Last updated: 1 October 2026

Duff Beauty respects your privacy. This privacy policy explains what personal data we collect, why we collect it, who we share it with and what rights you have.

Data controller

ND-GROUP ApS (Duff Beauty)
Vesterbrogade 67, 3. th.
1620 Copenhagen V, Denmark
CVR (company reg. no.): 40662022
Email: hello@duffbeauty.com

What data we collect and why

When you shop in our webshop: full name, delivery address, email address, phone number and information about what you have bought.
Purpose and legal basis: The processing is necessary to deliver your products, handle returns, exchanges and complaints, and fulfil our contract with you (GDPR Art. 6(1)(b)). We also keep accounting records because the law requires it (GDPR Art. 6(1)(c)).

When you sign up for our newsletter and SMS: name, email address and phone number.
Purpose and legal basis: We send you inspiration, exclusive offers and news through our marketing platform (Klaviyo). We only do this if you have given your explicit consent (GDPR Art. 6(1)(a)).

When you use our website (cookies and similar technologies): IP address, information about your device and browser, and how you use the website, for example which pages you visit, what you click on and what you buy. We only use cookies that are not strictly necessary if you have given your consent. Read more in our Cookie Policy.

We need the data required to fulfil the contract to process your order. Without it, we cannot deliver your products. Data we collect based on your consent, such as for newsletters, SMS and cookies, is voluntary, and you can withdraw your consent at any time.

How long we keep your data

  • Purchase and transaction data: 5 years plus the current financial year from the date of purchase, as required by the Danish Bookkeeping Act.
  • Marketing data: for as long as you are subscribed. If you unsubscribe, your data is deleted immediately, except what is needed to document that you have withdrawn your consent.
  • Customer service enquiries: for as long as needed to handle your enquiry and any complaint.

Who we share your data with

We do not sell your personal data. We use selected data processors that process data on our behalf:

  • Webshop platform: Shopify
  • Shipping and logistics: GLS, PostNord, Shipmondo
  • Returns and complaints: Revershero
  • Payments: Shopify Payments, AltaPay, PayPal
  • Marketing (email and SMS): Klaviyo
  • Analytics: Triple Whale, Google
  • Advertising: Meta, TikTok, Pinterest, Snapchat, Google
  • Accounting: Visma e-conomic

Transfers outside the EU/EEA

Some of our data processors are established outside the EU/EEA, for example in the USA. When we transfer data there, we use a lawful transfer mechanism, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. When we ship your order to a country outside the EU/EEA, we share the data needed for delivery with the carrier, as this is necessary to fulfil our contract with you.

Your rights

You have the right to:

  • access the data we process about you and get a copy of it
  • have incorrect data corrected
  • have your data deleted («the right to be forgotten»)
  • have the processing restricted
  • object to the processing, including direct marketing and profiling
  • receive your data in a structured format (data portability)
  • withdraw your consent at any time

To use your rights, email us at hello@duffbeauty.com. You can also unsubscribe from our newsletter using the link at the bottom of every email.

Complaints

If you are not satisfied with how we process your personal data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, which is the supervisory authority for ND-GROUP ApS. If you live in another EU/EEA country, you can also complain to the data protection authority in your country.

Changes

We update this privacy policy when we change how we process personal data. The date at the top shows when it was last updated.