PRIVACY POLICY

1. INTRODUCTION

It is important to Ønskeskyen ApS / GoWish ApS ("GoWish", "we", "us" or "our") that you feel confident about how we handle your personal data ("Personal Data"). We therefore have a privacy policy describing how we process the Personal Data we collect when you create an account on and use our website GoWish.com ("the Website") and our app GoWish ("the Platform"). Our processing is carried out responsibly, with respect for your privacy, and in accordance with the principles and requirements of the General Data Protection Regulation (hereinafter “GDPR”) and the Danish Data Protection Act.

The purpose of this privacy policy is, among other things, to inform you about how we specifically process Personal Data and about your rights in connection with that processing.

The Website and the Platform are collectively referred to below as "the Services". Your use of the Services and submission of your Personal Data to us constitutes your acknowledgement that you have received and read this privacy policy.

This privacy policy was last updated on 19. September 2026.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The data controller for the processing of your Personal Data is:

GoWish ApS (Ønskeskyen ApS)
Amerika Plads 19, 3rd floor
2100 Copenhagen Ø
CVR number: 41284366
If you have questions about the processing of your Personal Data, please contact our data protection team at privacy@gowish.com.

3. DESCRIPTION OF PROCESSING ACTIVITIES

3.1. OUR PROCESSING ACTIVITIES

Below is an overview of the categories of Personal Data we process about you, as well as the purposes and legal bases for our processing.

As a general rule, GoWish does not wish to process sensitive personal data about you. However, information you enter into a wish list yourself (e.g., title, description, or specific wish items) may contain information that constitutes sensitive personal data (such as religious holidays indicating belief, wedding lists indicating sexual orientation, or health-related wish items). We do not use such information for our own purposes (such as statistics or personalization) nor register them separately; they are processed solely to store and display your wish list. By entering such information into the Services, you provide your explicit consent pursuant to GDPR Article 9(2)(a). The general legal basis for processing your Personal Data in connection with your profile and wish list is set out in section 3.1.1.

3.1.1. Profile, sub-accounts and kids accounts on GoWish's Services

Purpose: To administer and deliver the Services — including creation, activation, deactivation and maintenance of the Services and your profile and any sub-accounts — we request certain Personal Data from you. Failure to provide this data may mean we cannot enter into a contractual relationship with you, and you may be unable to use our Services.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, email address, date of birth and gender, postal code and country
• Wishes you create in your profile and wishes you reserve
• Phone number and profile picture, if you have chosen to add these to your profile

When creating sub-accounts or kids accounts, including wish lists for others, we process name, age and gender based on the information you provide when activating the account.

Legal basis: The processing of your personal data is necessary for the performance of the contract with you to provide the Services, in accordance with Article 6(1)(b) of the GDPR. As regards your telephone number and your profile picture, the processing is based on Ønskeskyen’s legitimate interest in communicating with you and providing you with a personalised experience when you have chosen your own profile picture, see Article 6(1)(f) of the GDPR.

3.1.1.a. Visibility of your profile and wish lists

To make it easier to share and find wish lists, other users of the Services can search for you by name. Search results display your name, username, and profile picture. The legal basis is GoWish's legitimate interest in supporting sharing and interaction between users (GDPR Article 6(1)(f)). You can hide your profile from search in your profile settings at any time. You decide the visibility of your wish lists (public, friends only, unlisted link, or private) based on your consent (GDPR Article 6(1)(a)). You can change the visibility of a wish list at any time in your profile or list settings.

3.1.2. Development and improvement of Services and solutions

Purpose: Personal Data is processed for the development and improvement of the Services, for example through data analysis, as well as for the development of new services and solutions.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, email address, phone number (if provided), date of birth and gender
• Wish list details (list name, wish descriptions including product name, description, image and price, reservations, etc.)

Legal basis: The personal data is also necessary for us to pursue our legitimate interest in improving and developing the Services and solutions, including generating useful and accurate statistics, and developing new services and solutions, in accordance with Article 6(1)(f) of the GDPR.

3.1.3. When you activate "Invite your friends" via the Platform

Purpose: To make it easier for you to find and connect with friends who already use the app, and to invite friends who do not.

Categories of Personal Data: The categories of personal data that we process about you include:

• Contact list (to find and connect you with friends who already use the app, and to invite those who do not)

Obs: You can disable this feature in your phone's settings at any time. GoWish only syncs phone contacts if you actively grant permission via your phone's settings. You can stop synchronisation and remove access by going to your phone's app settings and disabling "Contacts". If you have never granted permission, GoWish does not have access to your contacts.

Legal basis: The processing of your “contacts” is based on our legitimate interest in helping you invite your friends to your wish list, in accordance with Article 6(1)(f) of the GDPR.

3.1.4. Marketing in the form of newsletters

Purpose: Personal Data is processed so that GoWish can send you newsletters and information about products or services related to GoWish and its partners via electronic media, such as email, SMS or push notifications, where you have given your consent in accordance with the Danish Marketing Practices Act. We do not send newsletters to users under the age of 15.

Categories of Personal Data: The categories of personal data that we process about you include:

• Email address and phone number (if provided)

Legal basis: The processing of personal data is based on your consent, see Article 6(1)(a) of the GDPR. The processing of data relating to whether you open and click on links in our newsletters is carried out on the basis of a legitimate interest, see Article 6(1)(f) of the GDPR. In weighing up the interests involved, we have emphasised that we have a relevant and balanced interest in investigating whether our users respond to the newsletter, so that we know whether the content therefore reflects our users’ needs or needs to be amended in future.

3.1.5. Recommendations and inspiration lists on the Services

Purpose: GoWish is designed to help you find content and wishes that match your needs and interests. We therefore provide recommendations and inspiration lists in our inspiration universe to deliver better personalised content and more relevant product information. For this purpose, we segment users' wishes based on basic demographic data and compile statistics at an aggregate level based on wish list items, age and gender. The goal is to create top lists of popular products for various occasions and present these to you in your profile.

Categories of Personal Data: The categories of personal data that we process about you include:

• Demographic data (gender, age, country)
• Products on your wish list

Please note: Recommendations and inspiration lists may contain advertisements and affiliate links.

Legal basis: The processing of personal data is based on Ønskesky’s legitimate interest in being able to provide you with better personalised services and more relevant product information and communications, in accordance with Article 6(1)(f) of the GDPR.

3.1.6. Targeted Advertising and Retargeting

3.1.6.1. Retargeting

Purpose of the processing: We process your personal data to show you relevant marketing about GoWish and our partners' products on the digital media and social platforms you use. This includes targeted advertising based on your interests and behaviour, as well as retargeting, where you as a previous visitor may be shown relevant ads on third-party platforms and social media such as Facebook, Instagram, Snap and Google.

Categories of personal data: The categories of personal data we may process in connection with this activity include:

• Demographic data (gender, age, country)
• Products on your wish list
• Email address (in hashed form when shared with third parties)
• Phone number (if provided)
• Behavioural data, including visits to GoWish's website and app (used for retargeting, exclusion and lookalike audiences)

Legal basis: The processing is based on your consent, cf. GDPR Article 6(1)(a). You may withdraw your consent at any time by updating your consent settings under your profile or by changing your cookie preferences. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.

3.1.6.2. Sharing of encrypted contact details for matching, exclusion and lookalike audiences

Purpose of the processing: In order to carry out relevant and cost-effective marketing, we may share an encrypted (hashed) list of contact details with selected social media platforms, including Facebook, Instagram and Google. The platform can then determine whether a given user on the platform matches an existing customer with us without accessing the information in clear text. This is used for two purposes: to exclude existing customers from campaigns aimed at new customers, and to enable the platform to identify potential new customers whose profile resembles our existing customers (lookalike audiences).

Categories of personal data:

• Email address (in hashed/encrypted form)
• Phone number, if provided (in hashed/encrypted form)

Legal basis: This processing is based on our legitimate interest under GDPR Article 6(1)(f) in carrying out relevant and cost-effective marketing. We have conducted a balancing of interests and determined that our interest in this limited use does not override your fundamental rights and freedoms. The encrypted identifiers shared are kept by the platform only for as long as necessary to complete the match, after which they are deleted or anonymised. GoWish is the data controller for the sharing and matching; each platform is an independent data controller for its subsequent use. You have the right to object to this processing at any time under GDPR Article 21(1) without stating a reason, via account settings or privacy@gowish.com. This processing also requires consent for the underlying cookies/tracking technologies in our consent banner. This processing does not apply to Kids Accounts or users under 18.

3.1.6.3. Programmatic advertising via IAB Transparency and Consent Framework

Purpose of the processing: On the Website and in the Platform, we use IAB Europe's Transparency and Consent Framework (TCF) to obtain and transmit your consent so that participating advertisers and adtech vendors can process your Personal Data for programmatic advertising, targeting, and ad performance measurement. When you give consent in our consent management solution (CookieBot on the Website and Usercentrics in the Platform), your consent signal is passed to participating vendors on IAB Europe's Global Vendor List.

Categories of personal data: Cookie and device identifiers, IP address, and information about your behavior on the Website and Platform.

Legal basis: Processing is based on your consent, cf. GDPR Article 6(1)(a). You can withdraw your consent at any time or adjust vendor permissions via CookieBot on the Website or Usercentrics in the Platform.

Recipients: Participating vendors are registered on IAB Europe's Global Vendor List, available in our consent solutions and cookie policy.

3.1.6.4. Sharing with commercial partners for audience matching and activation

Purpose of the processing: To enable selected commercial partners to show you, and users with similar interests, relevant advertising, we may, with your consent, share an encrypted (hashed) list of your contact details, together with information about your interests and the products on your wish list, with the individual partner. The sharing takes place via a technical matching platform, which receives the information and carries out the matching on our instructions. The platform then makes the result of the matching (a segment of users) available to the commercial partner, who may then itself activate relevant advertising towards you and similar users on its own channels.

Categories of personal data:

• Email address (in hashed/encrypted form)
• Telephone number, if provided (in hashed/encrypted form)
• Products on your wish list and other interest data, to the extent necessary for the matching

Legal basis: The processing takes place on the basis of your consent, cf. Article 6(1)(a) GDPR. Consent is given via a separate function in your account settings, independently of the general cookie consent and of the consent for retargeting described in section 3.1.6.1.

The encrypted identifiers used for the matching are retained only for the period necessary to carry out the matching, after which they are deleted or anonymised. Ønskeskyen is the controller responsible for the decision to share, and for carrying out the sharing with the commercial partner. The technical matching platform performing the matching itself acts as a processor for Ønskeskyen, and solely on our instructions. The commercial partner is an independent controller for its own subsequent use and activation of the matched segment.

You may withdraw your consent at any time in the account settings or by writing to privacy@gowish.com. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

3.1.7. Competitions

Purpose: Personal Data is processed so that GoWish can run competitions and contact you if you win. Competitions will be subject to specific terms and conditions.

Categories of Personal Data:

• Name, email address and your competition entry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in organising the competition and contacting the winner.

3.1.8. Satisfaction surveys

Purpose: GoWish may in some cases use Personal Data to send out satisfaction surveys.

Categories of Personal Data:

• Name, email address and your survey responses

Legal basis: Article 6(1)(f) GDPR — legitimate interest in improving the Services.

3.1.9. Cookies and other technologies on the Services

Purpose: GoWish uses cookies and similar technologies on the Website for functional and statistical purposes, including storing login-related data and tracking visitors via Google Analytics. Consent for non-necessary cookies on the Website is managed through CookieBot, an IAB-certified consent solution. In the Platform, we use similar tracking technologies for functional, statistical, and marketing purposes. Consent for these technologies in the Platform is managed through Usercentrics, which is also an IAB-certified consent solution. You can view and change your consents at any time in the Platform settings under "Account" and "Privacy Settings".

You can find more information about our use of cookies and how to delete or disable them in our cookie policy.

GoWish uses your device (phone, computer or tablet) as a proxy to register and update your wishes and related product information in the Platform (app). This means GoWish may use your device to retrieve information about the wishes you create or update and the products you view. We use this information to reduce errors when creating wishes, to provide accurate and up-to-date product information, and to improve the usability of our Services. No browser information is gathered from your equipment regarding the Mobile Proxy functionality. Further details on our tracking via the embedded browser when clicking out are outlined independently under Section 3.1.14.

Categories of Personal Data: The categories of personal data that we process about you include:

• Whether you have previously visited the site, whether you are logged in, and your language and currency preferences
• Information to ensure your wishes are correctly created from the inserted URL
• Cookie and tracking data, including pixels from third parties such as Meta Pixel and Google Ads, as well as via the IAB Transparency and Consent Framework as described in Section 3.1.6.3

Legal basis: Article 6(1)(a) GDPR for non-necessary cookies and tracking technologies on both the Website and Platform (consent). Article 6(1)(f) GDPR for other purposes (legitimate interest in ensuring website and platform functionality). Article 6(1)(f) GDPR for mobile proxy use (legitimate interest in reducing errors, updating prices and optimising usability).

3.1.10. When you visit GoWish's profiles on social media (Facebook, Instagram, LinkedIn, Snapchat and TikTok)

Purpose: To market GoWish on social media, respond to your enquiries, allow you to participate in competitions and contact you if you win. When the social media platforms listed above use your Personal Data from GoWish's profiles for their own purposes — such as improving their advertising systems — they process your data as described in their own privacy policies: Facebook/Instagram, LinkedIn, TikTok, Snapchat.

Categories of Personal Data: GoWish processes information you have made available through your social media settings, your reactions to our posts, your sharing thereof and your comments on our posts.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in marketing GoWish and engaging with customers on the social platforms they already use.

3.1.11. Customer service and support

Purpose: Personal Data is processed so that GoWish can provide thorough customer service and support in connection with your enquiries.

Categories of Personal Data:

• Name, email address, phone number and the content of your enquiry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in ensuring adequate customer service and support.

3.1.12. Other contact and communication with you

Purpose: Personal Data is processed so that GoWish can communicate with you.

Categories of Personal Data:

• Name, email address and phone number

Legal basis: Article 6(1)(f) GDPR — legitimate interest in communicating with you.

3.1.13. Establishing, exercising or defending a legal claim

In addition to the above, there may be instances where your Personal Data is processed for the purpose of establishing, exercising or defending a legal claim under Article 6(1)(f) GDPR.

3.1.14. In app browser and click out tracking to merchants

Purpose: Whenever you navigate from the Platform to a webshop, such as selecting "Go to Store" or following a matched item, the webshop opens inside an embedded browser rather than your device's native browser. Throughout that active session, GoWish stores the unique click ID assigned by our affiliate network partner and captures confirmation from the shop upon transaction completion. This enables us to attribute and settle referral fees for sales generated via our Platform using the integrated browser, while mitigating attribution loss from domain redirects and browser-level tracking limits.

Categories of Personal Data: The categories of personal data that we process about you include:

• Click ID and session tracking code linked to your outbound navigation to a retailer
• Purchase verification signal supplied by the webshop, or automated detection determining if the loaded screen is an order confirmation
• Technical analytics data including timestamp, webshop details, and outbound origin point

Please note: The integrated in-app browser does not record or collect inputs, keystrokes, form information, credit card data, or similar behavior on the retailer's website.

Legal basis: This processing is based on your consent, see Article 6(1)(a) of the GDPR, aligned with the tracking practices detailed in Sections 3.1.6 and 3.1.9. Permission is gathered via our Consent Management Platform (Usercentrics), and you may revoke your consent anytime in your account settings or Usercentrics panel.

3.2. SPECIAL PROVISIONS FOR CHILDREN UNDER 15 - KIDS ACCOUNT

We take the protection of children's Personal Data very seriously. Our processing of data relating to children under 15 is carried out in accordance with applicable data protection legislation (including the GDPR) and the guidelines of the Danish Data Protection Authority (Datatilsynet).

The Services are not intended for use by children under 15 without adult consent. If you are the parent of a child under 15 and believe your child has submitted Personal Data to us without your consent, please contact us immediately. We will then delete the information from our system.

We collect and process ordinary Personal Data about children under 15 in order to provide and improve our Services. This may include:

• Identification data: name, age, gender, images
• Usage data: wish lists, reserved wishes
• Technical data: device type, browser and language settings (functional cookies only)

As a Kids Account is linked to a parent account, the parent account is the controlling account.
This information is used to:

• Create and manage the child's profile on the Services, including as a sub-account or Kids Account
• Enable features such as wish lists, family sharing and wish reservations
• Tailor the gift generator based on wishes from other children in the same age group
• Improve the Services' functionality and user experience

Children under 15 do not have access to our creator universe, and no tracking technologies, retargeting or profiling directed at this age group are used. Only the gift generator relevant to the child's age is shown. No advertisements, social feeds or marketing pop-ups are displayed.

Parental controls are built into Kids Accounts. Parents can view and manage wish lists. If the parent account is deleted, the associated Kids Account is automatically deleted.

We only retain children's Personal Data for as long as necessary to provide the Services or meet our legal obligations. When an account has been inactive for 2 years, or when parents or guardians request it, we permanently delete or anonymise the data. Deleted data cannot be recovered, and any associated wish lists are removed at the same time.

4. RECIPIENTS OF YOUR PERSONAL DATA

We transfer Personal Data to data processors who carry out various tasks on our behalf, including hosting, support, technical operations, analytics, service improvement and newsletter distribution.

We have entered into data processing agreements with all our data processors. They may only access and process Personal Data on our behalf, based on our instructions and for our specified purposes.

We may also disclose Personal Data where required to comply with applicable law, court orders or other public authority decisions, or where disclosure is necessary to uncover or investigate suspected unlawful use of the Services.

We use Google as a supplier of certain technical and analytical solutions, including Google Analytics, Google Tag Manager and Google Cloud services. In this context, Google may receive technical data such as IP addresses, browser and device information, language settings and usage data from our Services. Your customer ID, email, postcode and behavioural data may be stored in Google Cloud. We use Google Cloud to aggregate and process your data in order to better present recommended products on the website and in our marketing. This data is stored within the EU, and only trusted GoWish employees have access to it. Google processes the data as a data processor on our behalf under a data processing agreement.

In connection with programmatic advertising via the IAB Transparency and Consent Framework set up on the Website through CookieBot and in the Platform through Usercentrics, your Personal Data may, to the extent you have given consent, be shared with a number of third-party advertisers and adtech vendors registered on IAB Europe's Global Vendor List. The current list of these vendors is set out in our consent solutions and cookie policy.

Where possible, we require our partners to process your data within the EU/EEA. However, some of our suppliers operate outside the EU/EEA, for example in the USA, and use of these suppliers involves the transfer of your Personal Data outside the EU/EEA. Where processing within the EU/EEA is not possible, we ensure transfers take place in accordance with Chapter V of the GDPR.
Transfers to third countries assessed as providing an adequate level of protection do not require specific authorisation.
For transfers to countries outside the EU/EEA, we ensure an appropriate transfer mechanism is in place, such as:

• A European Commission adequacy decision
• EU Standard Contractual Clauses
• Another valid transfer basis under GDPR Chapter V, including Data Privacy Framework certification for recipients in the USA: https://www.dataprivacyframework.gov/s/participant-search

We currently work with the following service providers outside the EU/EEA:

We also share Personal Data collected via cookies on our website with the third-party providers listed in our cookie policy.

We may share your data with third parties, including partners involved in digital advertising, who use it for targeted advertising and so-called "Custom Audience" matching. We currently work with example: Google LLC, Meta Platforms Ireland Ltd., TV2 Danmark A/S, Dentsu A/S and Snap Group SAS. Users who do not wish to have their data shared may opt out at any time, unconditionally, via their membership profile page under 'Account' and then opt out of 'Advertising partners' ('Annoncepartnere').

We may also produce aggregated and anonymised analyses based on data collected through the Services — for example, statistical insights about trends, product popularity, wish list activity, traffic patterns or other platform usage metrics. These analyses do not identify individual users and do not contain Personal Data. They may be used internally or shared with partners, service providers or other third parties for analytical, product development or reporting purposes.

5. RETENTION PERIOD

We retain your Personal Data for as long as necessary for the purpose of the processing.

This means we will retain your Personal Data for as long as you have an active profile with GoWish. If you delete your account via your profile, your data will be deleted or anonymised within 5 days, unless we have a legitimate interest or legal obligation to retain it.

We retain your data for up to 2 years after the last activity on your profile. "Activity" includes creating a wish, reserving a wish, or similar actions.
For marketing purposes, including newsletter subscriptions, we retain your data until you withdraw your consent and no longer wish to receive communications from us.

If you have participated in a competition, we delete your data no later than 12 months after the competition has been fully concluded and administered. Data necessary to document that the competition was based on valid consent is retained for two years after opt-out, in accordance with the limitation rules in the Danish Marketing Practices Act.

If you have granted GoWish access to your address book in order to see which of your contacts also use GoWish, GoWish deletes that data immediately. It is not stored by GoWish.

6. YOUR RIGHTS

We ask you to keep the Personal Data you provide to us up to date and to correct any changes by updating your GoWish profile. If you are unable to correct your information yourself, you can contact us with your specific request at contact@gowish.com.

You can exercise your rights directly within the Services to a large extent. Among other things, you can delete your user account and the information we have registered about you. For rights you cannot exercise directly in the Services, please refer to the procedure described above.

You are responsible for maintaining the confidentiality of your profile and login credentials (including your password), and for all activities carried out under your profile. If you create a profile with us, do not share your login credentials with anyone.

Your rights are as follows:

• Right of access: The right to see the Personal Data being processed about you.
• Right to rectification: The right to have inaccurate data corrected.
• Right to erasure ("right to be forgotten"): The right to have data deleted before the standard deletion deadline, where specific conditions are met.
• Right to restriction of processing: The right to restrict the use of your data in certain situations.
• Right to object: The right to object to otherwise lawful processing, e.g. direct marketing.
• Right to data portability: The right to receive your data in a structured format (where processing is based on consent or contract).
• Right to withdraw consent: Where processing is based on your consent. This can be done via your user profile.
• Right to lodge a complaint: The right to complain to the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with the processing.

To exercise any of the above rights, please send a request to privacy@gowish.com. You will receive a response within 30 days.

We have implemented a number of measures to protect your Personal Data and safeguard your rights. Please note that some rights only apply under certain circumstances. Datatilsynet has published guidance on the rights of data subjects. To read more about your rights, please see here.

7. QUESTIONS

If you have general questions about this privacy policy, wish to exercise any of your rights as described above, or disagree with the way we process your Personal Data, please contact GoWish at privacy@gowish.com.

8. COMPLAINTS TO THE DANISH DATA PROTECTION AUTHORITY

If you disagree with the way GoWish processes your Personal Data, you may also lodge a complaint with the Danish Data Protection Authority (Datatilsynet) using the contact details available at www.datatilsynet.dk.
We hope, however, that you will first contact GoWish at privacy@gowish.com so that we can try to resolve the matter together.

9. CHANGES AND LATEST VERSION OF THIS PRIVACY POLICY

This privacy policy is updated on an ongoing basis and revised regularly. The current version is always the one available here on www.gowish.com.

This policy has been prepared in Danish and may be translated into other languages. In the event of any discrepancy or ambiguity between the Danish version and a translation, the Danish version shall prevail.

This is version 5 of GoWish's Privacy Policy, dated 19. September 2026.