Privacy Policy — KHM Portal

DRAFT — not legally reviewed. This is a translation of the Danish policy, which is the authoritative version. Fill in [...] placeholders before publishing.

Last updated: 2026-08-17

1. Data controller

Københavns historiske markeder Maglemosevej 31, 2640 Hedehusene, Denmark CVR (company reg. no.): 37149977 Email: info@khm.dk

Please direct any questions about your personal data here.

2. What information we process

When you are registered as a user (volunteer, actor or administrator) we process:

  • Identity: name, any nickname/actor name
  • Contact: email address, phone number, postal address
  • Identification: uploaded ID document, where your role requires it
  • Account: role and permissions, login (Passkeys, Google login, magic email link), language preference
  • Activity: notifications and an audit log of actions in the system
  • Health and dietary information (special categories): information about health considerations, allergies and special diets that you voluntarily provide so we can adapt tasks, catering and accommodation to you. This is processed solely on the basis of your separate, explicit consent (see the dedicated consent declaration), stored encrypted, accessible only to volunteer coordinators, and deleted on withdrawal or when the consent expires (13 months).

Sensitive fields (name, email, phone, ID, health information) are stored encrypted.

When you apply as an actor

You can submit an application without having a user account. We then process:

  • Contact: name, email address, phone number, and if you provide them: company registration number and links to your website or social media
  • About the stall and camp: group name, period, stall type, what you sell or make, dimensions of stall and camp, number of people, the drawing of your camp, information about open fire and gas, and your own comments
  • Photos: the pictures of stall and camp you attach yourself

Contact details are stored encrypted. Photos are re-encoded on receipt, which removes EXIF data — including GPS position.

3. Purposes and legal basis

  • Administering your participation as a volunteer/actor — Contract / legitimate interest, art. 6(1)(b)/(f)
  • Sending you essential operational messages (shifts, critical notices) — Legitimate interest, art. 6(1)(f)
  • Login and account security — Contract, art. 6(1)(b)
  • Audit log for security purposes — Legal obligation / legitimate interest, art. 6(1)(c)/(f)
  • Adapting tasks and catering to your health/allergies — explicit consent, art. 9(2)(a) (+ art. 6(1)(a))
  • Processing your actor application and preparing a contract — Steps prior to a contract, art. 6(1)(b)
  • Showing your stall on our website — consent, art. 6(1)(a)
  • Sharing your stall on social media — consent, art. 6(1)(a)

The last two are optional. If you say no, we process your application in exactly the same way, and you may withdraw the consent at any time.

Health information is processed exclusively on the basis of your explicit consent. You may withdraw consent at any time without consequence for your participation otherwise; we then delete the information.

4. Cookies

The portal sets one necessary cookie to keep you logged in. It is strictly necessary for the site to function and does not require consent. We use no analytics, marketing or third-party tracking cookies.

5. Recipients and processors

We do not disclose your information to others, but use data processors for operations:

  • Hosting: Hetzner Online GmbH (servers in the EU)
  • Email delivery: [provider]
  • Login: Google (only when using Google login)

A data processing agreement is in place with each of them.

6. Retention

We retain your information for as long as you are an active participant and thereafter [period, e.g. 12 months], after which it is deleted or anonymised. The audit log is retained [period] for security purposes.

Actor applications: contact details, your comments and your photos are removed 13 months after the end date of the market. Group name, stall type, dimensions, number of people and the outcome remain, so the association can see how many applied and how many were turned down. If your application is approved, the contact details move to your user account immediately, and the application remains without them.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection. You may withdraw a consent. Contact [contact-email]. You may lodge a complaint with the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk).

8. Security

Sensitive information is stored encrypted, access is role-controlled, and actions are logged. Data is hosted in the EU.