LAYER 02 goes up 01 Dec

Last updated: 28 September 2026

This Privacy Policy explains what personal data we collect when you visit the Division Studios online store, shop with us or get in touch. It also explains why we use the data, who we share it with and what rights you have.

This page is our only privacy policy. Every sign-up and notification form in the store links to it. On the password page shown before the store opens, the full text of this page opens under the sign-up form.

We process personal data under the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

Who is responsible for your data

The data controller is Division Studios.

• Email: mikkel08mau@gmail.com

If you have a question about this policy or your data, email us at mikkel08mau@gmail.com.

At a glance

The details for each activity are below.

What we collect and why

Orders and checkout

• Data: your name, billing and delivery address, email address, phone number, the items you order, order number, prices, shipping method and payment status.
• Data we get from others: the result of the payment and of fraud checks from our payment providers and Shopify, and delivery updates from the carrier. If someone else orders for you, we get your name, delivery address and, if given, your phone number from them.
• Payments: you enter your payment details directly with our payment providers. Division Studios never sees or stores your full card number.
• Purpose: to process, ship and deliver your order and send you order and shipping emails, including your tracking link. We also use the data to handle returns, withdrawals, refunds and complaints, to keep our accounting records and to protect the store and our customers against fraud and misuse.
• Legal basis: Art. 6(1)(b) GDPR, because we need the data to perform our contract with you. Art. 6(1)(c) GDPR, to meet our legal obligations under the Danish Bookkeeping Act and consumer law. Art. 6(1)(f) GDPR, our legitimate interest in preventing fraud and in establishing, exercising or defending legal claims.
• How long:
  • Invoices, payment records and other accounting records: 5 years from the end of the financial year in which the order was placed, as the Danish Bookkeeping Act requires.
  • Emails and other messages about an order: until the 2-year period for complaints about defects and the 3-year limitation period for claims have run out. If a claim is ongoing, we keep them until it is settled. Withdrawal requests are kept as described under Withdrawal form.
  • Your remaining order data in Shopify: we delete or anonymise it when the 5-year period for accounting records has ended.

You must give us your name, delivery address and email address to place an order. Without them we cannot process or deliver your order.

Customer accounts

• Data: your name, email address, login details, saved addresses and order history.
• Purpose: to let you log in, see your orders and save your addresses.
• Legal basis: Art. 6(1)(b) GDPR, because you asked us to provide the account.
• How long: for as long as you keep the account. You can ask us to close it at any time. The orders in your order history are kept as described under Orders and checkout.

You don't have to create an account. If your account uses a password, we cannot see it.

Newsletter

• Data: your email address, when and where you signed up and your email marketing consent. We store this as a customer profile in Shopify.
• Where you sign up: in the footer, in the newsletter section, or on the password page shown before the store opens. Each of these forms tells you what we send (drops, restocks and offers by email) and that you can unsubscribe at any time. It also links to this Privacy Policy. On the password page, the text of this policy opens under the form.
• Purpose: to send you emails about new drops, restocks and offers from Division Studios.
• Legal basis: Art. 6(1)(a) GDPR, your consent. The Danish Marketing Practices Act also requires your consent before we send you marketing emails.
• How long: until you unsubscribe. After you unsubscribe, we stop sending you marketing emails. If you also have an account or have placed orders, we keep your customer details for those purposes as described above.

After you unsubscribe, we keep a record of your email address and of when you gave and withdrew your consent for 2 years. We use this record only to be able to show that you gave your consent and that we respected your choice, and then we delete it (Art. 6(1)(f) GDPR).

You can unsubscribe at any time with the link in every newsletter or by emailing mikkel08mau@gmail.com.

Drop reminders

• Data: your email address, the name of the drop you want a reminder for and when you sent the request. Your request reaches us as a message through Shopify's contact form. It does not create a customer profile in Shopify.
• Where you sign up: in the drop countdown section.
• Purpose: to email you when that drop goes live. The form says: "We only use your email to tell you when the drop goes live." It also links to this Privacy Policy.
• Legal basis: Art. 6(1)(a) GDPR, your consent.
• How long: until we have sent the reminder. Then we delete your request. If you have also signed up for our newsletter, created an account or placed an order, we keep your customer details for those purposes as described above.

We use your email address only for that one drop reminder. A drop reminder does not sign you up for our newsletter. We do not send you our newsletter or other marketing unless you sign up for it separately.

You can cancel your reminder at any time by emailing mikkel08mau@gmail.com. If you cancel before we have sent it, we delete your request.

Restock notifications

• Data: your email address, the product and size you want and when you sent the request. Your request reaches us by email through Shopify's contact form.
• Where you sign up: on a product page, when the size you want is sold out.
• Purpose: to email you when that product and size is back in stock. The form says: "We only use your email to tell you when it's back." It also links to this Privacy Policy.
• Legal basis: Art. 6(1)(a) GDPR, your consent.
• How long: until the item is back and we have told you, or for at most 12 months after your request. Our drops are limited, and sold-out pieces may not come back. If yours doesn't, we delete your request after 12 months. If you have also signed up for our newsletter, created an account or placed an order, we keep your customer details for those purposes as described above.

A restock notification does not sign you up for our newsletter. We do not send you our newsletter or other marketing unless you sign up for it separately.

After we have told you the item is back, we keep a record of your email address and of when you asked for the notification for 2 years, to be able to show that you gave your consent. Then we delete it (Art. 6(1)(f) GDPR).

You can cancel your request at any time by emailing mikkel08mau@gmail.com. If you cancel before we have told you, we delete your request.

Contact form and emails

• Data: your name, your email address, your phone number if you choose to give it, your message and anything else you include.
• Purpose: to answer your question and follow up on it.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in replying to people who contact us. If your message is about an order or a purchase you are considering, Art. 6(1)(b) GDPR.
• How long: we delete your message 12 months after your question has been answered. Messages about an order are kept as described under Orders and checkout. Withdrawal requests are kept as described under Withdrawal form.

You can reach us through our Contact page or by emailing mikkel08mau@gmail.com.

Please do not send us sensitive information, such as health data or card numbers, through the form or by email.

Withdrawal form

• Data: your name, email address, order number, order or delivery date, the items you are withdrawing from and any message you add. We also record the date and time you submitted the form. Your withdrawal reaches us by email through Shopify's contact form.
• Purpose: to register and process your withdrawal from the contract, email you an acknowledgement of receipt with the content of your withdrawal and the date and time you submitted it, refund you and keep a record of the withdrawal.
• Legal basis: Art. 6(1)(c) GDPR, to meet our obligations under the Danish Consumer Contracts Act (forbrugeraftaleloven), including confirming receipt of your withdrawal on a durable medium. Art. 6(1)(b) GDPR, to settle the contract with you. Art. 6(1)(f) GDPR, our legitimate interest in being able to document the withdrawal if there is a dispute.
• How long: we keep your withdrawal, our acknowledgement of receipt and the refund record together with the order they relate to. We keep them for 5 years from the end of the financial year in which we refunded you or otherwise closed the case. Refund records are part of our accounting records, which the Danish Bookkeeping Act requires us to keep for 5 years.

Withdrawals you send us by email or post are stored and kept in the same way. The acknowledgement of receipt described above is sent for withdrawals submitted through our withdrawal form.

To learn more about your right of withdrawal, see our Right of Withdrawal page. To see how to send items back, see our Returns page. To withdraw or return items, use the withdrawal form or email mikkel08mau@gmail.com.

Visiting the store, cookies and browser storage

• Data: technical data such as your IP address, your browser and device type and the pages you request. Shopify processes this data to deliver the store. The theme's fonts and files come from Shopify's own content delivery network (such as cdn.shopify.com and fonts.shopifycdn.com). If you accept analytics or marketing cookies, also how you use the store, such as the pages you view, the site you came from and what you add to your cart or buy.
• Purpose: to show you the store, keep it working and secure, and remember your cart. If you allow preference cookies, also to remember your choices. If you accept analytics or marketing cookies, also to understand how the store is used and to measure our marketing.
• Legal basis:
  • Art. 6(1)(f) GDPR, our legitimate interest in running a working and secure store.
  • For cookies needed to provide something you ask for, such as your cart or checkout, also Art. 6(1)(b) GDPR.
  • Cookies and similar technologies that are not strictly necessary, for preferences, analytics and marketing, including the theme's own browser storage: our cookie banner asks every visitor for consent, and we only use them if you accept them. The legal basis is your consent (Art. 6(1)(a) GDPR).
• How long:
  • Technical data, such as your IP address and device data: Shopify keeps it only as long as it is needed to deliver the store and keep it secure.
  • Data about how you use the store (analytics): we keep it for up to 2 years. Then we delete it or keep it only in anonymous, aggregated form, such as visitor numbers.
  • The theme's own items in your browser: as described below.
  • Shopify's cookies: for the periods shown in Shopify's cookie list. How long a cookie stays in your browser is not the same as how long we keep the data collected through it. Our Cookie Policy has the full details.

Shopify sets its own cookies for the cart, session, checkout, security, your cookie choices and Shopify analytics. Shopify lists them in its cookie list. Cookies that are not strictly necessary, such as analytics cookies, are only used if you accept them in our cookie banner.

The theme itself can save three small items in your browser. It saves them only if you allow preference cookies in our cookie banner. Without that permission, nothing is saved, and these features work only on the page you are on.

• ams.size (local storage): remembers the size or sizes you picked, for tops and bottoms, so they are already marked on other products. The size you pick on a product page is remembered in the same way. It stays on your device until you use "Forget my size", clear this store's site data in your browser, or withdraw your consent to preference cookies. "Forget my size" clears all your saved sizes. You find it in the "Your size" menu on collection pages, in search results and in the product grid on the homepage.
• ams.view (local storage): remembers whether you prefer grid or list view on collection and search pages. It stays on your device until you clear this store's site data or withdraw your consent to preference cookies.
• ams-pasted (session storage): makes the intro animation play only once per browser session. It is cleared when your browser session ends.

If you allow preference cookies later, the theme then saves the choices you have made on the page you are on. If you decline or later withdraw your consent to preference cookies, the theme deletes all three items.

These items stay on your device, and the theme does not send them to us.

The theme does not load Google Fonts, third-party analytics or advertising pixels. If we add apps that do, we will update this policy and our Cookie Policy and ask for your consent first.

Our Cookie Policy has the full details. You can change or withdraw your choices at any time with the "Cookie settings" button in the footer.

Who we share your data with

We only share personal data when it is needed for the purposes above. Service providers that process data for us (data processors) may use it only on our instructions and under a data processing agreement.

• Shopify. Our store runs on Shopify. For EU merchants, Shopify's contracting and processing entity is Shopify International Limited, Ireland. Shopify hosts the store and checkout, stores customer and order data, handles our forms and provides analytics. It does this for us as our data processor.
• Shopify as an independent controller. Shopify also uses some data for its own purposes: for Shop Pay and the Shop app if you choose to use them, for fraud prevention and platform security, and, where enabled, to provide services that use data from your interactions with other Shopify stores. Shopify's own Consumer Privacy Policy explains this processing and how you can use your rights towards Shopify.
• Payment providers. They process your payment details to complete the payment and to prevent payment fraud. They usually do this as independent controllers under their own privacy policies.
• Shipping carriers. They receive your name and delivery address. Where they need it for delivery updates, they also receive your email address or phone number. For orders shipped outside the EU, we also share customs information with the carrier and with customs authorities.
• Email services. Our email providers send our order, service and marketing emails and host the inbox where your messages and form submissions arrive. If we change how we send our emails, we will update this policy.
• Authorities and advisers. We share data with public authorities, courts or professional advisers when the law requires it or when needed to establish, exercise or defend legal claims.

Our footer may link to our social media profiles. If you follow such a link, the platform's own privacy policy applies. The theme does not embed social media plugins.

Transfers outside the EU/EEA

Shopify may transfer personal data to Canada, the United States and other countries where its sub-processors operate. Some of our other providers may also process data outside the EU/EEA.

When personal data is transferred outside the EU/EEA, one of these safeguards protects it:

• An adequacy decision by the European Commission, which confirms that the country gives an adequate level of protection. Canada has one for organisations covered by its federal private-sector privacy law (PIPEDA), which includes Shopify's Canadian parent company, Shopify Inc.
• The EU-US Data Privacy Framework, an adequacy decision that covers recipients in the United States certified under it.
• Standard contractual clauses approved by the European Commission, where there is no adequacy decision.

If you order delivery to a country outside the EU/EEA, we must share your delivery details with carriers and, where required, with customs authorities in that country. This transfer is necessary to perform our contract with you (Art. 49(1)(b) GDPR).

To get more information about these safeguards or a copy of them, email mikkel08mau@gmail.com.

Your rights

You have the following rights under the GDPR:

• Access: to find out whether we process your data and to get a copy of it.
• Rectification: to have incorrect data corrected and incomplete data completed.
• Erasure: to have your data deleted, for example when we no longer need it or you withdraw your consent. We may keep data the law requires us to keep, such as accounting records.
• Restriction: to ask us to limit how we use your data, for example while we check whether it is correct.
• Data portability: to receive the data you gave us, where we process it based on consent or contract and by automated means, in a structured, commonly used and machine-readable format. You can also ask us to send it to another controller where this is technically possible.
• Objection: to object, on grounds relating to your situation, to processing based on our legitimate interests. You can always object to direct marketing, and we will then stop.
• Withdrawing consent: to withdraw your consent at any time. This does not affect processing that took place before you withdrew it.

Your right to object

You can object at any time, on grounds relating to your particular situation, to processing we base on our legitimate interests (Art. 6(1)(f) GDPR), for example fraud prevention or documenting a withdrawal. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You can object to direct marketing at any time, and we will stop using your data for it.

To object, email mikkel08mau@gmail.com. For marketing emails, you can also use the unsubscribe link in every newsletter.

How to use your rights

Email us at mikkel08mau@gmail.com.

You can withdraw or change your consent to cookies and browser storage at any time with the "Cookie settings" button in the footer. You can also block or delete cookies in your browser settings.

It is normally free of charge. We may charge a reasonable fee for extra copies of your data. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it.

We reply within one month. If your request is complex, or you send us many requests, we may need up to two more months. If so, we will tell you within the first month.

We may ask you to confirm your identity, for example by writing from the email address you used for your order.

If you have an account, you can also see and update some of your details yourself after logging in.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Payment providers may run automated checks for payment fraud when they process your payment. Their own privacy policies cover these checks.

Children

Our newsletter, drop reminders and restock notifications are based on your consent. You can give that consent yourself if you have reached the age of digital consent where you live. It is 15 in Denmark and between 13 and 16 in other EU/EEA countries.

If you are younger than that, please ask a parent or guardian to agree before you sign up.

If we learn that a child below that age in their country has signed up without a parent's or guardian's consent, we will delete their email address.

If you think a child has given us personal data, contact us at mikkel08mau@gmail.com. We will delete it unless the law requires us to keep it.

Changes to this policy

We may update this policy when our store, our services, our email set-up or the law change. The date at the top of this page shows when we last updated it.

If we make significant changes, we will point them out clearly on this page. Where appropriate, we will also tell you by email.