1. INTRODUCTION

It is important to GoWish ApS ("GoWish", "we", "us" or "our") that you feel confident about how we handle your personal data ("Personal Data"). We therefore have a privacy policy describing how we process the Personal Data we collect when you create an account on and use our website partner.GoWish.com ("the Website"). Our processing is carried out responsibly, with respect for your privacy, and in accordance with the principles and requirements of the General Data Protection Regulation (hereinafter “GDPR”) and the Danish Data Protection Act.

The purpose of this privacy policy is, among other things, to inform you about how we specifically process Personal Data and about your rights in connection with that processing.

Your use of the Website and submission of your Personal Data to us constitutes your acknowledgement that you have received and read this privacy policy.

This privacy policy was last updated on 3 September 2026.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The data controller for the processing of your Personal Data is:
GoWish ApS
Amerika Plads 19, 3rd floor
2100 Copenhagen Ø
CVR number: 41284366

If you have questions about the processing of your Personal Data, please contact our data protection team at privacy@gowish.com.

3. DESCRIPTION OF PROCESSING ACTIVITIES

3.1. Contact form and partner enquiries

Purpose: When you submit an enquiry through the Website contact form, or otherwise reach out to our partner team, we process certain personal data in order to respond to your enquiry and manage our commercial relationship with you. Failure to provide this data may mean we are unable to respond to or follow up on your enquiry.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, job title, business email address and phone number
• Company name and relevant business information
• The content of your enquiry or message
• Notes and records of any subsequent calls, meetings or correspondence

Legal basis: The processing of your personal data is based on GoWish's legitimate interest in responding to business enquiries and managing its commercial partner relationships, in accordance with Article 6(1)(f) of the GDPR. Where a specific partnership is requested or agreed upon, the processing may additionally be necessary for the performance of a contract, in accordance with Article 6(1)(b) of the GDPR.

3.2. Analytics and partner outreach, including by telephone

Purpose: GoWish uses analytics tools to understand how visitors use the Website, including which pages are visited, how long visitors spend on the Website, and general navigation patterns. This helps us improve the our service and, where relevant, identify companies that have shown an interest in our partnership programme. In some cases, we may use this information, combined with publicly available professional data, to contact a representative of the relevant company about partnership opportunities, including by telephone.

Categories of personal data: The categories of personal data we may process in connection with this activity include:

• Analytics and behavioural data relating to your visit to the Website (via cookies - see our Cookie Policy for further information)
• Company name and sector, where identifiable through analytics data
• Publicly available professional contact information, such as name, job title and business contact details

Legal basis: The processing of analytics data is based on your consent, see Article 6(1)(a) of the GDPR, where non-necessary cookies are used. Where analytics data informs our commercial outreach activities, including telephone contact, the processing is based on GoWish's legitimate interest in identifying and developing partnerships with relevant companies, in accordance with Article 6(1)(f) of the GDPR. Companies visiting the Website would reasonably expect to be contacted about partnership opportunities. You may object to this processing at any time by contacting us at privacy@gowish.com.

3.3. Marketing and event communications

Purpose: If you have signed up to receive news, updates or invitations from GoWish in connection with our partnership programme, we process your personal data in order to send you relevant communications by email or other electronic media.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name and business email address

Legal basis: The processing of your personal data is based on your consent, see Article 6(1)(a) of the GDPR, where you have actively opted in to receive communications from us. For existing business contacts, the processing may be based on GoWish's legitimate interest in maintaining relevant commercial relationships and keeping partners informed, in accordance with Article 6(1)(f) of the GDPR and applicable marketing law. You may withdraw your consent or unsubscribe at any time.

3.4. Contract and commercial management

Purpose: When GoWish enters into a partnership agreement with a company, we process the personal data of the individuals named in or involved in that agreement in order to manage the commercial relationship, fulfil our contractual obligations and comply with applicable legal requirements.

Categories of Personal Data: The categories of personal data that we process about you include:

• Name, job title, business email address and phone number of signatories, billing contacts and operational contacts
• Content of signed agreements and related correspondence
• Commercial negotiation records and performance data related to the partnership

Legal basis: The processing of your personal data is necessary for the performance of the contract with you or the company you represent, in accordance with Article 6(1)(b) of the GDPR. The processing is also necessary for GoWish to comply with applicable legal obligations - including record-keeping requirements - in accordance with Article 6(1)(c) of the GDPR. Ongoing relationship management beyond the immediate contract is based on GoWish's legitimate interest in maintaining active commercial partnerships, in accordance with Article 6(1)(f) of the GDPR.

3.5. Satisfaction surveys

Purpose: GoWish may in some cases use Personal Data to send out satisfaction surveys.

Categories of Personal Data:

• Name, email address and your survey responses

Legal basis: Article 6(1)(f) GDPR - legitimate interest in improving the Services.

3.6. Cookies and other technologies on the Services

Purpose: GoWish uses cookies on the Website for functional and statistical purposes, tracking visitors via Google Analytics and managing consent through CookieBot.

You can find more information about our use of cookies and how to delete or disable them in our cookie policy.

Categories of Personal Data: The categories of personal data that we process about you include:

• Whether you have previously visited the site, Cookie and tracking data, including pixels from third parties such as Meta Pixel and Google Ads

Legal basis: Article 6(1)(a) GDPR for non-necessary cookies (consent). Article 6(1)(f) GDPR for other purposes (legitimate interest in ensuring website functionality and conducting traffic analysis).

3.7. Other contact and communication with you

Purpose: Personal Data is processed so that GoWish can communicate with you.

Categories of Personal Data:

• Name, email address and phone number

Legal basis: Article 6(1)(f) GDPR - legitimate interest in communicating with you.

3.8. Establishing, exercising or defending a legal claim

In addition to the above, there may be instances where your Personal Data is processed for the purpose of establishing, exercising or defending a legal claim under Article 6(1)(f) GDPR.

4. RECIPIENTS OF YOUR PERSONAL DATA

We transfer Personal Data to data processors who carry out various tasks on our behalf, including hosting, support, technical operations, analytics, service improvement and newsletter distribution.

We have entered into data processing agreements with all our data processors. They may only access and process Personal Data on our behalf, based on our instructions and for our specified purposes.

We may also disclose Personal Data where required to comply with applicable law, court orders or other public authority decisions, or where disclosure is necessary to uncover or investigate suspected unlawful use of the Services.

We use Google as a supplier of certain technical and analytical solutions, including Google Analytics, Google Tag Manager and Google Cloud services. In this context, Google may receive technical data such as IP addresses, browser and device information, language settings and usage data from our Services. Your customer ID, email, postcode and behavioural data may be stored in Google Cloud. We use Google Cloud to aggregate and process your data in order to better present recommended products on the website and in our marketing. This data is stored within the EU, and only trusted GoWish employees have access to it. Google processes the data as a data processor on our behalf under a data processing agreement.

We use HubSpot to manage enquiries submitted through our partner contact form. When you submit a message through the form, the information you provide, including your name, business email address, company name and message content, is stored and managed in HubSpot's CRM platform. HubSpot is based in the United States and processes data on our behalf under a data processing agreement. HubSpot is certified under the EU-US Data Privacy Framework, which provides an appropriate safeguard for the transfer of your personal data to the USA.

Where possible, we require our partners to process your data within the EU/EEA. However, some of our suppliers operate outside the EU/EEA, for example in the USA, and use of these suppliers involves the transfer of your Personal Data outside the EU/EEA. Where processing within the EU/EEA is not possible, we ensure transfers take place in accordance with Chapter V of the GDPR.

Transfers to third countries assessed as providing an adequate level of protection do not require specific authorisation.

For transfers to countries outside the EU/EEA, we ensure an appropriate transfer mechanism is in place, such as:

• A European Commission adequacy decision
• EU Standard Contractual Clauses
• Another valid transfer basis under GDPR Chapter V, including Data Privacy Framework certification for recipients in the USA: https://www.dataprivacyframework.gov/s/participant-search

We currently work with the following service providers outside the EU/EEA. For each provider, we have indicated the types of personal data that may be transferred to the provider and the purpose for which it is transferred:

• Fastly (USA). Purpose: IT Security and Performance - IP address, location, website endpoints
• ActiveCampaign (USA). Purpose: Newsletter distribution (only consented) - name and business email
• Twilio (USA). Purpose: Sending administrative emails - name and business email
• HubSpot (USA). Purpose: Management of inquiries via the partner contact form - Name, business email, company name

We also share Personal Data collected via cookies on our website with the third-party providers listed in our cookie policy.

5. RETENTION PERIOD

We retain your Personal Data for as long as necessary for the purpose of the processing.

For marketing purposes, including newsletter subscriptions, we retain your data until you withdraw your consent and no longer wish to receive communications from us.

6. YOUR RIGHTS

We ask you to keep the Personal Data you provide to us up to date and to correct any changes by contacting us with your specific request at privacy@gowish.com.

You are responsible for maintaining the confidentiality of your profile and login credentials (including your password), and for all activities carried out under your profile. If you create a profile with us, do not share your login credentials with anyone.

Your rights are as follows:

• Right of access: The right to see the Personal Data being processed about you.
• Right to rectification: The right to have inaccurate data corrected.
• Right to erasure ("right to be forgotten"): The right to have data deleted before the standard deletion deadline, where specific conditions are met.
• Right to restriction of processing: The right to restrict the use of your data in certain situations.
• Right to object: The right to object to otherwise lawful processing, e.g. direct marketing.
• Right to data portability: The right to receive your data in a structured format (where processing is based on consent or contract).
• Right to withdraw consent: Where processing is based on your consent. This can be done via your user profile.
• Right to lodge a complaint: The right to complain to the Danish Data Protection Authority (Datatilsynet) if you are dissatisfied with the processing.

To exercise any of the above rights, please send a request to privacy@gowish.com.

You will receive a response within 30 days.

We have implemented a number of measures to protect your Personal Data and safeguard your rights. Please note that some rights only apply under certain circumstances. Datatilsynet has published guidance on the rights of data subjects.

7. QUESTIONS

If you have general questions about this privacy policy, wish to exercise any of your rights as described above, or disagree with the way we process your Personal Data, please contact GoWish at privacy@gowish.com.

8. COMPLAINTS TO THE DANISH DATA PROTECTION AUTHORITY

If you disagree with the way GoWish processes your Personal Data, you may also lodge a complaint with the Danish Data Protection Authority (Datatilsynet) using the contact details available at www.datatilsynet.dk. We hope, however, that you will first contact GoWish at privacy@gowish.com so that we can try to resolve the matter together.

9. CHANGES AND LATEST VERSION OF THIS PRIVACY POLICY

This privacy policy is updated on an ongoing basis and revised regularly. The current version is always the one available here on GoWish.com.

This policy has been prepared in Danish and may be translated into other languages. In the event of any discrepancy or ambiguity between the Danish version and a translation, the Danish version shall prevail.

This is version 1 of Partner GoWish's privacy policy, dated 3 September 2026.