Privacy Policy
Who We Are (Data Controller)
Your personal data is controlled by:
A1 (CVR no. 32355643)
Hjortegyden 18, 5560 Aarup, Denmark
Email: [email protected]
We are registered in Denmark and subject to the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).
What Data We Collect and Why
Shipment data
When you create a shipping label, you provide sender and recipient names, addresses, postal codes, countries, and optionally phone numbers and email addresses. For international shipments you may also provide a description of goods and customs values. We use this data to create the shipping label and transmit the necessary information to the carrier you select.
Legal basis: Article 6(1)(b) GDPR — performance of a contract.
Payment data
We collect the currency, amount, and order reference associated with each transaction. Card details, bank account numbers, and other sensitive payment credentials are collected and processed exclusively by Mollie B.V. (our payment service provider), not by us. We receive only a payment status confirmation and a transaction reference from Mollie. Mollie's privacy practices are governed by Mollie's Privacy Statement.
Legal basis: Article 6(1)(b) GDPR — performance of a contract; Article 6(1)(c) — compliance with financial record-keeping obligations.
Account data
If you create an account, we store your email address, name, and billing details. Your prepaid wallet balance and transaction history are kept as part of your account. Invoices are retained for 5 years as required by the Danish Bookkeeping Act (Bogføringsloven). Sign-in is by email link (magic link); we do not store passwords.
Legal basis: Article 6(1)(b) GDPR — performance of a contract; Article 6(1)(c) — compliance with legal obligations.
Technical and usage data
When you visit the site, we receive standard server-log data including your IP address, browser type, and the pages you request. We use IP geolocation solely to pre-select your country and currency; we do not store geolocation results beyond your session.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in operating a secure and correctly-localised service.
Usage analytics and session recordings
Applies when analytics runs in automatic mode: To understand how the site is used, we make first-party, cookieless recordings of page interactions (clicks, scrolling, navigation, and masked page content) on the public pages — never inside your account. These recordings are fully masked: everything you type — names, addresses, email addresses, card fields, and customs details — is hidden inside your browser before anything is sent to us. With each visit we store your country and a shortened, hashed form of your IP address, never the full address; if you are signed in, the visit is linked to your account. No cookies or other identifiers are placed on your device, and the data is processed only by us. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is recorded unless you allow it. Legal basis: Article 6(1)(f) GDPR — legitimate interests in improving the service; you may object at any time (see §5).
Applies when analytics runs in consent mode: We make usage recordings and collect interaction events only after you choose "Allow analytics" in the small banner shown at the bottom of the page. Until you allow it, nothing is recorded; if you choose "No thanks", no analytics data is collected. Your choice is stored in your browser's local storage (key 321_analytics) and can be withdrawn at any time. Recordings are fully masked as described above. Legal basis: Article 6(1)(a) GDPR — consent.
- Microsoft Clarity: Where this mode is enabled, Microsoft (Microsoft Ireland Operations Ltd.) acts as our processor for product-analytics session replay and is loaded only after you choose "Allow analytics" — never before. Microsoft's processing is governed by the Microsoft Privacy Statement.
Applies when analytics is turned off: We do not make any usage recordings and do not collect analytics or interaction events. Only the standard server-log data described above is processed.
Support correspondence
If you contact us by email, we retain that correspondence to handle your inquiry and to maintain a record of the resolution.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in responding to and documenting customer inquiries.
Who We Share Your Data With
We share personal data only as necessary to provide the service:
- The carrier you choose (GLS, PostNord, DHL, UPS, DAO, Bring, and others): Shipment data (sender and recipient addresses, parcel dimensions, weight, and for international shipments customs information) is transmitted to the carrier selected at checkout. The carrier's own privacy policy applies to their handling of this data.
- Mollie B.V.: Payment processing. Mollie acts as a data processor and independent data controller for payment data, regulated under Dutch and EU law.
- Microsoft: We send transactional emails (label confirmations, magic-link sign-in emails) via Microsoft 365.
- Cloudflare: Our network, security, and DNS provider. All traffic passes through Cloudflare's edge network.
- Hosting provider: Our servers are hosted with a third-party infrastructure provider in the United States (New York).
- Google Fonts: Font files are loaded from Google's CDN when you visit the site. Google may log the request.
- Address and location services: The front page uses the Danish address register, an OpenStreetMap-based geocoder, and an IP-to-country look-up service to help you enter addresses and to pre-select your country and currency. Only the data you type or your IP address is sent; we do not store the responses.
We do not sell, rent, or trade your personal data to any third party for marketing or profiling purposes.
How Long We Keep Your Data
- Order and shipment records (addresses, label data, payment references, invoices): retained for 5 years from the date of the transaction, as required by Danish bookkeeping law (Bogføringsloven).
- Server logs (IP addresses, access logs): rolling 30-day retention, then deleted.
- Usage recordings and analytics events: retained for 30 days, then automatically deleted.
- Support emails: retained for the duration needed to resolve the inquiry and for up to 2 years thereafter.
Your Rights Under GDPR
As a data subject in the EU/EEA or the UK, you have the following rights. To exercise any of them, contact us at [email protected]. We will respond within one month (extendable by two further months for complex requests).
Request a copy of the personal data we hold about you (Art. 15 GDPR).
Ask us to correct inaccurate or incomplete data (Art. 16 GDPR).
Request deletion of your data where we have no overriding legal basis for retaining it (Art. 17 GDPR). Note that accounting records must be retained for 5 years.
Receive your data in a structured, machine-readable format where processing is based on contract or consent (Art. 20 GDPR).
Object to processing based on legitimate interests (Art. 21 GDPR). We will stop unless we can demonstrate compelling legitimate grounds.
Request that we restrict processing while a dispute about accuracy or legal basis is resolved (Art. 18 GDPR).
Cookies and Local Storage
321label.com sets one strictly necessary session cookie for signed-in users. We use the browser's local storage to remember your language, currency, and country choices, and to hold the order token of a purchase in progress. We do not set advertising cookies, analytics cookies, or third-party tracking cookies. No data from local storage is shared with third parties.
Applies when analytics runs in automatic mode: Our usage analytics are cookieless and first-party — they store no cookies and no identifiers on your device. The recording session is held in memory only and is not persisted in your browser.
Applies when analytics runs in consent mode: If you accept analytics, we store your choice in local storage under the key 321_analytics. Where Microsoft Clarity is enabled, it is loaded only after your consent and may set its own cookies; choosing "No thanks" or withdrawing consent prevents this.
Applies when analytics is turned off: No analytics cookies, identifiers, or storage keys are set beyond the strictly necessary items listed above.
International Data Transfers
Our servers are located in the United States (New York). Personal data of users in the EU/EEA is therefore transferred to the United States. The legal basis for these transfers is the European Commission's Standard Contractual Clauses (SCCs). Where a recipient is certified under the EU–US Data Privacy Framework, that certification forms an additional transfer basis.
When you ship to a destination outside the EEA, the carrier will process shipment data (including addresses) in the destination country. This is inherent to the nature of the service and is covered by Article 49(1)(b) GDPR (transfer necessary for the performance of a contract).
Security
We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, and destruction. Payment data never transits our servers — it is submitted directly to Mollie over an encrypted connection.
Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be published on this page with a revised "last updated" date. Continued use of the service after the updated date constitutes acknowledgement of the revised policy.
How to Contact Us
For any privacy-related question, request, or complaint: [email protected]
If you are not satisfied with our response, you have the right to lodge a complaint with the Danish data protection supervisory authority:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
datatilsynet.dk · [email protected]