Privacy Policy

1. Who is the data controller

Things to do CPH is operated by Felipe, an independent local guide based in Copenhagen, Denmark ("we", "us", "our"). We are the data controller for the personal data described in this policy.

Contact: fbmalinarich@gmail.com · WhatsApp +45 91 69 08 50

2. What data we collect

We only collect what we need to run your tour booking and answer your messages:

• Booking details: full name, email address, phone number and an optional message, plus the date, time, duration and number of people for your tour. You give us this directly when you book on thingstodocph.com.
• Payment information: we never see or store your card details. Payment is handled entirely by Stripe on Stripe's own secure checkout page; we only receive confirmation that payment succeeded, the amount, and a payment reference.
• Communications: if you write to us by email or WhatsApp, we keep that conversation to answer you and coordinate your tour.
• Technical data: like most websites, our hosting provider automatically logs basic technical information (such as your IP address and browser type) for security and troubleshooting purposes.
• Cookies: see our Cookie Policy for the small amount of data cookies store on your device.

3. Why we process it and our legal basis

• To create and manage your booking, send your confirmation and invoice, and deliver the tour: necessary to perform our contract with you (GDPR art. 6(1)(b)).
• To answer questions you send us before or after booking: our legitimate interest in providing customer service (art. 6(1)(f)), or performance of a contract if you've already booked.
• To keep accounting records of payments received: a legal obligation under Danish bookkeeping law (art. 6(1)(c)).
• To show you relevant ads and measure their performance via Google Ads: only with your consent (art. 6(1)(a)), given or refused through the cookie banner.
• To keep the site secure and diagnose technical issues: our legitimate interest (art. 6(1)(f)).

4. Who we share it with

We don't sell your data. We share it only with the people and services that need it to make your tour happen:

• Stripe (payment processor), to charge your card and process refunds.
• Our email provider, to send you the booking confirmation, invoice and cancellation emails.
• WhatsApp (Meta), if we message you there to fine-tune your itinerary: only using the phone number you gave us at booking.
• Google, for Google Ads conversion measurement, but only if you've accepted that in the cookie banner.
• Our hosting provider, which stores the booking data and runs the website.

We don't use any other analytics, advertising network or third-party tool beyond what's listed here and in our Cookie Policy.

5. International transfers

Some of the services above (Stripe, Google, Meta/WhatsApp) may process data outside the EU/EEA, including in the United States. When that happens, we rely on the safeguards required by GDPR: providers certified under the EU-U.S. Data Privacy Framework, and/or the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Booking records (including the personal data on them) are kept for as long as required by Danish bookkeeping law (currently 5 years from the end of the financial year they relate to) and then deleted.
• Messages exchanged by email or WhatsApp are kept for as long as reasonably needed to resolve your query, then deleted or archived.
• Cookie data is kept for the period stated in our Cookie Policy.

If you'd like us to delete data sooner than these periods allow, where the law lets us, see "Your rights" below.

7. How we protect it

Bookings are stored on our hosting provider's server, access to the admin panel where we manage them is protected by a login, and the site is served over HTTPS. We never handle or store your full card number: that only ever touches Stripe's systems. No online system is 100% secure, but we take reasonable, proportionate steps for the size and nature of this business.

8. Cookies

Cookies are covered in detail in our separate Cookie Policy, including which ones we use, which need your consent, and how to change your choice at any time.

9. Your rights

Under GDPR, you can ask us to:

• Access the personal data we hold about you;
• Correct it if it's inaccurate;
• Delete it, where we're not required to keep it for legal reasons (such as accounting records);
• Restrict or object to certain processing;
• Receive a copy of the data you gave us in a portable format;
• Withdraw consent at any time for anything based on consent (like Google Ads cookies), without affecting processing done before you withdrew it.

To exercise any of these, write to fbmalinarich@gmail.com. We'll respond within one month, as required by law.

10. Children

Our tours can include children as part of a family group, but the booking itself must be made by an adult (18+), who is responsible for the accuracy of the data provided for every member of the group. We don't knowingly collect data directly from children to create their own accounts or bookings. There are none on this site.

11. Changes to this policy

We may update this policy if the way we handle data changes, or if the law requires it. The version that applies is the one published here, dated at the top of this page.

12. Contact and complaints

Questions about this policy or your data: fbmalinarich@gmail.com · WhatsApp +45 91 69 08 50.

If you're unhappy with how we've handled your data, you also have the right to complain to the Danish Data Protection Agency (Datatilsynet), dt@datatilsynet.dk, or to the data protection authority in your own EU/EEA country of residence.