WowDelivery is operated by BY Administration, which is the data controller for the information processed here.
This policy describes what we actually store, why, who sees it, and for how long. It is written from how the system is built — not from a template.
What we collect
**When you order:** name, delivery address, phone number and email. Without them the order cannot be delivered.
**Your order history:** what you ordered, from whom, when, and what it cost. We use it for receipts, for support, and to offer you the same order again.
**Your account, if you create one:** your contact details, saved addresses, favourites and language choice.
**Payment:** we never store your card number. The payment provider handles the card and returns the card type and last four digits, so you can recognise it next time.
**Technical:** your IP address and browser details when you call our API. We use them to limit abuse and to diagnose faults.
If you order as a guest we create no account. The basket is held together by a random token in a cookie that expires after three days.
Why, and on what legal basis
| Purpose | Legal basis | |---|---| | Delivering your order | Performance of the contract | | Receipts and order updates | Performance of the contract | | Support and complaints | Performance of the contract | | Accounting | Legal obligation (Danish Bookkeeping Act) | | Security, abuse prevention, diagnostics | Legitimate interest | | Marketing by email and SMS | Your consent |
We do not use your data for automated decisions with legal effect on you.
Who sees it
**The shop** gets what it needs to pack and prepare the order: the items, your notes and your first name. The shop does not get your full address for a delivery.
**The courier** gets your address, your first name and your phone number — from the moment the job is assigned until the delivery is complete. Not afterwards.
**The payment provider** gets what is needed to take the payment.
**The delivery partner.** If your order is delivered by an external partner, the partner gets the pick-up and drop-off addresses and a contact number.
**Our own staff** can see your order while handling a support case. Every back-office lookup and change is logged.
We do not sell your information, and we do not share it beyond the above unless we are legally required to.
All of our processors are in the EU/EEA.
How long we keep it
**Orders and receipts:** five years after the end of the financial year, because the Bookkeeping Act requires it.
**Your account:** for as long as you have one. If you delete it we remove your contact details and saved addresses. Orders remain for the statutory period, detached from your profile.
**Support cases:** two years after the case is closed.
**Technical logs:** 90 days at most.
**Marketing consent:** until you withdraw it, and then a note that you did, so we do not write to you again by mistake.
Cookies
We use the cookies the site cannot work without:
- **Session** — keeps you signed in. Not readable by JavaScript. - **Basket** — holds your basket together, including when you are not signed in. Expires after three days. - **Language and theme** — remembers your choices.
We use no third-party advertising or tracking cookies.
Your rights
Under the GDPR you have the right to:
- **access** — to know what we hold about you, and get a copy - **rectification** — to have something wrong corrected - **erasure** — to have your data deleted once we no longer have a basis to hold it - **restriction** — to have processing paused while an objection is considered - **portability** — to receive your data in a machine-readable format - **objection** — to processing based on legitimate interest - **withdrawal of consent** — which does not affect what happened before
Write to privacy@wowdelivery.dk. We answer within one month. If we need longer we will say so within that month and explain why.
Security
Passwords are stored hashed, never in plain text. Session keys live in cookies JavaScript cannot read. All traffic is encrypted. Access to production data is limited to the staff who need it, and every lookup is logged.
If a breach occurs that poses a risk to you, we notify the Danish Data Protection Agency within 72 hours and you without undue delay.
Complaints
If you are unhappy with how we handle your information, you may complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.
About this version
This policy describes the system as it is built today. It has **not** been reviewed by a lawyer, and it must be before the platform processes payments for real customers. Company details — registration number and address — and the names of the specific processors must be inserted before it is complete.
Last updated: 28 July 2026.