Privacy Policy

Soya Group A/S 

Last updated: 10.09.2026 


1. DATA CONTROLLER 

Soya Group A/S (“Soya Group”, “we”, “us” or “our”) is the data controller for the processing of personal data described in this Privacy Policy. 

Soya Group A/S 
CVR no.: 26486254 
Under Broen 1 
6400 Sønderborg 
Denmark 
Email: online@soyaconcept.com 
Phone: +45 73 12 16 40 

If you have any questions about our processing of personal data or wish to exercise your rights, you are welcome to contact us. 


2. WHAT PERSONAL DATA DO WE COLLECT? 

We collect and process personal data when you: 

  • visit our website
  • make a purchase in our webshop
  • create a customer account
  • subscribe to our newsletter
  • participate in competitions, campaigns or gamification activities
  • contact customer service
  • interact with our advertisements or marketing
  • visit our social media profiles 

Depending on the situation, we may process the following categories of personal data: 

  • name
  • address
  • email address
  • phone number
  • country
  • purchase and order information
  • payment information
  • product interests and preferences
  • communication history
  • technical information about your device, browser and IP address
  • information about your use of the website and our marketing 


3. WEBSITE VISITORS 

When you visit our website, we process information about your use of the site. 

This may include: 

  • IP address
  • browser type
  • device type
  • time of visit
  • pages you visit
  • products and categories you are interested in
  • click behaviour and navigation
  • cookie consent choices 

The purposes of the processing are to: 

  • operate and secure the website
  • analyse traffic and usage patterns
  • improve functionality and user experience
  • develop our products and services
  • personalise content and marketing where you have given consent 

The processing is based on our legitimate interest in operating and improving our website and, where required by applicable law, on your consent. 

You can read more about our use of cookies in our Cookie Policy. 


4. PURCHASES IN THE WEBSHOP 

When you shop with us, we process the information necessary to complete your purchase. 

This may include: 

  • name
  • address
  • delivery address
  • email address
  • phone number
  • order information
  • purchase history
  • payment information
  • delivery information 

We process the information in order to: 

  • complete and administer your purchase
  • deliver your goods
  • handle payments
  • provide customer service
  • process complaints and returns
  • prevent fraud
  • comply with accounting and consumer law obligations 

The processing is necessary to perform our contract with you and to comply with our legal obligations. 


5. CUSTOMER ACCOUNT 

When you create a customer account with us, we may process information such as: 

  • name and contact details 
  • purchase history
  • product interests
  • preferences
  • login and account information 

We use the information to administer your account, provide customer service and improve your customer experience. 

The processing is based on our contract with you concerning the customer account and our legitimate interest in administering and improving our services. 


6. NEWSLETTERS AND MARKETING 

You can subscribe to our marketing through: 

  • the website
  • pop-ups
  • checkout
  • Facebook Lead Ads
  • campaigns and activities through Playable 

We process, among other things: 

  • name
  • email address
  • country
  • product interests
  • interactions with our marketing 

We use the information for: 

  • sending newsletters
  • information about products and campaigns
  • targeted communication
  • analysis of marketing activities
  • improving relevance and customer experience 

We only send electronic marketing where we have the consent required under applicable law. 

In certain markets, we use double opt-in as an additional validation of your consent. 

You can unsubscribe from marketing at any time via the link in our emails or by contacting us. 


7. COMPETITIONS, CAMPAIGNS AND GAMIFICATION 

When you participate in competitions, campaigns, surveys, quizzes or gamification activities, we may process information about: 

  • name
  • email address
  • phone number
  • participation information
  • answers or contributions
  • any consents provided 

The purposes are to: 

  • administer the activity
  • contact winners or participants
  • provide prizes or benefits
  • document completed campaigns
  • collect marketing consents where relevant 

The processing takes place in order to fulfil the terms of your participation or on the basis of your consent to marketing. 


8. PERSONALISATION AND PROFILING 

To provide relevant products, offers and communication, we may analyse information about: 

  • purchase history
  • product interests
  • browsing behaviour
  • interaction with newsletters
  • participation in campaigns 

We use this information, among other things, for: 

  • customer segmentation
  • personalised product recommendations
  • automated marketing flows
  • targeted marketing
  • improving the customer experience 

The processing is based on consent or our legitimate interest in providing relevant product recommendations based on your behaviour. 

We work with external technology partners and marketing tools for these purposes. 

The profiling does not produce legal effects or similarly significantly affect you. 


9. AI-BASED FUNCTIONS 

We use artificial intelligence (AI) in selected functions on our website to improve the customer experience and make it easier to find relevant products and information. 

This includes, among other things: 

  • an AI-based chatbot that can answer questions and assist you on the website
  • AI-based search that helps understand your searches and display relevant products and results 

When you use these functions, we may process the information you enter yourself, including questions, searches and any contact or order information. Technical information about your use of the functions may also be processed, such as your IP address, device and browser information, as well as information about your session and interaction with the website. 

The information is used to provide the requested functions, generate relevant answers and search results, and develop and improve the quality of our AI-based services. 

Conversations with the chatbot may be stored and used to develop and improve the chatbot and its responses. Conversations and related information are generally stored for up to 12 months unless a shorter retention period has been established. You have the option to delete your conversations yourself. 

We recommend that you do not enter sensitive personal data or other confidential information into the chatbot. 

We use Diverge (Dialog Intelligens ApS) as the technology provider for our AI-based functions. Diverge’s infrastructure is hosted within the EU/EEA. However, AI subprocessors outside the EU/EEA may be used. In such cases, we ensure a valid transfer mechanism and appropriate safeguards in accordance with applicable data protection legislation. 

The processing is based on our legitimate interest in providing efficient digital customer service and in developing and improving the functionality and customer experience on our website. 


10. SOCIAL MEDIA AND ONLINE ADVERTISING 

We use social media and digital advertising platforms to communicate with customers and market our products. 

We may use information about your activity on our website for advertising on platforms such as: 

  • Meta
  • Google
  • Pinterest
  • LinkedIn
  • TikTok
  • YouTube 

This may include audience building, remarketing and the display of relevant advertisements. 

When we use social media advertising tools to track activity on our website, we have joint responsibility with the platforms for the collection and transfer of your data. We have entered into the legally required arrangements regarding the allocation of responsibilities, and you can read more about the processing in the platforms’ own privacy policies. 


11. SHARING OF PERSONAL DATA 

We may share personal data with suppliers and partners who help us operate our business. 

This may include: 

  • ecommerce platforms
  • marketing and CRM platforms
  • analytics and reporting tools
  • personalisation tools 
  • AI, chatbot and search technology providers
  • advertising platforms
  • payment providers
  • shipping and logistics partners
  • customer service platforms
  • IT and hosting providers
  • external advisers and marketing partners 

We may also disclose information to public authorities where we are legally required to do so. 

Our suppliers may only process information according to our instructions and for the purposes we have defined. 


12. INTERNATIONAL TRANSFERS 

Some of our suppliers or their subprocessors may be established outside the EU/EEA. 

If personal data is transferred to countries outside the EU/EEA, we ensure that the transfer takes place on a lawful basis and with appropriate safeguards. 

This may include the use of: 

  • the European Commission’s Standard Contractual Clauses (SCCs)
  • the EU-U.S. Data Privacy Framework
  • other approved transfer mechanisms 

You are welcome to contact us if you would like further information about such transfers. 


13. RETENTION OF PERSONAL DATA 

We only retain personal data for as long as necessary to fulfil the purposes for which the information was collected, or for as long as required by law. 

As a general rule, the following retention periods apply: 

Datatype

Retention period

Purchase and order data 

5 years after the end of the financial year 

Customer account

3 år efter seneste aktivitet 

Klub Soya-medlemskab 

3 years after the latest activity 

Newsletter subscriptions

For as long as the consent remains active 

Documentation of consent

2 years after withdrawal 

Competitions and campaigns 

6 months after completion 

Customer service enquiries

3 years 

Web analytics

Up to 26 months 

Cookie consents

12 months

Chatbot conversations and related metadata

Up to 12 months, unless a shorter period has been established or the conversation is deleted earlier 

 

When the information is no longer necessary, it is deleted or anonymised. 

 

14. YOUR RIGHTS 

You have a number of rights under data protection legislation. 

These include the right to: 

  • access the personal data we process about you
  • rectify inaccurate information
  • have information deleted in certain circumstances
  • restrict processing
  • data portability
  • object to processing
  • withdraw consent 

If you wish to exercise your rights, you can contact us. 

 

15. COMPLAINTS 

If you are dissatisfied with our processing of your personal data, you have the right to lodge a complaint with the relevant data protection authority. 

In Denmark, this is: 

Datatilsynet 
Carl Jacobsens Vej 35 
2500 Valby 
Denmark 


www.datatilsynet.dk 

 

16. CHANGES TO THIS PRIVACY POLICY 

We may update this Privacy Policy from time to time to reflect changes in our processing of personal data, our services or applicable legislation. 

The latest version will always be available on our website.