PRIVACY POLICY

1. INTRODUCTION

It is important to Ønskeskyen ApS / GoWish ApS ("GoWish", "we", "us" or "our") that you feel confident about how we handle your personal data ("Personal Data"). We therefore have a privacy policy describing how we process the Personal Data we collect when you create an account on and use our website GoWish.com ("the Website") and our app GoWish ("the Platform"). Our processing is carried out responsibly, with respect for your privacy, and in accordance with the principles and requirements of the General Data Protection Regulation (hereinafter “GDPR”) and the Danish Data Protection Act.

The purpose of this privacy policy is, among other things, to inform you about how we specifically process Personal Data and about your rights in connection with that processing.

The Website and the Platform are collectively referred to below as "the Services". Your use of the Services and submission of your Personal Data to us constitutes your acknowledgement that you have received and read this privacy policy.

This privacy policy was last updated on 19. September 2026.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The data controller for the processing of your Personal Data is:

GoWish ApS (Ønskeskyen ApS)
Amerika Plads 19, 3rd floor
2100 Copenhagen Ø
CVR number: 41284366
If you have questions about the processing of your Personal Data, please contact our data protection team at privacy@gowish.com.

3. DESCRIPTION OF PROCESSING ACTIVITIES

3.1. OUR PROCESSING ACTIVITIES

Below is an overview of the categories of Personal Data we process about you, as well as the purposes and legal bases for our processing.

As a general rule, GoWish does not wish to process sensitive personal data about you. However, information you enter into a wish list yourself (e.g., title, description, or specific wish items) may contain information that constitutes sensitive personal data (such as religious holidays indicating belief, wedding lists indicating sexual orientation, or health-related wish items). We do not use such information for our own purposes (such as statistics or personalization) nor register them separately; they are processed solely to store and display your wish list. By entering such information into the Services, you provide your explicit consent pursuant to GDPR Article 9(2)(a). The general legal basis for processing your Personal Data in connection with your profile and wish list is set out in section 3.1.1.

3.1.1. Profile, sub-accounts and kids accounts on GoWish's Services

Purpose: To administer and deliver the Services — including creation, activation, deactivation and maintenance of the Services and your profile and any sub-accounts — we request certain Personal Data from you. Failure to provide this data may mean we cannot enter into a contractual relationship with you, and you may be unable to use our Services.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, email address, date of birth and gender, postal code and country
• Wishes you create in your profile and wishes you reserve
• Phone number and profile picture, if you have chosen to add these to your profile

When creating sub-accounts or kids accounts, including wish lists for others, we process name, age and gender based on the information you provide when activating the account.

Legal basis: The processing of your personal data is necessary for the performance of the contract with you to provide the Services, in accordance with Article 6(1)(b) of the GDPR. As regards your telephone number and your profile picture, the processing is based on Ønskeskyen’s legitimate interest in communicating with you and providing you with a personalised experience when you have chosen your own profile picture, see Article 6(1)(f) of the GDPR.

3.1.1.a. Visibility of your profile and wish lists

To make it easier to share and find wish lists, other users of the Services can search for you by name. Search results display your name, username, and profile picture. The legal basis is GoWish's legitimate interest in supporting sharing and interaction between users (GDPR Article 6(1)(f)). You can hide your profile from search in your profile settings at any time. You decide the visibility of your wish lists (public, friends only, unlisted link, or private) based on your consent (GDPR Article 6(1)(a)). You can change the visibility of a wish list at any time in your profile or list settings.

3.1.2. Development and improvement of Services and solutions

Purpose: Personal Data is processed for the development and improvement of the Services, for example through data analysis, as well as for the development of new services and solutions.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, email address, phone number (if provided), date of birth and gender
• Wish list details (list name, wish descriptions including product name, description, image and price, reservations, etc.)

Legal basis: The personal data is also necessary for us to pursue our legitimate interest in improving and developing the Services and solutions, including generating useful and accurate statistics, and developing new services and solutions, in accordance with Article 6(1)(f) of the GDPR.

3.1.3. When you activate "Invite your friends" via the Platform

Purpose: To make it easier for you to find and connect with friends who already use the app, and to invite friends who do not.

Categories of Personal Data: The categories of personal data that we process about you include:

• Contact list (to find and connect you with friends who already use the app, and to invite those who do not)

Obs: You can disable this feature in your phone's settings at any time. GoWish only syncs phone contacts if you actively grant permission via your phone's settings. You can stop synchronisation and remove access by going to your phone's app settings and disabling "Contacts". If you have never granted permission, GoWish does not have access to your contacts.

Legal basis: The processing of your “contacts” is based on our legitimate interest in helping you invite your friends to your wish list, in accordance with Article 6(1)(f) of the GDPR.

3.1.4. Marketing in the form of newsletters

Purpose: Personal Data is processed so that GoWish can send you newsletters and information about products or services related to GoWish and its partners via electronic media, such as email, SMS or push notifications, where you have given your consent in accordance with the Danish Marketing Practices Act. We do not send newsletters to users under the age of 15.

Categories of Personal Data: The categories of personal data that we process about you include:

• Email address and phone number (if provided)

Legal basis: The processing of personal data is based on your consent, see Article 6(1)(a) of the GDPR. The processing of data relating to whether you open and click on links in our newsletters is carried out on the basis of a legitimate interest, see Article 6(1)(f) of the GDPR. In weighing up the interests involved, we have emphasised that we have a relevant and balanced interest in investigating whether our users respond to the newsletter, so that we know whether the content therefore reflects our users’ needs or needs to be amended in future.

3.1.5. Recommendations and inspiration lists on the Services

Purpose: GoWish is designed to help you find content and wishes that match your needs and interests. We therefore provide recommendations and inspiration lists in our inspiration universe to deliver better personalised content and more relevant product information. We can also add advertising in the platform. For this purpose, we segment users' wishes based on basic demographic data and compile statistics at an aggregate level based on wish list items, age and gender. The goal is to create top lists of popular products for various occasions and present these to you in your profile.

Categories of Personal Data: The categories of personal data that we process about you include:

• Demographic data (gender, age, country)
• Products on your wish list

Please note: Recommendations and inspiration lists may contain advertisements and affiliate links.

Legal basis: The processing of personal data is based on Ønskesky’s legitimate interest in being able to provide you with better personalised services and more relevant product information and communications, in accordance with Article 6(1)(f) of the GDPR.

3.1.6. Targeted advertising and data sharing with commercial partners

GoWish processes Personal Data to deliver highly relevant commercial communications regarding our Services and partner offerings across various digital channels and social networks. Detailed descriptions of these activities are provided in sections 3.1.6.1 through 3.1.6.4. These processing routines do not apply to Kids Accounts or individuals under 18 years of age.

We collaborate with several adtech platforms and media partners, including Google LLC, Meta Platforms Ireland Ltd., TV 2 Danmark A/S, Dentsu A/S, and Snap Group SAS.

3.1.6.1. Retargeting, custom audience matching, and lookalike modeling

Purpose: Data is processed to present tailored promotional content for GoWish and partner products on third-party channels such as Facebook, Instagram, Snapchat, and Google. Operations encompass:
a) Retargeting: Displaying customized ads to previous visitors of the Website or Platform on external platforms.
b) Audience matching, exclusion, and lookalike creation: Transmission of pseudonymous (hashed) contact details (email and phone number) to networks. Networks verify user accounts without viewing plain text credentials to exclude current members from acquisition campaigns or identify similar user profiles.

Categories of Personal Data:

• Online behavioral analytics, including activity logs from the Website and Platform
• Hashed email address (for matching purposes)
• Hashed phone number, where submitted (for matching purposes)

Legal basis: Processing relies on user consent pursuant to GDPR Article 6(1)(a), obtained via CookieBot on the Website and Usercentrics in the Platform. Retargeting activities additionally comply with national cookie regulations. Contact matching routines are restricted strictly to consented profiles.
Consent may be revoked at any point through the CookieBot or Usercentrics preferences. Revocation does not affect the lawfulness of processing conducted prior to withdrawal.

3.1.6.2. Custom audience segments for media partners

Purpose: GoWish categorizes profiles into audience segments based on demographics and listed interests (such as home decor items). Hashed identifiers associated with these segments may be shared with selected publishers within secure data clean rooms. Raw wish list entries and personal identifiers are never transferred. We provide only segment parameters and hashed references. Segments facilitate advertising:

1. Directly for GoWish Services,
2. Joint marketing campaigns executed alongside commercial partners, and
3. Third-party advertisers purchasing placements via media agencies targeting GoWish audience definitions.

GoWish does not share underlying wish details or unencrypted profile data with external entities; only segment definitions and hashed identifiers are exposed.

Categories of Personal Data:

• Demographic attributes (gender, age, country)
• Wish list contents (utilized solely internally to construct audience parameters without external disclosure)
• Hashed email address
• Assigned audience segment classifications

Legal basis: Processing is supported by our legitimate interest in delivering tailored ad products and promoting our Services, as well as the commercial interest of partners in reaching prospective audiences pursuant to GDPR Article 6(1)(f). A balancing test confirms these interests do not override fundamental user rights.

Users hold an unconditional right to object under GDPR Article 21(2). Objections can be registered under Profile → Account → Advertising partners, or by reaching out to privacy@gowish.com. Upon objection, processing for this purpose ceases and the user is removed from all custom segments.

3.1.6.3. Programmatic advertising via IAB Transparency and Consent Framework

Purpose: Across our Website and Platform, we utilize IAB Europe’s Transparency and Consent Framework (TCF) to collect and transmit your consent signals to participating adtech vendors and advertisers. This permits processing of your Personal Data for programmatic advertising, audience targeting, and ad performance measurement. When providing consent via CookieBot on the Website or Usercentrics in the Platform, your consent preference is communicated to participating vendors, who may independently handle data in accordance with your granted permissions.

Categories of Personal Data: Device and cookie identifiers, IP address, and platform usage activity, subject to your granted consent.

Legal basis: Processing relies on your consent pursuant to Article 6(1)(a) GDPR. You can withdraw consent or adjust individual vendor permissions at any time via CookieBot on the Website or Usercentrics in the Platform settings.

Recipients: Participating vendors are listed on IAB Europe’s Global Vendor List. The updated list of vendors eligible to process Personal Data through this framework is available within our consent interfaces and cookie policy

3.1.7. Competitions

Purpose: Personal Data is processed so that GoWish can run competitions and contact you if you win. Competitions will be subject to specific terms and conditions.

Categories of Personal Data:

• Name, email address and your competition entry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in organising the competition and contacting the winner.

3.1.8. Satisfaction surveys

Purpose: GoWish may in some cases use Personal Data to send out satisfaction surveys.

Categories of Personal Data:

• Name, email address and your survey responses

Legal basis: Article 6(1)(f) GDPR — legitimate interest in improving the Services.

3.1.9. Cookies and other technologies on the Services

Purpose: GoWish uses cookies and similar technologies on the Website for functional and statistical purposes, including storing login-related data and tracking visitors via Google Analytics. Consent for non-necessary cookies on the Website is managed through CookieBot, an IAB-certified consent solution. In the Platform, we use similar tracking technologies for functional, statistical, and marketing purposes. Consent for these technologies in the Platform is managed through Usercentrics, which is also an IAB-certified consent solution. You can view and change your consents at any time in the Platform settings under "Account" and "Privacy Settings".

You can find more information about our use of cookies and how to delete or disable them in our cookie policy.

GoWish uses your device (phone, computer or tablet) as a proxy to register and update your wishes and related product information in the Platform (app). This means GoWish may use your device to retrieve information about the wishes you create or update and the products you view. We use this information to reduce errors when creating wishes, to provide accurate and up-to-date product information, and to improve the usability of our Services. No browser information is gathered from your equipment regarding the Mobile Proxy functionality. Further details on our tracking via the embedded browser when clicking out are outlined independently under Section 3.1.14.

Categories of Personal Data: The categories of personal data that we process about you include:

• Whether you have previously visited the site, whether you are logged in, and your language and currency preferences
• Information to ensure your wishes are correctly created from the inserted URL
• Cookie and tracking data, including pixels from third parties such as Meta Pixel and Google Ads, as well as via the IAB Transparency and Consent Framework as described in Section 3.1.6.3

Legal basis: Article 6(1)(a) GDPR for non-necessary cookies and tracking technologies on both the Website and Platform (consent). Article 6(1)(f) GDPR for other purposes (legitimate interest in ensuring website and platform functionality). Article 6(1)(f) GDPR for mobile proxy use (legitimate interest in reducing errors, updating prices and optimising usability).

3.1.10. When you visit GoWish's profiles on social media (Facebook, Instagram, LinkedIn, Snapchat and TikTok)

Purpose: To market GoWish on social media, respond to your enquiries, allow you to participate in competitions and contact you if you win. When the social media platforms listed above use your Personal Data from GoWish's profiles for their own purposes — such as improving their advertising systems — they process your data as described in their own privacy policies: Facebook/Instagram, LinkedIn, TikTok, Snapchat.

Categories of Personal Data: GoWish processes information you have made available through your social media settings, your reactions to our posts, your sharing thereof and your comments on our posts.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in marketing GoWish and engaging with customers on the social platforms they already use.

3.1.11. Customer service and support

Purpose: Personal Data is processed so that GoWish can provide thorough customer service and support in connection with your enquiries.

Categories of Personal Data:

• Name, email address, phone number and the content of your enquiry

Legal basis: Article 6(1)(f) GDPR — legitimate interest in ensuring adequate customer service and support.

3.1.12. Other contact and communication with you

Purpose: Personal Data is processed so that GoWish can communicate with you.

Categories of Personal Data:

• Name, email address and phone number

Legal basis: Article 6(1)(f) GDPR — legitimate interest in communicating with you.

3.1.13. Establishing, exercising or defending a legal claim

In addition to the above, there may be instances where your Personal Data is processed for the purpose of establishing, exercising or defending a legal claim under Article 6(1)(f) GDPR.

3.1.14. In app browser and click out tracking to merchants

Purpose: Whenever you navigate from the Platform to a webshop, such as selecting "Go to Store" or following a matched item, the webshop opens inside an embedded browser rather than your device's native browser. Throughout that active session, GoWish stores the unique click ID assigned by our affiliate network partner and captures confirmation from the shop upon transaction completion. This enables us to attribute and settle referral fees for sales generated via our Platform using the integrated browser, while mitigating attribution loss from domain redirects and browser-level tracking limits.

Categories of Personal Data: The categories of personal data that we process about you include:

• Click ID and session tracking code linked to your outbound navigation to a retailer
• Purchase verification signal supplied by the webshop, or automated detection determining if the loaded screen is an order confirmation
• Technical analytics data including timestamp, webshop details, and outbound origin point

Please note: The integrated in-app browser does not record or collect inputs, keystrokes, form information, credit card data, or similar behavior on the retailer's website.

Legal basis: This processing is based on your consent, see Article 6(1)(a) of the GDPR, aligned with the tracking practices detailed in Sections 3.1.6 and 3.1.9. Permission is gathered via our Consent Management Platform (Usercentrics), and you may revoke your consent anytime in your account settings or Usercentrics panel.

3.2. SPECIAL PROVISIONS FOR CHILDREN UNDER 15 - KIDS ACCOUNT

We take the protection of children's Personal Data very seriously. Our processing of data relating to children under 15 is carried out in accordance with applicable data protection legislation (including the GDPR) and the guidelines of the Danish Data Protection Authority (Datatilsynet).

The Services are not intended for use by children under 15 without adult consent. If you are the parent of a child under 15 and believe your child has submitted Personal Data to us without your consent, please contact us immediately. We will then delete the information from our system.

We collect and process ordinary Personal Data about children under 15 in order to provide and improve our Services. This may include:

• Identification data: name, age, gender, images
• Usage data: wish lists, reserved wishes
• Technical data: device type, browser and language settings (functional cookies only)

As a Kids Account is linked to a parent account, the parent account is the controlling account.
This information is used to:

• Create and manage the child's profile on the Services, including as a sub-account or Kids Account
• Enable features such as wish lists, family sharing and wish reservations
• Tailor the gift generator based on wishes from other children in the same age group
• Improve the Services' functionality and user experience

Children under 15 do not have access to our creator universe, and no tracking technologies, retargeting or profiling directed at this age group are used. Only the gift generator relevant to the child's age is shown. No advertisements, social feeds or marketing pop-ups are displayed.

Parental controls are built into Kids Accounts. Parents can view and manage wish lists. If the parent account is deleted, the associated Kids Account is automatically deleted.

We only retain children's Personal Data for as long as necessary to provide the Services or meet our legal obligations. When an account has been inactive for 2 years, or when parents or guardians request it, we permanently delete or anonymise the data. Deleted data cannot be recovered, and any associated wish lists are removed at the same time.

4. RECIPIENTS OF YOUR PERSONAL DATA

We transfer Personal Data to data processors who carry out various tasks on our behalf, including hosting, support, technical operations, analytics, service improvement and newsletter distribution.

We have entered into data processing agreements with all our data processors. They may only access and process Personal Data on our behalf, based on our instructions and for our specified purposes.

We may also disclose Personal Data where required to comply with applicable law, court orders or other public authority decisions, or where disclosure is necessary to uncover or investigate suspected unlawful use of the Services.

We use Google as a supplier of certain technical and analytical solutions, including Google Analytics, Google Tag Manager and Google Cloud services. In this context, Google may receive technical data such as IP addresses, browser and device information, language settings and usage data from our Services. Your customer ID, email, postcode and behavioural data may be stored in Google Cloud. We use Google Cloud to aggregate and process your data in order to better present recommended products on the website and in our marketing. This data is stored within the EU, and only trusted GoWish employees have access to it. Google processes the data as a data processor on our behalf under a data processing agreement.

In connection with programmatic advertising via the IAB Transparency and Consent Framework set up on the Website through CookieBot and in the Platform through Usercentrics, your Personal Data may, to the extent you have given consent, be shared with a number of third-party advertisers and adtech vendors registered on IAB Europe's Global Vendor List. The current list of these vendors is set out in our consent solutions and cookie policy.

Where possible, we require our partners to process your data within the EU/EEA. However, some of our suppliers operate outside the EU/EEA, for example in the USA, and use of these suppliers involves the transfer of your Personal Data outside the EU/EEA. Where processing within the EU/EEA is not possible, we ensure transfers take place in accordance with Chapter V of the GDPR.
Transfers to third countries assessed as providing an adequate level of protection do not require specific authorisation.
For transfers to countries outside the EU/EEA, we ensure an appropriate transfer mechanism is in place, such as:

• A European Commission adequacy decision
• EU Standard Contractual Clauses
• Another valid transfer basis under GDPR Chapter V, including Data Privacy Framework certification for recipients in the USA: https://www.dataprivacyframework.gov/s/participant-search

We currently work with the following service providers outside the EU/EEA:

We also share Personal Data collected via cookies on our website with the third-party providers listed in our cookie policy.

We may share your data with third parties, including partners involved in digital advertising, who use it for targeted advertising and so-called "Custom Audience" matching. We currently work with example: Google LLC, Meta Platforms Ireland Ltd., TV2 Danmark A/S, Dentsu A/S and Snap Group SAS. Users who do not wish to have their data shared may opt out at any time, unconditionally, via their membership profile page under 'Account' and then opt out of 'Advertising partners' ('Annoncepartnere').

We may also produce aggregated and anonymised analyses based on data collected through the Services — for example, statistical insights about trends, product popularity, wish list activity, traffic patterns or other platform usage metrics. These analyses do not identify individual users and do not contain Personal Data. They may be used internally or shared with partners, service providers or other third parties for analytical, product development or reporting purposes.

5. RETENTION PERIOD

We retain your Personal Data for as long as necessary for the purpose of the processing.

This means we will retain your Personal Data for as long as you have an active profile with GoWish. If you delete your account via your profile, your data will be deleted or anonymised within 5 days, unless we have a legitimate interest or legal obligation to retain it.

We retain your data for up to 2 years after the last activity on your profile. "Activity" includes creating a wish, reserving a wish, or similar actions.
For marketing purposes, including newsletter subscriptions, we retain your data until you withdraw your consent and no longer wish to receive communications from us.

If you have participated in a competition, we delete your data no later than 12 months after the competition has been fully concluded and administered. Data necessary to document that the competition was based on valid consent is retained for two years after opt-out, in accordance with the limitation rules in the Danish Marketing Practices Act.

If you have granted GoWish access to your address book in order to see which of your contacts also use GoWish, GoWish deletes that data immediately. It is not stored by GoWish.

6. YOUR RIGHTS

We ask you to keep the Personal Data you provide to us up to date and to correct any changes by updating your GoWish profile. If you are unable to correct your information yourself, you can contact us with your specific request at contact@gowish.com.

You can exercise your rights directly within the Services to a large extent. Among other things, you can delete your user account and the information we have registered about you. For rights you cannot exercise directly in the Services, please refer to the procedure described above.

You are responsible for maintaining the confidentiality of your profile and login credentials (including your password), and for all activities carried out under your profile. If you create a profile with us, do not share your login credentials with anyone.

Your rights are as follows:

• Right of access: The right to see the Personal Data being processed about you.
• Right to rectification: The right to have inaccurate data corrected.
• Right to erasure ("right to be forgotten"): The right to have data deleted before the standard deletion deadline, where specific conditions are met.
• Right to restriction of processing: The right to restrict the use of your data in certain situations.
• Right to object: The right to object to otherwise lawful processing, e.g. direct marketing.
• Right to data portability: The right to receive your data in a structured format (where processing is based on consent or contract).
• Right to withdraw consent: Where processing is based on your consent. This can be done via your user profile.
• Right to lodge a complaint: The right to complain to the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with the processing.

To exercise any of the above rights, please send a request to privacy@gowish.com. You will receive a response within 30 days.

We have implemented a number of measures to protect your Personal Data and safeguard your rights. Please note that some rights only apply under certain circumstances. Datatilsynet has published guidance on the rights of data subjects. To read more about your rights, please see here.

7. QUESTIONS

If you have general questions about this privacy policy, wish to exercise any of your rights as described above, or disagree with the way we process your Personal Data, please contact GoWish at privacy@gowish.com.

8. COMPLAINTS TO THE DANISH DATA PROTECTION AUTHORITY

If you disagree with the way GoWish processes your Personal Data, you may also lodge a complaint with the Danish Data Protection Authority (Datatilsynet) using the contact details available at www.datatilsynet.dk.
We hope, however, that you will first contact GoWish at privacy@gowish.com so that we can try to resolve the matter together.

9. CHANGES AND LATEST VERSION OF THIS PRIVACY POLICY

This privacy policy is updated on an ongoing basis and revised regularly. The current version is always the one available here on www.gowish.com.

This policy has been prepared in Danish and may be translated into other languages. In the event of any discrepancy or ambiguity between the Danish version and a translation, the Danish version shall prevail.

This is version 5 of GoWish's Privacy Policy, dated 19. September 2026.