1. Purpose of the policy
    The purpose of this Privacy Policy is to make you aware of how Mac Baren Tobacco Company A/S (“we”, “us”) processes personal data. With this policy we want to inform about what information is collected and processed and how long it is kept. The Privacy Policy addresses the processing of personal data by Mac Baren Tobacco Company A/S when you enter into agreements, interact or otherwise exchange personal data with us.
  2. Description of the processes
    1. Mac Baren Tobacco Company A/S processes your data for one or more specific purposes and in accordance with data protection rules. Among other things, we process information if you are a customer of ours, a business partner, a supplier, visit our website or our social media, or apply for a job with us. The information will predominantly come directly from you, and we will only process your information for as long as is necessary for the purpose for which it was collected. However, information may also be processed and stored longer in anonymized form.
      You can read more about the types of processing we carry out below.
    2. Customer relations
      Mac Baren does not process personal data of private customers, but in connection with the sale of our products to business customers, we process information about their contact person to conclude and perform a contract pursuant to GDPR Art. 6(1)(b). This information includes contact details such as name, company name, email, address, and telephone number as well as purchase history and payment details.
      We delete the data on an ongoing basis, but no later than 5 years after the end of the customer relationship.
    3. Cookies and the website
      As part of the general operation of our website, we collect personal data about you via cookies to improve the look and feel of the website and to compile statistics. The information we collect via cookies includes IP address, browser type, device (type, version, operating system, etc.) and user behavior, including page views.
      We only collect your personal data if you have given your consent. You can withdraw your consent at any time. Read more about our use of cookies in our Cookie Statement which you can find in our cookie banner on the website.
      We also process information when you contact us via our contact form on our website. For this purpose, we process name, e-mail, and country. It is also possible to write in a free text field, but we advise against writing personal data in this field unless it is relevant to the inquiry.
      The data we process via our contact form is deleted continuously and no later than 5 years after the last contact.
      On our website we also have integrated social media plugins, which have the possibility to collect data about you through this, if you have given your consent. In this context, we have a joint data responsibility with each medium. We use integrated plugins from LinkedIn and YouTube.
    4. Social media
      We use the social media LinkedIn, Facebook, and YouTube to connect with our customers and potential customers, and to promote our marketing efforts. If you have “liked” our fan page on the social media or have been in contact with us through this, we avoidably process your personal data. For this purpose, we only process information about your name and email, and possibly information about your purchase, if this is apparent from the context.
      If you contact us via social media, we process your personal data based on our interest in being able to contact you and respond to your enquiries, as set out in GDPR Article 6(1)(f). The data will originate from you and the social media through which you contact us.
      We have a so-called joint data responsibility with the social media we use, as we both process your personal data for our own purposes. You can read more about the social media’s processing of your personal data below:

      Data processed in connection with social media, which relate to direct communication via social media, are deleted immediately. For example, posts on Facebook pages or in public groups are not deleted, as a post or comment on Facebook pages or in public groups is considered to be in the public domain. You can read more about public areas here.

    5. Video surveillance
      We process personal data in connection with television surveillance in areas not used for normal traffic, such as the car park and at the entrance to the production hall. In addition, video surveillance is installed in specific areas such as gates, doors, and windows at the warehouse. The video surveillance contains only images and no sound. The footage is stored on a server located in our own server room. The purpose of the TV surveillance is crime prevention. The Mac Bar clearly indicates the surveillance by means of signage.
      Image recordings from television surveillance are generally deleted within 30 days after they have been recorded in accordance with Section 4 c, paragraph 4 of the Television Surveillance Act.
      Recordings containing personal data are only disclosed if you have given your express consent, if this is required by law or if the disclosure is made for the purpose of solving a crime.
    6. Job applicants
      If you apply for a job with us, we process your personal data for the purpose of assessing whether you are qualified for an existing or future position with us pursuant to GDPR Art. 6(1)(b). We process the information you provide to us, including your name, contact details, work and education history, education level, CV, application, availability date, video presentation and references. References are obtained only if deemed relevant and with your consent.
      We also process information about you based on our legitimate interest as set out in GDPR Art. 6(1)(f). This includes, for example, information collected from social media published by you. In this case, we consider that our interests in processing your personal data outweigh your interests in not having the data processed.
      In a possible recruitment process, logic and personality analysis may be used in this context, ordinary personal data will be processed, where the basis for processing is following a legitimate interest pursuant to GDPR Art. 6(1)(f). If the need for processing sensitive personal data arises, you will be asked to give your consent pursuant to GDPR art. 9(2)(a). When you apply for a job with us, HR, management, and any trusted employees will have access to your data.
      If you have applied for a job advertised with us, your data will be automatically deleted after six months. If you wish to delete your data before the six months, please send an email to HR@halberg-as.dk with the information.
      Unsolicited applications are kept for six months. 14 days before the six months have elapsed, you will receive an email with the option to consent to a further six months of retention. If you do not accept this consent or do not respond to the e-mail, your consent and thus your data will be deleted. If you wish to delete your data within the next six months, please send an email to HR@halberg-as.dk with the information.
      If you choose to subscribe to the Job Agent, your data will be kept until you stop subscribing to the Job Agent.
    7. Suppliers and partners
      When we enter into agreements with suppliers and business partners, we process their contact information. This includes information on name, job title, telephone number, e-mail and, if necessary, payment or bank details.
      The data is processed either because it is necessary for the performance of the contract with the supplier or business partner in question pursuant to GDPR Art. 6(1)(b), or because we have a legitimate interest in processing the contact details of the person concerned as part of the contract pursuant to GDPR Art. 6(1)(f).
      We keep relevant contact information throughout our cooperation. Written correspondence is deleted on an ongoing basis, and information necessary to fulfil our obligations under the Accounting Act is kept for 5 years plus the current financial year.
  3. Recipients of personal data
    We treat your personal data with confidentiality, and as a rule we do not disclose the information to third parties. However, we may disclose your personal data if you have given your consent, if we have a legitimate interest in disclosure or if we have a legal obligation to do so.
    We may transfer personal data to our system providers who process personal data on our behalf and under our specific instructions pursuant to the data processing agreement entered into.
    In some cases, we use data processors outside the EU/EEA, whereby personal data may be transferred to third countries, including in connection with our use of cloud solutions. For this purpose, we apply a valid transfer basis (possibly including Standard Contractual Clauses) before transferring the personal data. The transfer will only take place in compliance with the necessary security safeguards as required by applicable data protection legislation and an individual assessment will always be made regarding the need for additional measures.
  4. Your rights
    When we collect information about you, you have several basic rights under the data protection rules that you can exercise. Your rights include the right to request access to and rectification or erasure of your personal data, restriction of and objection to our processing, and the right to receive your data in a structured, commonly used, and machine-readable format (data portability).
    The above rights may be subject to conditions and limitations. Whether you as a data subject can request, for example, the erasure of your personal data, will in all cases depend on a specific assessment.
    If you have given your consent to our processing of your data, you have the right to withdraw this consent at any time.
    If you are dissatisfied with our processing of your personal data, you can lodge a complaint with the Danish Data Protection Authority via their website www.datatilsynet.dk/english or by calling +45 33 19 32 00.
  5. Our Contact Details
    The company responsible for processing your personal data is:

    Mac Baren Tobacco Company A/S
    CVR.nr: 88 21 22 15
    Porthusvej 100, 5700 Svendborg
    E-mail: info@mac-baren.com
    Tel.: +45 63 22 52 00

    If you have any questions regarding our processing of your personal data, please contact us at info@mac-baren.com or by phone +45 63 22 52 00.

  6. Modifications
    We reserve the right to update and amend these guidelines for the processing of personal data. In the event of material modifications, we will notify you by e-mail or by a visible announcement on our website.
    This privacy policy was last revised on 06.12.2022.