Vineyard clarity

Privacy Policy

This layered notice explains why Tendonsankle gathers personal data while you browse, email, negotiate sessions, acquire educational meal materials, or request refunds. Sections separate visitor education from studio operations so auditors, advertising reviewers, or curious readers slide to whichever depth suits them.

Cookie Policy maps granular jars; Terms cover participation posture; monetary reversals sit in Refund Policy.

Editorial warmth Mail controller

ControllerDenmark

Controller identity

The data controller is Tendonsankle, stationed at Amagerbrogade 158, 2300 København, Denmark. Routine channels include telephone +45 32 58 01 40 and email online@tendonsankle.world.

Address-based service of documents remains valid under Danish procedural customs. Individuals may appoint representatives; authentication steps follow proportionate checks so impersonation stays unlikely.

Processors only receive delegated instructions spelled out internally. Responsibility for downstream subprocessors rotates back through contract reviews each quarter regardless of transactional volume.

Coverage

Material scope

This policy embraces static informational pages (Healthy Meals, Daily Menu), the Contact form, ancillary PDF or zip releases we email post-purchase, and administrative discussions about refunds spelled out publicly in our Refund Policy.

If you browse without submitting anything, strictly necessary cookies paired with ephemeral server telemetry may nonetheless leave traces described later. Optional analytics identifiers activate solely after affirmative toggles logged by the onsite banner.

Separate agreements may attach to bespoke collaborations; where conflicts arise between this general notice and individualized schedules, schedules win for that relationship only.

FieldsMinimisation

Categories harmonized with processing

Identifiers: name aliases, phonetic spelling preferences, invoicing postal codes, hashed customer numbers. Contact channels: SMTP headers, voicemail callbacks, messenger handles if you cite them willingly. Interaction content includes message bodies, annotated PDF comments, transcripts you export from calls when shared deliberately.

Transactional metadata references cart identifiers, PSP tokens we never store bare, reversal codes, bookkeeping PDF attachments. Behavioural artefacts cover aggregated heatmaps activated only upon analytics consent—not session replay software by default.

Pseudonymous device hints include truncated IP prefixes, coarse geolocation derived indirectly, coarse screen metrics for responsive debugging when we reproduce layout tickets.

Storage layering

Hot caches refresh quickly while archive buckets cool slowly for accounting.

Boundary testing

Access reviews coincide with roadmap weeks so documentation stays honest.

Jurisdictional mesh

Transfers lean on SCCs when adequacy fades or infrastructure migrates temporarily.

Art. 6Consent

Lawfulness inventory

Article 6(1)(f) legitimises conversational replies grounded in balancing tests favouring restrained retention. Purchase fulfilment leverages Article 6(1)(b) performance scaffolding. Fiscal obligations cling to Article 6(1)(c). Where marketing cookies shimmer on, Article 6(1)(a) consent supplies the pedestal.

Profiling for tailored pricing does not presently occur. Automated decision-making devoid of humane review is expressly disclaimed aside from deterministic spam filtration.

Withdrawing consent drills straight through analytics toggles—it never erases bookkeeping rows the state expects for seven-year horizons.
Compliance sketch

TimersArchives

Retention ladders

Operational mail threads compress after twenty-four dormant months unless you explicitly resurrect them. Receipt packages bond to seven Danish bookkeeping cycles. Cookie proofs persist forty-eight months to demonstrate consent versioning when regulators ask politely but firmly.

Incident logs shorten to ninety days absent escalation. Telemetry backups rotate weekly with encrypted offsite mirrors replaced monthly.

Processors receive parallel obligations; annual attestations summarise compliance even when no breaches occurred—that silence deserves documentation too.

TOMsMFA

Technical and organisational measures

Administrators adopt hardware keys wherever supported. MFA applies to transactional consoles. Pseudonymised exports travel through SFTP corridors rather than zipped email unless clients insist with signed waivers stored separately.

Patch cadence targets weekly merges for frameworks powering static bundles. Quarterly tabletop exercises emulate credential leaks—not to alarm, but to rehearse calmly.

Visitors never see HTTP-only asset references; CSP headers evolve without breaking informational fonts sourced through encrypted CDNs referenced in markup.

GDPRAppeals

Individual rights choreography

Access requests receive human-written summaries instead of dumping raw directories. Rectification honours spelling upgrades or pronoun tweaks without unnecessary drama. Erasure honours forgotten accounts unless contradictory law demands retention.

Restrictions pause optional marketing touches while contentious invoices settle. Portable bundles ship as structured JSON zipped politely. Objections to legitimate interest processing funnel into escalation notes within ten business days.

Residents of California may request categorical disclosures—we respond with granular tables even when GDPR glossary leads. Appeals route through Datatilsynet in Denmark yet we welcome pragmatic dialogue beforehand.

Dollar or euro footprints

Presentment currency does not dictate storage jurisdiction rather than bookkeeping currency. Receipt metadata normalises internally for auditors.

Volunteered health anecdotes

Unsolicited medically adjacent paragraphs get minimised swiftly; facilitators annotate sessions as editorial-only reminders without diagnostic tone.

Photographic attachments

Unsolicited kitchen photography may be archived only if contractual—otherwise thumbnails delete after ticketing closure.

Review cadence

We revisit this dossier alongside publishing cycles—expect cosmetic tweaks when typography changes or supervisory guidance shifts without fanfare.

Printing or PDF exporting for internal compliance binders stays permitted provided recipients remember static copies eventually drift from the authoritative HTTPS-hosted edition.