General Privacy Policy of NORMAL

At Normal A/S (”NORMAL”) we give high priority to confidentiality and data safety. You can read more about how we process your personal data in this Privacy Policy.

Normal A/S, CVR no. 34883793, Godthåbsvej 41, DK-8660 Skanderborg, is the data controller for the processing of the personal data covered by this Privacy Policy.

1. WE PROCESS YOUR PERSONAL DATA
We process your personal data for different purposes which you can read more about in the following sections.

We will solely keep your personal data when and for as long as it is necessary to comply with the purposes for which it has been collected, or if necessary to comply with applicable law.

1.1. If you accept cookies on NORMAL’s website

Purpose and legal framework
In order to manage, develop and administrate our website(s), as well as secure relevant news and offers from us to you, we process personal data about you, if you consent to cookies.

You can read more about cookies in our cookie policy. Depending on which cookies you accept, we can process the following personal data about you:

General personal data such as e.g., IP address, the sites you visit and other digital footprints. Processing happens based on your consent, cf. GDPR art. 6 (1)(a).

Disclosure
To the extent that you consent to third-party cookies, we will disclose your personal data to these third parties. You can read more about third-party cookies in our cookie policy. In addition, we may disclose your personal data to relevant suppliers and partners, including e.g. software suppliers, marketing agencies and other data processors.

Deletion policy
The period during which we process your personal data for these purposes depends on which cookies you give consent to.

You may at any time change your consent settings or withdraw your consent and delete the cookies that you previously gave consent to, by following the instructions in our cookie policy.

However, do note that the withdrawal of your consent has no effect on the legitimacy of our processing of your personal data up until the time when you withdraw your consent.

1.2. When you sign up to our customer app

Purpose and legal framework
In order to create and manage your user in the customer app, we process the following personal data about you:

General personal data such as e.g. name, contact information, date of birth, sex, purchase history, which stores you have purchased from, receipts, debit card details and which competitions you have participated in. The processing is based on your consent and in order to safeguard yours and our interests in the use of our customer app, cf. GDPR art. 6 (1)(a) and (f).

In order to send you direct targeted marketing in the customer app and via newsletter or push messages and to ensure that you always receive the most relevant offers (profiling), we process the following information about you, when you consent to marketing:

General personal data, including your name and contact information, your preferences and purchase statistics. The processing is to safeguard you and our legitimate interest in always being able to target the best and most relevant offers and news to you, cf. GDPR art. 6, (1)(f).

Disclosure
To the extent necessary to provide our service to you, we may disclose your information to relevant suppliers and partners, including e.g. software suppliers, marketing agencies and other data processors.

Deletion policy
We process your personal data for as long as you are an active user of our customer app. You may delete your user profile at any time by following the instructions in our customer app.

You may decline profiling of your personal data at any time by unsubscribing from our newsletter, deleting the customer app or blocking push notifications. You can also always contact dataprivacy@normal.eu for help.

1.3. If you consent to NORMAL’s marketing

Purpose and legal framework
If you consent to receiving our newsletters, push notifications or other direct marketing, we process the following information about you in order to send marketing to you and always ensure that you receive the best and most relevant offers (profiling):

General information, including e.g. your name and email address. The processing takes place based on your consent to marketing cf. GDPR art. 6, (1) (a) and section 10 of the Danish Marketing Practices Act.

If you have consented to us sending you newsletters, we will process the following additional data about you, to target our marketing and improve our campaigns:

General data collected via “pixels” in our newsletters, including clicks on contents in the newsletter. In addition, we collect your geolocation and IP address to determine your geographic location. The processing is based on your consent to receiving newsletters from us, cf. GDPR art. 6 (1)(a).

A ”pixel” is a file in our newsletter which gives us access to collect data specifying which advertisements and articles you click in the newsletter. Your location can help us see which NORMAL stores are most relevant to you. The use of pixels and the collection of the said data is a prerequisite for receiving our newsletter. If you do not accept our processing of your personal data in this respect, it will not be possible for you to receive our newsletter.

Disclosure
To the extent necessary to provide our service to you, we may disclose your information to relevant suppliers and partners, including, for example, software suppliers, marketing agencies and other data processors.

Deletion policy
You may decline profiling of your personal data at any time for marketing and profiling purposes by withdrawing your consent to marketing. You may withdraw your consent by deleting our customer app, blocking push notifications and by following the "unsubscribe newsletter" instructions at the bottom of all our newsletters. You can also always contact dataprivacy@normal.eu for help.

However, do note that the withdrawal of your consent has no effect on the legitimacy of our processing of your personal data up until the time when you withdraw your consent.

1.4. When you shop in our NORMAL stores

Purpose and legal framework
When you shop in our stores with a debit card associated with your user in our customer app, we process the following personal data in order to provide the best service to you:

General personal data, including e.g. your purchase statistics and your receipts. The processing takes place in order to provide you with the best service and to ensure that you always receive the best offers and news if you consent to marketing (profiling), cf. GDPR Art. 6 (1) (f).

When you return or exchange goods you have purchased in a NORMAL store, we process the following information about you in order to comply with our legal obligations under the Danish Bookkeeping Act:

General personal data, including e.g. name, address and signature on the return receipt, cf. GDPR art. 6(1)(c).

Disclosure
To the extent necessary to provide our service to you, we may disclose your information to relevant suppliers and partners, including e.g. software suppliers, marketing agencies and other data processors.

Deletion policy
We process your personal data about purchases and receipts for as long as you have registered your debit card information in our customer app. You may delete your debit card information at any time by following the instructions in our customer app.

If you have returned goods that you have purchased in a NORMAL store, we will store your personal information on the return receipt for five (5) years after the purchase in order to comply with our obligations under the Danish Bookkeeping Act.

1.5. CCTV in our NORMAL stores
In order to prevent crime, we have CCTV installed in our stores. This means that we process the following personal data about you when you visit a NORMAL store:

General personal data, including video recordings of your behavior in the store and information about which purchases you make. The processing takes place to safeguard our and our customers' interests in ensuring that NORMAL's stores are a safe and secure place to stay, cf. GDPR art 6 (1)(f).
Information about criminal offences, including e.g. video recordings of shoplifting, violent behavior or the like. The processing takes place to safeguard our and public interests in crime prevention and possible investigations in accordance with national rules.

Disclosure
If we discover shoplifting or similar behavior that needs to be reported to the police, we will pass on relevant surveillance videos to the police. Such disclosure is made in order to safeguard our and public interests in crime prevention and possible prosecution in accordance with national rules in this regard.

Deletion policy
CCTV videos are stored for 30 days in accordance with national rules on CCTV, unless special circumstances mean that we may store the surveillance material for a longer period, in particular in connection with an investigation.

1.6. When you shop in our NORMAL web shop

Purpose and legal framework
When you shop in our web shop, we process the following personal data in order to be able to handle and administer your purchases and provide the best customer service to you:

General personal information, including e.g. which products you have purchased, payment information, name, address, delivery address, complaint and return cases, correspondence with our customer service. The processing takes place in order to fulfil an agreement with you and to safeguard your and our interests in providing you with the best possible service, cf. GDPR Art. 6 (1)(b) and (f).

If you consent to marketing, we process the following personal data about you in order to target the best and most relevant offers to you (profiling):

General personal information, including e.g. which products you have purchased. The processing takes place to safeguard your and our interests in ensuring that you always receive the best and most relevant news and offers, cf. GDPR Art. 6 (1)(f).

For the prevention and investigation of suspected fraud, we may process the following personal data about you:

General personal information, including e.g. when you make a purchase in our web shop or information about your purchases that we receive from our payment solution providers. The processing takes place to safeguard our interests in preventing and reducing fraud, cf. GDPR Art. 6 (1) (f).

Disclosure
To the extent necessary to provide our service to you, we may disclose your information to relevant suppliers and partners, including e.g. software suppliers, marketing agencies and other data processors.

If we suspect fraud or illegal circumstances, we may disclose relevant information about this to the police for the purpose of reporting to the police or as part of the police investigation. Such disclosure is made in order to safeguard our and public interests in crime prevention and possible prosecution in accordance with national rules in this regard.

Deletion policy
We store your personal information in connection with the invoice and the return receipt for five (5) years after the purchase/return in order to comply with our obligations under the Danish Bookkeeping Act.

If we retain information about you in connection with the investigation of fraud or other illegal activities, we will retain such information until it is handed over to the police.

1.7. When you participate in a competition

Purpose and legal framework
If you participate in a competition offered by NORMAL, we process the following personal data about you for the purpose of conducting the competition:

General personal information, including e.g. your name, address, profile information on social media, if the competition is offered via social media. The processing takes place to safeguard your and our interests in enabling you to participate in the competition, cf. GDPR art. 6, stk. 1(f).

You can read more about our competitions in our competition terms in connection with the specific competitions.

Disclosure
If you win a competition, we may publish your details on our website or on social media if the competition is offered on social media. If we publish pictures of you, this will only happen to the extent that you have given your consent to this.

In addition, we may disclose your information to relevant partners and suppliers, including, e.g. software suppliers and other data processors.

Deletion policy
We process your personal data for a maximum of six (6) months after we have selected a winner and completed the competition. If, at the same time as participating in the competition, you have signed up for our newsletter or other marketing, we process and store your information as described in further detail under section 1.3.

1.8. If you are a contact person at one of our suppliers or partners

Purpose and legal framework
In order to handle day-to-day operations, we process the following categories of personal data about contact persons at our suppliers, business partners and business customers:

General personal data, including e.g. name, title, contact information, preferred language and other CRM-related information. The processing takes place in order to safeguard our interests in purchasing services and goods from our suppliers and to handle day-to-day operations, cf. GDPR Art 6(1)(f).

Disclosure
To the extent necessary for the company's operations, we may disclose your information to relevant partners, including, for example, software suppliers, freight companies, accountants, and lawyers.

Deletion policy
By default, we store your personal information for as long as the customer relationship exists or until you or our supplier inform us that you are no longer a contact person.

Personal data registered in connection with sales, delivery, invoicing, etc. is stored for five (5) years after the end of the financial year in question.

Personal data registered in connection with the conclusion of supplier agreements etc. is stored for up to five (5) years after the agreement in question has expired.

2. JOINT DATA RESPONSIBILITY
To the extent that you interact with NORMAL on our Facebook, Instagram or TikTok pages, we process your personal data as a joint data controller with the provider of the media, cf. GDPR art. 26.

The processing of your personal data takes place, among other things, if you:

"Like" our posts,
Comment on our posts or pages, or
Visit our pages.

You can read more about these processing activities in the privacy policies of each of the respective media.

3. DISCLOSURE OF PERSONAL DATA TO THIRD COUNTRIES
If it is necessary for our processing of your personal data, we may disclose personal data to third countries outside the EU/EEA. Disclosure of personal data to third countries will only take place if we have a legal basis, including, e.g.

If the European Commission has assessed that the security in the third country is sufficient, cf. GDPR Art. 45
In case of otherwise sufficient guarantees for security, including, e.g., when entering the EU Commission's standard contracts, cf. GDPR Art. 46, or
If one or more of the exceptions in GDPR art. 49 apply

If you would like further information about third-country disclosures, you are always welcome to contact us at dataprivacy@normal.eu.

4. IF YOU WISH TO WITHDRAW YOUR CONSENT
If we process your personal data on the basis of your consent, you can withdraw your consent at any time by contacting us as indicated above under section 1 or follow the instructions on our website, in newsletters, etc.

If you withdraw your consent, please note that it does not affect the legitimacy of our processing up to the time when you withdraw your consent, and that in special cases we may be entitled to continue processing your personal data, e.g., to defend ourselves against a possible legal claim.

5. YOUR RIGHTS
You are welcome to contact NORMAL if you want information about which data is processed about you and for which purposes. As a data subject, you have the following rights when we collect and use your personal data:

You have the right to access the personal data that we process about you.
You have the right to object to our collection and further processing of your personal data.
You have the right to rectification and deletion of your personal data, subject to certain statutory exceptions, including the Danish Bookkeeping Act.
You have the right to request restriction of your personal data from us.
In certain circumstances, you may also request to receive a copy of your personal data, as well as a copy of the transmission of the personal data you have provided to us, to another data controller (data portability).

If you wish to exercise any of these rights, or if you have any questions regarding the processing of your personal data, you are welcome to contact us at dataprivacy@normal.eu.

6. COMPLAINT OPTIONS
You have the right to file a complaint with the Danish Data Protection Agency or the Data Protection Agency in the EU/EEA country where you are domiciled, if you are dissatisfied with the way we process your personal data. However, we hope that you will always contact us first, so that we can find an amicable solution. You are always welcome to contact us at dataprivacy@normal.eu.

You can find the Danish Data Protection Agency's contact information and complaint guidance on www.datatilsynet.dk.

7. PRECAUTIONARY MEASURES
We give high priority to personal data security, and we therefore have a strong focus on processing your personal data in accordance with applicable data protection legislation.

In order to protect your personal data in the best possible way, we continuously assess the risks that may be associated with our processing of your personal data. We pay particular attention to protecting your personal data against discrimination, identity theft, financial loss, loss of reputation and confidentiality.

In the event of any security breach that poses a high risk to your rights, we will notify you of the security breach as soon as possible under the circumstances.

8. CHANGES TO THIS PRIVACY POLICY
We reserve the right to make changes to this Privacy Policy from time to time. In case of changes, the date at the bottom of the Privacy Policy will be updated. The Privacy Policy is force from time to time is available on our websites and in our app, "NORMAL".

This Privacy Policy was last updated on March 8, 2023.

Privacy policy for job applicants