Privacy & cookie policy

Last updated: 16 October 2026

This policy explains how Enkl Sound Copenhagen ApS processes personal data when you visit our website, buy our products, contact us, subscribe to our newsletter, apply for a job or use the Enkl Sound app.

1. Who is responsible for your personal data?

Enkl Sound Copenhagen ApS is the data controller for the processing described in this policy.

Enkl Sound Copenhagen ApS Fruebjergvej 3 2100 Copenhagen Ø Denmark Company registration number (CVR): 41 92 38 30

Privacy enquiries and requests concerning your rights: contact@enklsound.com Support for the Enkl Sound app: app@enklsound.com

2. On our website, including cookies

When you visit our website, technical information may be processed, including your IP address, device and browser information, the pages you visit and your interactions with the website.

We use this information to deliver and secure the website, provide the functions you request and, subject to your cookie choices, understand website use and measure marketing.

The legal basis for processing necessary to operate and secure the website is our legitimate interest in providing a functioning and secure online service under GDPR Article 6(1)(f). Processing necessary to take steps at your request before a purchase or to perform your purchase contract is based on Article 6(1)(b).

Where consent is required for cookies or related processing, the legal basis is your consent under Article 6(1)(a). This includes non-essential analytics and marketing technologies that require consent.

Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies, such as pixels and local storage, can also store information or recognise your device.

We distinguish between the following categories of cookies and similar technologies:

• Necessary technologies used to deliver requested functions, such as maintaining a shopping cart, securing the website and remembering consent choices.
• Optional preference technologies.
• Optional analytics technologies used to understand website use.
• Optional marketing technologies used to measure advertising or personalise marketing.

We ask for your consent before activating non-essential technologies that require it. You can refuse them and later change or withdraw your choice through the website's cookie settings.

The following table describes the main Shopify cookies and the Pandectes consent cookie. Which cookies are used depends on your choices and the functions you use. Durations are maximum configured or published lifetimes; browser limits can shorten them, and renewed use may refresh them:

Cookie	Provider	Purpose	Duration
_pandectes_gdpr	Pandectes, on our domain	Necessary: remembers and documents cookie choices	365 days
localization	Shopify, on our domain	Necessary: localises the shopping cart to the correct country	1 year
cart_currency	Shopify, on our domain	Remembers the shopping cart currency	14 days
_shopify_essential	Shopify, on our domain	Essential store, session, checkout and security information	1 year
_shopify_analytics	Shopify, on our domain	Storefront and checkout analytics	1 year
_shopify_marketing	Shopify, on our domain	Marketing-related information	1 year

Shopify's current cookie information is available at https://www.shopify.com/legal/cookies.

Our website also includes Google Analytics and Google tags, Microsoft Clarity, Meta, Klaviyo, Spoks, Trustpilot, Judge.me, Instafeed, Kaching Bundles, Powerful Form Builder and affiliate or advertising services, including Partner-ads, ShareASale, Reaktion, Bannercrowd and retargeted.co. Pandectes is the installed consent-management service. Loading an integration can disclose technical information such as an IP address even where it does not set a cookie. Instafeed states that its feed itself does not set cookies; requesting embedded Instagram content is a separate interaction with that platform.

Optional analytics and marketing can use identifiers such as Google’s _ga and _ga_* cookies, Meta’s _fbp, Microsoft Clarity’s _clck and _clsk, and Klaviyo’s __kla_id. They help measure visits, connect page views, attribute advertising or recognise newsletter subscribers. Klaviyo publishes a maximum lifetime of two years for __kla_id, subject to browser limits. Cookie lifetimes and the data kept on a provider’s servers are different retention periods. Additional cookies may be used for the cart, payment, login, embedded content or a function you request.

Provider details are available at https://policies.google.com/technologies/cookies, https://www.facebook.com/privacy/policies/cookies/, https://learn.microsoft.com/clarity/setup-and-installation/clarity-cookies and https://help.klaviyo.com/hc/en-us/articles/360034666712. Our cookie settings distinguish necessary, functionality, performance and targeting categories. Some integrations can load in a restricted mode with consent denied; a denied cookie choice does not necessarily prevent every technical request to a provider.

You can also manage or delete cookies through your browser. Blocking necessary cookies may affect website functions. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

These website technologies are separate from the Enkl Sound app described below.

3. When you buy a product

We process the information needed to fulfil your order, including your name, contact details, billing and delivery addresses, products ordered, payment status and relevant correspondence. Where necessary, this may also include company information and delivery instructions.

We use this information to process payment, arrange delivery, send order updates, handle returns and complaints, provide customer service and meet accounting and other legal obligations.

Processing necessary for your purchase is based on GDPR Article 6(1)(b). Processing required by law is based on Article 6(1)(c). Processing necessary to prevent fraud or establish, exercise or defend legal claims may be based on our legitimate interests under Article 6(1)(f).

Relevant information is provided to payment providers, fulfilment providers and carriers as needed to complete the purchase. Depending on the service, a provider may act as our processor or as an independent data controller.

Order and accounting records are kept for the periods required by applicable law. Other customer information is kept only for as long as needed to fulfil the order, handle relevant warranty or complaint matters and resolve any associated legal claims.

4. In the Enkl Sound app

This section describes version 2.0 of the Enkl Sound app for iPhone, iPad and Android.

The app has no user account or profile. During normal use, it does not automatically send personal data to Enkl Sound or third parties. It contains no analytics, advertising or tracking.

The app uses Bluetooth to find and control your Enkl Sound speaker. Your settings, such as your equalizer presets and speaker names, are stored locally on your phone or tablet and on your speaker.

On older Android versions, the operating system may request location permission because Android requires it for Bluetooth scanning. The app does not use that permission to determine or track your location.

If you open a website link from the app, such as a speaker guide or FAQ, the page opens in your browser. The website sections of this policy then apply.

Optional diagnostics for support

You can choose to record a diagnostic report to help us investigate a problem.

Under Help > Diagnostics, you can enable "Diagnostics for support". This is off by default. While enabled, technical information about the app's connection to your speaker is recorded locally on your phone or tablet.

Diagnostics switches off automatically and the locally recorded information is deleted after seven days. Turning diagnostics off deletes that information immediately.

If you tap "Create email", your own email app opens with an encrypted diagnostic report attached, addressed to app@enklsound.com. Nothing is sent unless you send the email yourself.

The report contains technical information, including:

• The app version.
• Your phone or tablet model and operating system version.
• Your speaker model and firmware version.
• Your speaker's battery level.
• Recent communication between the app and your speaker.

If you send the email, we also receive your email address, the content of your message and any other information you choose to include.

We use the email and report only to answer your support request and investigate and resolve the problem you report. We do not use them for advertising or marketing.

The legal basis is our legitimate interest in providing product support and resolving reported problems under GDPR Article 6(1)(f).

Access is limited to authorised people handling support and app development for Enkl Sound. Any service provider processing the information on our behalf must follow our instructions and applicable confidentiality and data protection requirements.

Any third party with whom we share personal data from the Enkl Sound app, or whom we allow to access such data, must provide the same or an equivalent level of protection as described in this policy and required by the applicable app-store privacy rules. This includes external app developers, support providers and any affiliated companies that receive access. Access is limited to what is necessary for the stated support purpose and is subject to appropriate confidentiality, security and data-protection requirements.

Retention of app support data

We delete app support emails and their diagnostic reports no later than 30 days after the support case is closed, and in all cases no later than 90 days after we receive them. This also applies to working copies held for the investigation.

This specific retention period takes precedence over the general email retention criteria in section 8. Separate order, accounting or legal claim records are subject to section 3; diagnostic reports are not retained as accounting records.

Turning diagnostics off on your device does not delete a report you have already emailed to us. You can request deletion of an emailed report by contacting app@enklsound.com. We assess deletion requests in accordance with applicable data protection law.

Earlier app versions

The accounts and associated profile data from earlier versions of the Enkl Sound app have been deleted. Version 2.0 does not require or use those accounts.

For questions about personal data provided through an earlier version, contact contact@enklsound.com.

5. When you subscribe to our newsletter

We process your email address and any name or other information you choose to provide when subscribing.

We use this information to send the newsletters and marketing communications you have requested. The legal basis is your consent under GDPR Article 6(1)(a).

Our newsletter services may process delivery information and information about opens or link clicks to measure and improve communications. Where such tracking requires consent, it is subject to that consent. You may object to direct marketing and related profiling at any time.

You can unsubscribe at any time using the link in a newsletter or by contacting contact@enklsound.com.

We keep your subscription information while your subscription remains active. After you unsubscribe, we stop using it for newsletter marketing. We may retain the minimum information necessary to document consent, respect your unsubscribe request and handle relevant legal claims, based on our legitimate interests under Article 6(1)(f) or a legal obligation under Article 6(1)(c), where applicable.

Unsubscribing does not affect communications needed to fulfil an order or respond to a request you have made.

6. If you are a potential business customer

When we discuss a potential business relationship, we may process your name, business contact details, job title, company information, relevant professional profile information and correspondence.

The information may come from you, your organisation or publicly available professional sources.

We use it to respond to enquiries, assess a potential collaboration and manage the business relationship. The legal basis is our legitimate interest in developing and maintaining relevant business relationships under GDPR Article 6(1)(f).

This does not give us a general right to send unsolicited electronic marketing. Marketing must also comply with applicable marketing rules.

We keep the information while there is an active enquiry or a relevant business relationship, and thereafter only where necessary to meet legal obligations or handle relevant claims. You may object to processing based on our legitimate interests.

7. If you apply for a job

We process the information you provide in your application, CV and related correspondence. This may include your name, contact details, employment history, education, qualifications and skills.

We use the information to assess your application and communicate with you about recruitment. Depending on the circumstances, the legal basis is taking steps at your request before entering into an employment contract under GDPR Article 6(1)(b), our legitimate interest in managing recruitment under Article 6(1)(f), or a legal obligation under Article 6(1)(c).

Please do not send sensitive personal information unless it is specifically requested and necessary.

Application information is kept while the recruitment process is active and afterwards only for as long as necessary to handle relevant claims or meet legal obligations.

If we wish to retain your application for future opportunities, we ask for separate consent. With that consent, we retain it for up to two years. You can withdraw that consent at any time by contacting contact@enklsound.com.

8. If you contact us by email

We process your email address, name, message and any attachments or other information you provide.

We use this information to respond and handle the matter you contact us about. The legal basis is normally our legitimate interest in answering enquiries under GDPR Article 6(1)(f). Where your message concerns a purchase, a request to enter into a contract or a legal obligation, Articles 6(1)(b) or 6(1)(c) may apply instead.

We retain correspondence while the matter is active and afterwards only where needed to fulfil related obligations, document the handling of a complaint or establish, exercise or defend relevant legal claims. Information that is no longer needed is deleted.

App support emails and diagnostic reports are subject to the specific, shorter retention period in section 4.

9. Who receives personal data?

We use service providers to help operate our website and business. These include Shopify for the webshop, Spoks and Klaviyo for installed marketing integrations, Pandectes for consent management and, depending on your interaction with us, providers of payment, fulfilment, delivery, customer service, accounting and technical support services.

Other installed integrations support forms, reviews, embedded content, shipping, product feeds and order administration. Depending on the feature you use, these can include Powerful Form Builder, Judge.me, Trustpilot, Instafeed, Kaching Bundles, Shipmondo and other connected Shopify apps.

Providers acting as processors may process personal data only under our instructions and appropriate data processing agreements. Independent data controllers, such as certain payment providers or carriers, are responsible for their own processing.

We may also disclose information to professional advisers or public authorities where necessary and legally justified.

We limit disclosures to the information needed for the relevant purpose.

Shopify Network Intelligence

Shopify Network Intelligence is enabled for our store. Through these services, Shopify may combine information about interactions and transactions in our store with information from other merchants and Shopify to provide and improve analytics, personalisation and advertising services. For this processing, Shopify acts as an independent data controller. Shopify's Consumer Privacy Policy explains its processing and how to exercise rights: https://www.shopify.com/legal/privacy/consumers. Where required by law, this processing is subject to consent and the applicable opt-out or objection rights.

10. Transfers outside the EU/EEA

Some service providers may process personal data outside the EU/EEA. Such processing must be covered by a valid transfer mechanism under applicable data protection law.

For transfers to the United States, the EU-U.S. Data Privacy Framework can be used only where the relevant recipient is covered by an applicable adequacy decision and holds the necessary active certification.

Where no applicable adequacy decision covers a transfer, appropriate safeguards are required, such as the European Commission's Standard Contractual Clauses together with any necessary supplementary measures.

You can contact contact@enklsound.com for information about relevant international transfers and to request information about or a copy of the applicable safeguards, subject to lawful redactions.

The following published arrangements are relevant to services identified in our store:

• Shopify's Data Processing Addendum provides for approved Binding Corporate Rules for relevant transfers within the Shopify group and Standard Contractual Clauses for relevant other transfers. Our store's Shopify hosting setting is European Union; this does not exclude international processing or support access. See https://www.shopify.com/legal/dpa.
• Pandectes OÜ, Estonia, processes information for consent management under its published Data Processing Agreement. Its subprocessor list identifies storage of website consent records with Amazon Web Services in Ireland. It separately lists services used for merchant administration and support, including Cloudflare with global processing and Standard Contractual Clauses or an applicable adequacy decision, and customer.io with EU hosting and Standard Contractual Clauses for access from outside the EEA. These merchant-service arrangements do not mean that every listed provider receives website visitors' consent records. See https://pandectes.io/dpa/ and https://pandectes.io/sub-processors-list/.
• Klaviyo's Data Processing Agreement provides for the EU-U.S. Data Privacy Framework for covered transfers and Standard Contractual Clauses where the Framework cannot be relied on. Its published information states that the platform and customer data are hosted in the United States. See https://www.klaviyo.com/legal/data-processing-agreement.
• Spoks Technologies Inc. is a US company. Its published Data Processing Agreement incorporates the controller-to-processor Standard Contractual Clauses for relevant EEA transfers. See https://spoks.com/legal/dpa.
• Microsoft states that EU Clarity customers contract with Microsoft Ireland Operations Limited and that Standard Contractual Clauses support relevant transfers to Microsoft Corporation in the United States. See https://learn.microsoft.com/clarity/faq/.
• Globo / Powerful Form Builder publishes information about processing in Vietnam and service providers in the United States, Canada and France. Its DPA refers to Standard Contractual Clauses for relevant transfers. See https://globo.io/dpa/.
• Judge.me publishes a DPA incorporating Standard Contractual Clauses for relevant transfers. See https://judge.me/help/en/articles/8364277-gdpr-compliance-at-judge-me.

11. Security

We use technical and organisational measures appropriate to the personal data and risks involved, including restricting access to people who need it for their work.

Please avoid including unnecessary personal information in messages or diagnostic support requests.

12. Your rights

Depending on the circumstances and the legal basis for processing, you have the right to:

• Request access to your personal data and information about how they are processed.
• Have inaccurate information corrected.
• Request deletion.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Receive data you have provided in a structured, commonly used and machine-readable format and, where applicable, have them transferred to another controller.
• Withdraw consent at any time where processing is based on consent.

You may object to the use of your personal data for direct marketing at any time. If you do, we stop processing them for that purpose.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Some rights are subject to legal conditions or exceptions, including where retention is required by law.

To exercise your rights, contact contact@enklsound.com. For an app diagnostic report, you may also contact app@enklsound.com. We may request proportionate information to verify your identity where necessary.

You may complain to the Danish Data Protection Agency, Datatilsynet, at https://www.datatilsynet.dk, or to another competent supervisory authority.

13. Changes to this policy

We update this policy when our processing changes or clarification is needed. The date at the top shows when the text was last updated. Where required, significant changes will be brought to your attention separately.