PRIVACY POLICY

1. INTRODUCTION

It is important to GoWish ApS ("GoWish", "we", "us" or "our") that you feel confident about how we handle your personal data ("Personal Data"). We therefore have a privacy policy describing how we process the Personal Data we collect when you create an account on and use our website GoWish.com ("the Website") and our app GoWish ("the Platform"). Our processing is carried out responsibly, with respect for your privacy, and in accordance with the principles and requirements of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

The purpose of this privacy policy is, among other things, to inform you about how we specifically process Personal Data and about your rights in connection with that processing.

The Website and the Platform are collectively referred to below as "the Services".

Your use of the Services and submission of your Personal Data to us constitutes your acknowledgement that you have received and read this privacy policy.

This privacy policy was last updated on 25 March 2026.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The data controller for the processing of your Personal Data is:
GoWish ApS
Amerika Plads 19, 3rd floor
2100 Copenhagen Ø
CVR number: 41284366

If you have questions about the processing of your Personal Data, please contact our data protection team at privacy@gowish.com.

3. DESCRIPTION OF PROCESSING ACTIVITIES

3.1. ØNSKESKYEN'S PROCESSING ACTIVITIES

Below is an overview of the categories of Personal Data we process about you, as well as the purposes and legal bases for our processing.

Our processing does not include sensitive Personal Data.

3.1.1. Profile, sub-accounts and kids accounts on GoWish's Services

Purpose: To administer and deliver the Services — including creation, activation, deactivation and maintenance of the Services and your profile and any sub-accounts — we request certain Personal Data from you. Failure to provide this data may mean we cannot enter into a contractual relationship with you, and you may be unable to use our Services.

Categories of Personal Data:

• Name, email address, date of birth and gender
• Wishes you create in your profile and wishes you reserve
• Phone number and profile picture, if you have chosen to add these to your profile

When creating sub-accounts or kids accounts, including wish lists for others, we process name, age and gender based on the information you provide when activating the account. If you use information about other individuals, you must ensure those individuals are also made aware of this privacy policy.

Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of a contract with you.

For phone number and profile picture: Article 6(1)(f) GDPR — legitimate interest in communicating with you and providing a personalised experience.

3.1.2. Development and improvement of Services and solutions

Purpose: Personal Data is processed for the development and improvement of the Services — for example through data analysis — as well as for the development of new services and solutions.

Categories of Personal Data:

• Name, email address, phone number (if provided), date of birth and gender
• Wish list details (list name, wish descriptions including product name, description, image and price, reservations, etc.)

Legal basis: Article 6(1)(f) GDPR — legitimate interest in improving and developing the Services and solutions, including generating useful and accurate statistics.

3.1.3. When you activate "Invite your friends" via the Platform

Purpose: To make it easier for you to find and connect with friends who already use the app, and to invite friends who do not.

Categories of Personal Data:

• Contact list (to find and connect you with friends who already use the app, and to invite those who do not)

You can disable this feature in your phone's settings at any time. GoWish only syncs phone contacts if you actively grant permission via your phone's settings. You can stop synchronisation and remove access by going to your phone's app settings and disabling "Contacts". If you have never granted permission, GoWish does not have access to your contacts.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in helping you invite friends to your wish list.

3.1.4. Marketing in the form of newsletters

Purpose: Personal Data is processed so that GoWish can send you newsletters and information about products or services related to GoWish and its partners via electronic media, such as email, SMS or push notifications, where you have given your consent in accordance with the Danish Marketing Practices Act. We do not send newsletters to users under the age of 15.

Categories of Personal Data:

• Email address and phone number (if provided)

Legal basis: Article 6(1)(a) GDPR — your consent. Processing of data relating to whether you open and click in our newsletters is based on Article 6(1)(f) GDPR — legitimate interest in assessing whether users engage with our newsletter content.

3.1.5. Recommendations and inspiration lists on the Services

Purpose: GoWish is designed to help you find content and wishes that match your needs and interests. We therefore provide recommendations and inspiration lists in our inspiration universe to deliver better personalised content and more relevant product information. For this purpose, we segment users' wishes based on basic demographic data and compile statistics at an aggregate level based on wish list items, age and gender. The goal is to create top lists of popular products for various occasions and present these to you in your profile.

Categories of Personal Data:

• Demographic data (gender, age, country)
• Products on your wish list

Please note: Recommendations and inspiration lists may contain advertisements and affiliate links.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in providing better individual services and more relevant product information.

3.1.6. Targeted Advertising and Retargeting

Purpose of the processing: We process your personal data to show you relevant marketing about Ønskeskyen and our partners' products on the digital media and social platforms you use. This includes targeted advertising based on your interests and behaviour, as well as retargeting, where you as a previous visitor may be shown relevant ads on third-party platforms and social media such as Facebook, Instagram and Google. In connection with this, we may share your email address in hashed form with selected platforms and partners in order to match you with relevant advertisements.

Categories of personal data: The categories of personal data we may process in connection with this activity include:

• Demographic data (gender, age, country)
• Products on your wish list
• Email address (in hashed form when shared with third parties)
• Phone number (if provided)
• Behavioural data, including visits to Ønskeskyen's website and app (used for retargeting, exclusion and lookalike audiences)

Legal basis: The processing is based on your consent, cf. GDPR Article 6(1)(a). You may withdraw your consent at any time by updating your consent settings under your profile or by changing your cookie preferences. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

This processing does not apply to Kids Accounts or users under the age of 18.

3.1.7. Competitions

Purpose: Personal Data is processed so that GoWish can run competitions and contact you if you win. Competitions will be subject to specific terms and conditions.

Categories of Personal Data:

• Name, email address and your competition entry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in organising the competition and contacting the winner.

3.1.8. Satisfaction surveys

Purpose: GoWish may in some cases use Personal Data to send out satisfaction surveys.

Categories of Personal Data:

• Name, email address and your survey responses

Legal basis: Article 6(1)(f) GDPR — legitimate interest in improving the Services.

3.1.9. Cookies and other technologies on the Services

Purpose: GoWish uses cookies on the Website for functional and statistical purposes, including storing login-related data, tracking visitors via Google Analytics and managing consent through CookieBot.

You can find more information about our use of cookies and how to delete or disable them in our cookie policy.

GoWish uses your device (phone, computer or tablet) as a proxy to register and update your wishes and related product information in the Platform (app). This means GoWish may use your device to retrieve information about the wishes you create or update and the products you view. We use this information to reduce errors when creating wishes, to provide accurate and up-to-date product information, and to improve the usability of our Services. We do not access or collect other data, such as browser data, from your device.

Categories of Personal Data: The categories of personal data that we process about you include:

• Whether you have previously visited the site, whether you are logged in, and your language and currency preferences
• Information to ensure your wishes are correctly created from the inserted URL
• Cookie and tracking data, including pixels from third parties such as Meta Pixel and Google Ads

Legal basis: Article 6(1)(a) GDPR for non-necessary cookies (consent). Article 6(1)(f) GDPR for other purposes (legitimate interest in ensuring website functionality and conducting traffic analysis). Article 6(1)(f) GDPR for mobile proxy use (legitimate interest in reducing errors, updating prices and optimising usability).

3.1.10. When you visit GoWish's profiles on social media (Facebook, Instagram, LinkedIn, Snapchat and TikTok)

Purpose: To market GoWish on social media, respond to your enquiries, allow you to participate in competitions and contact you if you win. When the social media platforms listed above use your Personal Data from GoWish's profiles for their own purposes — such as improving their advertising systems — they process your data as described in their own privacy policies: Facebook/Instagram, LinkedIn, TikTok, Snapchat.

Categories of Personal Data: GoWish processes information you have made available through your social media settings, your reactions to our posts, your sharing thereof and your comments on our posts.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in marketing GoWish and engaging with customers on the social platforms they already use.

3.1.11. Customer service and support

Purpose: Personal Data is processed so that GoWish can provide thorough customer service and support in connection with your enquiries.

Categories of Personal Data:

• Name, email address, phone number and the content of your enquiry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in ensuring adequate customer service and support.

3.1.12. Other contact and communication with you

Purpose: Personal Data is processed so that GoWish can communicate with you.

Categories of Personal Data:

• Name, email address and phone number

Legal basis: Article 6(1)(f) GDPR — legitimate interest in communicating with you.

3.1.13. Establishing, exercising or defending a legal claim

In addition to the above, there may be instances where your Personal Data is processed for the purpose of establishing, exercising or defending a legal claim under Article 6(1)(f) GDPR.

3.2. SPECIAL PROVISIONS FOR CHILDREN UNDER 15 — KIDS ACCOUNT

We take the protection of children's Personal Data very seriously. Our processing of data relating to children under 15 is carried out in accordance with applicable data protection legislation (including the GDPR) and the guidelines of the Danish Data Protection Authority (Datatilsynet).

The Services are not intended for use by children under 15 without adult consent. If you are the parent of a child under 15 and believe your child has submitted Personal Data to us without your consent, please contact us immediately. We will then delete the information from our system.

We collect and process ordinary Personal Data about children under 15 in order to provide and improve our Services. This may include:

• Identification data: name, age, gender, images
• Usage data: wish lists, reserved wishes
• Technical data: device type, browser and language settings (functional cookies only)

As a Kids Account is linked to a parent account, the parent account is the controlling account.

This information is used to:

• Create and manage the child's profile on the Services, including as a sub-account or Kids Account
• Enable features such as wish lists, family sharing and wish reservations
• Tailor the gift generator based on wishes from other children in the same age group
• Improve the Services' functionality and user experience

Children under 15 do not have access to our creator universe, and no tracking technologies, retargeting or profiling directed at this age group are used. Only the gift generator relevant to the child's age is shown. No advertisements, social feeds or marketing pop-ups are displayed.

Parental controls are built into Kids Accounts. Parents can view and manage wish lists. If the parent account is deleted, the associated Kids Account is automatically deleted.

We only retain children's Personal Data for as long as necessary to provide the Services or meet our legal obligations. When an account has been inactive for 2 years, or when parents or guardians request it, we permanently delete or anonymise the data. Deleted data cannot be recovered, and any associated wish lists are removed at the same time.

4. RECIPIENTS OF YOUR PERSONAL DATA

We transfer Personal Data to data processors who carry out various tasks on our behalf, including hosting, support, technical operations, analytics, service improvement and newsletter distribution.

We have entered into data processing agreements with all our data processors. They may only access and process Personal Data on our behalf, based on our instructions and for our specified purposes.

We may also disclose Personal Data where required to comply with applicable law, court orders or other public authority decisions, or where disclosure is necessary to uncover or investigate suspected unlawful use of the Services.

We use Google as a supplier of certain technical and analytical solutions, including Google Analytics, Google Tag Manager and Google Cloud services. In this context, Google may receive technical data such as IP addresses, browser and device information, language settings and usage data from our Services. Your customer ID, email, postcode and behavioural data may be stored in Google Cloud. We use Google Cloud to aggregate and process your data in order to better present recommended products on the website and in our marketing. This data is stored within the EU, and only trusted GoWish employees have access to it. Google processes the data as a data processor on our behalf under a data processing agreement.

Where possible, we require our partners to process your data within the EU/EEA. However, some of our suppliers operate outside the EU/EEA, for example in the USA, and use of these suppliers involves the transfer of your Personal Data outside the EU/EEA. Where processing within the EU/EEA is not possible, we ensure transfers take place in accordance with Chapter V of the GDPR.

Transfers to third countries assessed as providing an adequate level of protection do not require specific authorisation.

For transfers to countries outside the EU/EEA, we ensure an appropriate transfer mechanism is in place, such as:

• A European Commission adequacy decision
• EU Standard Contractual Clauses
• Another valid transfer basis under GDPR Chapter V, including Data Privacy Framework certification for recipients in the USA: https://www.dataprivacyframework.gov/s/participant-search

We currently work with the following service providers outside the EU/EEA:

We also share Personal Data collected via cookies on our website with the third-party providers listed in our cookie policy.

We may share your data with third parties, including partners involved in digital advertising, who use it for targeted advertising and so-called "Custom Audience" matching. We currently work with: Google LLC, Meta Platforms Ireland Ltd., TV2 Danmark A/S, Dentsu A/S and Snap Group SAS. Users who do not wish to have their data shared may opt out at any time, unconditionally, via their membership profile page under 'Advertising Partners'.

We may also produce aggregated and anonymised analyses based on data collected through the Services — for example, statistical insights about trends, product popularity, wish list activity, traffic patterns or other platform usage metrics. These analyses do not identify individual users and do not contain Personal Data. They may be used internally or shared with partners, service providers or other third parties for analytical, product development or reporting purposes.

5. RETENTION PERIOD

We retain your Personal Data for as long as necessary for the purpose of the processing.

This means we will retain your Personal Data for as long as you have an active profile with GoWish. If you delete your account via your profile, your data will be deleted or anonymised within 5 days, unless we have a legitimate interest or legal obligation to retain it.

We retain your data for up to 2 years after the last activity on your profile. "Activity" includes creating a wish, reserving a wish, or similar actions.

For marketing purposes, including newsletter subscriptions, we retain your data until you withdraw your consent and no longer wish to receive communications from us.

If you have participated in a competition, we delete your data no later than 12 months after the competition has been fully concluded and administered. Data necessary to document that the competition was based on valid consent is retained for two years after opt-out, in accordance with the limitation rules in the Danish Marketing Practices Act.

If you have granted GoWish access to your address book in order to see which of your contacts also use GoWish, GoWish deletes that data immediately. It is not stored by GoWish.

6. YOUR RIGHTS

We ask you to keep the Personal Data you provide to us up to date and to correct any changes by updating your GoWish profile. If you are unable to correct your information yourself, you can contact us with your specific request at kontakt@onskeskyen.dk.

You are responsible for maintaining the confidentiality of your profile and login credentials (including your password), and for all activities carried out under your profile. If you create a profile with us, do not share your login credentials with anyone.

Your rights are as follows:

• Right of access: The right to see the Personal Data being processed about you.
• Right to rectification: The right to have inaccurate data corrected.
• Right to erasure ("right to be forgotten"): The right to have data deleted before the standard deletion deadline, where specific conditions are met.
• Right to restriction of processing: The right to restrict the use of your data in certain situations.
• Right to object: The right to object to otherwise lawful processing, e.g. direct marketing.
• Right to data portability: The right to receive your data in a structured format (where processing is based on consent or contract).
• Right to withdraw consent: Where processing is based on your consent. This can be done via your user profile.
• Right to lodge a complaint: The right to complain to the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with the processing.

To exercise any of the above rights, please send a request to privacy@onskeskyen.dk. You will receive a response within 30 days.

We have implemented a number of measures to protect your Personal Data and safeguard your rights. Please note that some rights only apply under certain circumstances. Datatilsynet has published guidance on the rights of data subjects.

7. QUESTIONS

If you have general questions about this privacy policy, wish to exercise any of your rights as described above, or disagree with the way we process your Personal Data, please contact GoWish at privacy@onskeskyen.dk.

8. COMPLAINTS TO THE DANISH DATA PROTECTION AUTHORITY

If you disagree with the way GoWish processes your Personal Data, you may also lodge a complaint with the Danish Data Protection Authority (Datatilsynet) using the contact details available at www.datatilsynet.dk. We hope, however, that you will first contact GoWish at privacy@onskeskyen.dk so that we can try to resolve the matter together.

9. CHANGES AND LATEST VERSION OF THIS PRIVACY POLICY

This privacy policy is updated on an ongoing basis and revised regularly. The current version is always the one available here on GoWish.com.

This policy has been prepared in Danish and may be translated into other languages. In the event of any discrepancy or ambiguity between the Danish version and a translation, the Danish version shall prevail.

This is version 4 of GoWish's privacy policy, dated 25 March 2026.