Privacy Policy & Data Governance

Effective Date: January 1, 2026 · Compliant with EU Regulation 2016/679 (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven)

1. Overview and Data Controller Identity

Carnivalvaultvist Media ApS ("we", "our", or "the Company") operates the digital publication and Nordic coffee discovery engine hosted at carnivalvaultvist.casa. We are committed to transparency, data minimization, and privacy-by-design under European Union legislation.

Data Controller Contact:
Carnivalvaultvist Media ApS
CVR / Company Registration No: DK-39281904
Bredgade 34, 1260 København K, Denmark
Official Privacy Inquiries: [email protected]

2. Categories of Personal Data Collected

We only collect and process data necessary to provide our brewing calculators, directory curation, and user communications:

Voluntary Form Data: Full name, electronic mail address, organization, and message contents submitted via our editorial desk contact interface.
Technical & Telemetry Data: Anonymized IP addresses (truncated), device browser version, operating system, and interaction timestamps.
Local Storage State: Browser key-value storage used strictly to remember your cookie preferences and brew ratio configuration variables.

3. Legal Bases for Data Processing (Article 6 GDPR)

Our processing activities rely strictly upon the following lawful grounds:

Consent (Art. 6(1)(a)): When you opt-in to non-essential analytics tracking or direct communications.
Contractual & Pre-contractual Necessity (Art. 6(1)(b)): Responding to roastery review submissions and editorial partnerships.
Legitimate Interests (Art. 6(1)(f)): Securing our web servers against malicious bot attacks and ensuring optimal rendering of 3D WebGL assets across devices.

4. Third-Party Service Providers & Data Transfers

Carnivalvaultvist works with trusted infrastructure partners within the European Economic Area (EEA). If technical delivery necessitates transfer beyond the EEA, such transfers are safeguarded by European Commission Standard Contractual Clauses (SCCs). Our providers include Cloudflare DNS/CDN, European cloud hosting centers in Frankfurt/Stockholm, and privacy-first analytics tools.

5. Retention Schedules

Inquiry records sent via our contact desk are retained for twenty-four (24) months for audit and verification purposes, after which they are irreversibly purged. Web server logs containing truncated IP addresses are automatically deleted after thirty (30) days.

6. Your Statutory GDPR Rights

Under Chapter III of the GDPR, visitors possess comprehensive rights regarding their personal information:

Right to Access (Art. 15): Request full copies of your data held by our organization.
Right to Rectification (Art. 16): Correct inaccurate or incomplete business profile details.
Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your personal records.
Right to Restrict or Object (Art. 18 & 21): Object to processing carried out under legitimate interest.
Right to Data Portability (Art. 20): Receive your structured data in machine-readable format.

To exercise any statutory right, contact our Data Protection representative at [email protected].

7. Right to Lodge a Complaint

If you believe our processing of your personal data infringes Danish or EU data protection legislation, you maintain the statutory right to lodge a formal complaint with the Danish Data Protection Agency:

Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Telephone: +45 33 19 32 00 | Web: datatilsynet.dk