Privacy Policy

Turban I/S (CVR: 46032764) is the data controller responsible for your personal data. Our registered address is C/O Dea Natasja Rosenmeier, Nørrebrogade 104 A, 2., 2200 København N, Denmark. For questions regarding data processing, contact us at [email protected].

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven). Our legal bases for processing include:

• Contract performance — processing necessary to fulfil your booking and provide our services (Art. 6(1)(b) GDPR).
• Legitimate interest — improving our services, preventing fraud, and maintaining security (Art. 6(1)(f) GDPR).
• Consent — marketing communications and non-essential cookies, where you have given explicit consent (Art. 6(1)(a) GDPR).
• Legal obligation — tax and accounting requirements under Danish law (Art. 6(1)(c) GDPR).

• Processing and confirming bookings
• Sending booking confirmations and reminders
• Managing cancellations and refunds
• Responding to your enquiries
• Sending newsletters and marketing (only with your consent)
• Improving our website and services
• Complying with legal and accounting obligations

We share your data with the following categories of third-party processors, all of whom are bound by data processing agreements:

• Frisbii / Flatpay — payment processing (PCI DSS compliant)
• Hosting provider — website and database hosting within the EU/EEA
• Email service provider — transactional and marketing emails

We do not sell your personal data to third parties.

• Booking data — retained for up to 5 years after the booking date, as required by Danish accounting law (Bogføringsloven).
• Account data — retained for as long as your account is active. You may request deletion at any time.
• Contact form data — retained for up to 12 months after your enquiry is resolved.
• Newsletter data — retained until you unsubscribe.
• Analytics data — retained for up to 26 months in anonymised form.

As a data subject, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data, subject to legal retention requirements.
• Right to restriction — request that we limit processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, commonly used format.
• Right to object — object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent — withdraw previously given consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or alteration. These include encrypted connections (HTTPS/TLS), hashed passwords, access controls, and regular security reviews.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
www.datatilsynet.dk

We may update this Privacy Policy from time to time. Material changes will be communicated via our website. The date at the top of this page indicates when this policy was last revised.