protection legislation, including the General Data Protection Regulation (GDPR) where applicable.

This policy also explains the rights available to individuals regarding their personal information and the procedures for submitting privacy-related requests.

1. Data Controller and Scope

For the purposes of this Privacy Policy, the business responsible for determining the purposes and means of processing personal information is:

Legal Entity: SANFLEX SLIBEMATERIALER ApS
Registration Number (CVR): 78117028
Registered Address: Arnold Nielsens Boulevard 66A, 2650 Hvidovre, Denmark
Website: https://kobca.shop
Privacy Contact: adinagrumblesop588@gmail.com

This policy applies to personal information processed in connection with website browsing, purchases, order fulfillment, payment coordination, customer communications, returns, refunds, and other related services.

Where another organization independently determines how and why personal information is processed, that organization may act as a separate data controller under applicable law.

2. Categories of Personal Information

We may process different categories of personal information depending on how customers interact with our website and services.

Information provided directly by customers

When placing an order, submitting a request, or contacting customer support, the information provided may include:

• Full name and contact details.

• Email address and telephone number.

• Billing and delivery addresses.

• Products purchased and order references.

• Purchase amounts and transaction details.

• Delivery preferences and fulfillment information.

• Return, exchange, cancellation, and refund records.

• Customer service messages and related correspondence.

• Other information voluntarily submitted through the website.

Technical and browsing information

When individuals access the website, certain technical information may be processed, including:

• Internet Protocol (IP) address.

• Browser and device information.

• Operating system and language preferences.

• Website access dates and times.

• Pages viewed and navigation activity.

• Referring websites and traffic sources.

• Security and diagnostic records.

• Cookie identifiers and similar online technologies, where permitted.

Payment information

Payments may be facilitated through external payment processing providers.

The relevant provider may collect and process payment details required to authorize and complete a transaction.

We may receive limited transaction information, such as payment confirmation, transaction references, payment status, and details needed for refunds or accounting.

Complete payment card information is handled according to the systems and practices of the applicable payment provider.

3. Purposes of Personal Data Processing

Personal information is processed for legitimate and clearly defined purposes connected with website operations and customer services.

Order administration and fulfillment

We use necessary information to receive purchases, confirm order details, coordinate payments, arrange shipments, provide delivery updates, and maintain records of completed transactions.

Customer support and after-sales assistance

Information may be used to respond to inquiries, investigate order concerns, manage cancellations, process returns or refunds, and resolve customer service issues.

Website functionality and security

Technical data may be processed to maintain website availability, diagnose errors, manage system performance, identify suspicious activity, and protect against unauthorized access or fraudulent transactions.

Service improvement

Where legally permitted, information about website performance and visitor interaction may be analyzed to improve navigation, product information, accessibility, and the overall shopping experience.

Marketing communications

Where required by law, promotional emails and other marketing communications will only be sent after obtaining the necessary consent.

Individuals may withdraw marketing consent or unsubscribe from promotional communications at any time.

Legal and regulatory compliance

Certain information must be processed or retained to meet accounting, taxation, consumer protection, financial reporting, or other legal obligations.

4. Legal Grounds for Processing

Where the GDPR applies, each relevant processing activity must be supported by an appropriate legal basis.

The applicable bases may include:

Processing activity	Legal basis
Processing purchases, delivery arrangements, and contractual customer services	Performance of a contract
Maintaining tax, accounting, and legally required business records	Compliance with a legal obligation
Protecting the website, preventing fraud, and managing appropriate operational risks	Legitimate interests, where applicable
Sending promotional communications where consent is required	Consent
Using non-essential analytics or advertising technologies where consent is required	Consent

Where processing relies on legitimate interests, we consider the necessity of the activity and its potential impact on the rights and freedoms of affected individuals.

Where consent is the applicable legal basis, individuals may withdraw that consent without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies and Online Tracking Technologies

Cookies and similar technologies may be used to operate website features, maintain shopping sessions, remember preferences, and support website performance.

Depending on the website's actual configuration, these technologies may be classified as follows.

Strictly necessary technologies

These support essential operations such as shopping cart functionality, checkout processes, security, and session management.

Functional technologies

These may remember selected preferences, including language settings and other website choices.

Analytics technologies

Where enabled, analytics tools may help identify website performance issues, understand aggregated visitor activity, and evaluate improvements.

Advertising technologies

Where enabled, advertising technologies may measure campaign performance, track eligible conversions, or support personalized advertising in accordance with applicable consent requirements.

Non-essential technologies requiring consent will not be activated before valid consent has been obtained.

Where an applicable consent interface is available, visitors may accept, reject, or adjust non-essential cookie preferences.

Browser settings may also allow users to delete or restrict certain cookies, although disabling essential technologies may affect website functionality.

6. Payment Processing and Transaction Security

When customers choose a payment method offered at checkout, the relevant information is processed to complete the transaction and maintain appropriate payment records.

External payment providers may independently process personal information for payment authorization, fraud detection, regulatory compliance, and transaction management.

Customers should consult the applicable payment provider's privacy information for details of its independent processing activities.

Personal information collected directly through the website must be transmitted using appropriate security protections.

Payment and transaction information will not be used for unrelated purposes without an appropriate legal basis.

7. Sharing Information with Service Providers

Providing online shopping services may require limited disclosure of relevant personal information to external service providers.

Such recipients may include:

• Payment processors and financial service providers.

• Delivery companies and logistics operators.

• Website infrastructure and hosting providers.

• Technical maintenance and security service providers.

• Customer communications and support systems.

• Analytics and advertising providers, where applicable.

• Professional advisers and compliance service providers.

Personal information should be shared only where necessary for an identified purpose and subject to applicable legal requirements.

Where service providers process information on our behalf, appropriate contractual and organizational safeguards will be used as required by data protection law.

We do not sell customer contact information as a standalone commercial product.

Information may also be disclosed to public authorities, courts, or regulators where required by valid legal obligations.

8. Analytics, Advertising and Google-Related Services

The website may use analytics, advertising measurement, or other third-party technologies where such services are actually enabled.

If Google Analytics, Google Ads, or related Google services are used, certain device information, browsing interactions, and online identifiers may be processed according to the specific configuration of those services.

Possible purposes include website traffic measurement, conversion reporting, technical analysis, and advertising performance evaluation.

Where required by European privacy and electronic communications laws, non-essential tracking technologies will only operate after appropriate user consent has been obtained.

Information about Google's handling of data when its services are used by websites and applications is available at:

https://policies.google.com/technologies/partner-sites

Visitors may also consult:

https://policies.google.com/privacy

The use of any advertising or analytics technology must reflect the actual tools installed on the website and the consent choices made by users.

9. International Transfers of Personal Information

Some technical, payment, logistics, or customer service providers may operate internationally.

As a result, personal information may be processed or accessed outside the country in which the customer resides.

When personal data protected by the GDPR is transferred outside the European Economic Area to a destination without an applicable adequacy decision, an appropriate transfer mechanism will be used where legally required.

Such mechanisms may include the European Commission's Standard Contractual Clauses, together with supplementary protections where necessary.

Information about applicable transfer safeguards may be requested through our privacy contact email.

10. Data Storage and Retention

Personal information is retained only for periods justified by the purposes for which it was collected or by applicable legal requirements.

Retention periods vary according to the category of information and its processing purpose.

Order and transaction records may need to be retained for accounting, taxation, consumer protection, or dispute resolution purposes.

Customer support information may be kept for the period reasonably necessary to resolve the relevant request and maintain required records.

Technical and security records may be retained for periods necessary to maintain security and investigate incidents.

Marketing information processed on the basis of consent will be reviewed when consent is withdrawn, subject to any legitimate need to retain limited suppression records.

When personal information is no longer required, it will be deleted, anonymized, or otherwise handled in accordance with applicable law.

Specific retention periods or the criteria used to determine them may be provided upon request where required by law.

11. Protection of Personal Information

We recognize the importance of maintaining appropriate safeguards against unauthorized access, accidental loss, unlawful disclosure, alteration, and misuse of personal data.

Depending on the applicable systems and risks, safeguards may include:

• Secure transmission protocols.

• Restricted access to business information.

• Appropriate authentication procedures.

• Technical monitoring and maintenance.

• Security updates and vulnerability management.

• Data backup and recovery arrangements.

• Controls governing access by relevant service providers.

• Procedures for reviewing and responding to security incidents.

Security arrangements must be proportionate to the sensitivity of the information and the risks associated with its processing.

No online system can provide an absolute guarantee against every possible security risk.

If you suspect that personal information has been compromised, please contact us using the details provided below.

12. Individual Privacy Rights

Individuals whose personal information is protected under the GDPR may exercise the following rights, subject to applicable legal conditions and exceptions.

Right of access

Request confirmation of whether personal information is being processed and obtain access to relevant information.

Right to rectification

Request correction of inaccurate personal information or completion of incomplete records.

Right to erasure

Request deletion of personal data where a recognized legal ground for erasure applies.

Right to restriction

Request limits on certain processing activities in circumstances recognized by law.

Right to data portability

Where applicable, receive personal information in a structured, commonly used, machine-readable format or request its transmission to another controller.

Right to object

Object to processing based on legitimate interests in circumstances provided by law.

Individuals also have the right to object to processing of their personal information for direct marketing purposes.

Right to withdraw consent

Withdraw previously provided consent at any time when consent is the legal basis for processing.

Rights relating to automated decision-making

Where applicable, individuals have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

To submit a privacy request, contact:

adinagrumblesop588@gmail.com

We may request information reasonably necessary to verify the identity of the requester before disclosing or modifying protected personal information.

Under the GDPR, requests will normally be addressed within one month of receipt. Where legally permitted due to complexity or the number of requests, this period may be extended by up to two additional months, with notice provided within the initial month.

13. Complaints and Supervisory Authorities

Individuals who believe their personal information has been processed unlawfully may contact us to raise their concerns.

They may also have the right to lodge a complaint with a competent data protection supervisory authority.

For processing supervised in Denmark, the relevant authority is:

Datatilsynet — Danish Data Protection Agency

Website: https://www.datatilsynet.dk

Individuals in the European Economic Area may also have the right to contact the supervisory authority in the country of their habitual residence, place of work, or the location of the alleged infringement.

Contacting us first is encouraged but is not a mandatory prerequisite to exercising the right to lodge a complaint.

14. Privacy of Children

This website is intended for individuals who are legally permitted to make purchases and enter into relevant transactions.

We do not intentionally seek to collect personal information from children in circumstances where such collection would be unlawful.

Where parental consent or another authorization is legally necessary, the relevant requirements must be satisfied before processing takes place.

If a parent or guardian believes that a child's personal information has been collected inappropriately, they may contact:

adinagrumblesop588@gmail.com

We will review the concern and take action consistent with applicable law.

15. External Websites and Independent Services

The website may contain links to external websites, payment systems, or other independently operated services.

The privacy practices of these external services may differ from those described in this policy.

When individuals leave our website and interact directly with an independent third-party service, that service's own privacy terms may apply.

We encourage visitors to review the relevant privacy notices before submitting personal information to external providers.

16. Personal Data Breaches

If a personal data security incident occurs, appropriate steps will be taken to investigate, contain, and address the issue.

Where required by the GDPR, a reportable personal data breach will be notified to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will also be informed without undue delay unless a lawful exception applies.

The specific response will depend on the nature, severity, and circumstances of the incident.

17. Changes to This Policy

This Privacy Policy may be updated when changes occur in applicable legislation, operational processes, website functionality, service providers, or personal data processing activities.

Any revised version will be published on this website together with an updated revision date.

Where changes require additional consent or direct notice under applicable law, appropriate steps will be taken before the affected processing begins.

We encourage visitors to consult this page periodically for current information about our privacy practices.

18. Privacy Inquiries and Business Contact Details

For requests relating to personal information, privacy rights, cookies, website data handling, or this Privacy Policy, please use the contact details below.

Legal Business Name: SANFLEX SLIBEMATERIALER ApS

Company Registration Number: 78117028

Registered Business Address: Arnold Nielsens Boulevard 66A, 2650 Hvidovre, Denmark

Website: https://kobca.shop

Email: adinagrumblesop588@gmail.com

We will review privacy-related communications and respond in accordance with applicable data protection laws.

This Privacy Policy applies to personal information processed through the website and associated customer services. Mandatory rights and protections provided by applicable law remain unaffected.