Privacy policy

Who we are

Happenings Group A/S (CVR 40979956), Klostergade 56B, 8000 Aarhus C, Denmark, is the data controller for CanIBuyFrom. Write to privacy@canibuyfrom.com about anything in this policy.

What we collect and why

• Your account: name, email address (stored encrypted) and a hashed password if you set one. We need these to give you an account.
• Your orders and bookings: when a shop connected to us ships an order or reports a visit, it tells us your email, the date, the amount and the status. We use this to send you one review link and to prove that your review belongs to a real purchase. This is our legitimate interest in trustworthy reviews.
• Your reviews: ratings, text, answers and photos. We remove location data from photos. Reviews are published under the display name you choose.
• Identity verification (optional): if you verify with MitID or BankID through our provider Idura, we keep your legal name and an anonymous ID from the provider. Never your CPR number. This is based on your consent, and you can withdraw it by deleting your account.
• Security log: every request to our service, with your IP address (stored encrypted), your city-level location as reported by Cloudflare, your device type and the time. We use it to stop fraud, fake reviews and abuse. This is our legitimate interest in a safe service.
• Messages and private feedback you send to a business through us.

Who sees what

• Everyone: your display name, your review, the month of your purchase and how it was verified.
• The business: your review, private feedback you send it, and that you are its customer. We don't give businesses your email address; they have it only if you bought from them.
• Our staff: only what they need for moderation and security. The security log is visible to administrators only, and every look at it is logged.

Who helps us

• Hetzner (servers, database and file storage in the EU).
• Cloudflare (delivers the website and protects it from attacks).
• Google (optional website analytics, only with your consent).
• SendGrid (sends our emails; data may be processed in the US under the EU's standard contractual clauses).
• Idura (identity verification with MitID and BankID, in the EU).
• Shopify and other shop systems send us order data on the shops' behalf.

How long we keep it

• Your account and reviews: until you delete them.
• The security log: 12 months, then it's deleted automatically.
• Order details: as long as they back a review or an open review link. Shops can ask us to delete a customer's order data, and we do.

Your rights

You can see and download everything we hold about you, correct your details, and delete your account from your profile. When you delete your account, we erase your personal data and take your reviews down. You can also object to how we use your data or ask us to limit it by writing to us.

If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).

Cookies

We use cookies to keep you signed in and remember your language. Your theme and analytics choice are saved in your browser. Cloudflare may use a cookie to distinguish people from bots. Google Analytics is optional and stays off until you accept it. If you accept, Google receives usage information about public pages and may process it outside the EU. We exclude search queries, private account pages and review-link tokens, and disable advertising features. Analytics cookies expire after 90 days. You can reject analytics or withdraw your consent through Privacy settings in the footer; withdrawing consent stops tracking and removes our Google Analytics cookies.