Privacy policy

1. Who is responsible

DDIP ApS, CVR 39586002, Denmark, is the data controller for the personal data described in sections 2 and 3. Questions about privacy can be sent to info@mojitiles.com.

2. Our customers and their staff

When you create an account and use mojitiles, we process:

What	Why	Legal basis (GDPR)
Name, email address and password (stored encrypted)	To create and secure your account and to contact you about it	Contract, art. 6(1)(b)
Company details, package and invoices	To bill you and keep our accounts	Contract and legal obligation, art. 6(1)(b) and (c)
Widget settings, brand colours, discount codes and websites	To provide the Service	Contract, art. 6(1)(b)
Emails and messages you send us	To answer you and give support	Legitimate interest, art. 6(1)(f)
Login and security logs	To keep the Service secure and prevent misuse	Legitimate interest, art. 6(1)(f)

We may send you emails about your account, your package and important changes to the Service. If we send you news or offers, you can unsubscribe at any time.

3. Visitors to mojitiles.com

Our website uses a session cookie that is needed to log in and to keep forms secure. It is deleted when you close your browser or log out. We don't use advertising or tracking cookies on our website.

Our web server keeps short technical logs (such as IP address, browser and the page requested) to keep the website running and secure. The website loads fonts from Google Fonts, which means your browser contacts Google's servers.

4. Visitors to our customers' websites

When a shop adds a mojitiles widget to its website, the widget collects data about the visitors to that website, so the shop can see how the widget is used. For this data, the shop is the data controller and DDIP ApS is the data processor. We only process the data on the shop's behalf, to provide the Service, and never for our own purposes.

The widgets can collect:

• the website and page where the widget was shown;
• technical information: IP address, browser, operating system, device type and language;
• approximate location (country and, where available, city), worked out from the IP address;
• how the widget was used, for example opened, game started, won or lost, reward shown or copied, emoji clicked or button clicked;
• an anonymous visitor ID, so the same visitor can be counted once;
• for the contact form: the name, email address and message the visitor writes.

Games may save the visitor's progress in their own browser (local storage), so a game can be continued later. The widgets do not use advertising or tracking cookies.

If you are a visitor and have questions about your data, please contact the shop whose website you visited. They decide what the data is used for. We will help the shop answer your request.

Data processing terms for our customers

These terms form the data processing agreement between you (the controller) and DDIP ApS (the processor), as required by GDPR article 28:

• We only process visitor data on your documented instructions, which are these terms and the settings you choose in the Service.
• Everyone at DDIP ApS who has access to the data is bound by confidentiality.
• We use appropriate technical and organisational security measures, including encrypted connections (HTTPS), access control and backups.
• We use sub-processors for hosting and email (see section 6). We will inform you before we add or replace a sub-processor, and you may object.
• We help you answer requests from data subjects and with your obligations on security, breach notification and impact assessments.
• We notify you without undue delay if we become aware of a personal data breach affecting your data.
• When the agreement ends, we delete the data as described in section 7, unless the law requires us to keep it.
• We make the information needed to show compliance available to you, and allow reasonable audits.

You are responsible for having a legal basis for the processing and for informing your visitors, for example in your own privacy policy.

5. Sharing data

We don't sell personal data. We only share it with:

• suppliers who help us run the Service (see section 6);
• our accountant and public authorities, when the law requires it;
• the shop that owns the widget, for data collected by that shop's widgets.

6. Sub-processors and transfers

We use a small number of suppliers to host the Service and send email. They only process data on our instructions and under a data processing agreement. We aim to keep data within the EU/EEA. If data is transferred outside the EU/EEA, we make sure there is a valid legal basis, such as the EU Commission's standard contractual clauses. You can ask us for a list of our current sub-processors.

7. How long we keep data

• Account data: as long as your account is active. When it is closed, we delete it within 30 days.
• Invoices and accounting records: 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.
• Widget statistics and contact form messages: as long as the shop's account is active, and deleted within 30 days after it is closed. Shops can delete contact form messages themselves at any time.
• Backups: data can remain in backups for up to 30 days after it has been deleted.

8. Your rights

Under the GDPR you have the right to:

• get access to the personal data we have about you;
• have incorrect data corrected;
• have your data deleted;
• restrict or object to our processing;
• receive your data in a structured, machine-readable format (data portability).

To use your rights, email info@mojitiles.com. We answer within one month.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

9. Changes

We may update this policy. If the changes are important, we will tell our customers by email or in the dashboard. The date at the top shows when it was last changed.