Privacy policy

This Privacy Policy describes how CVRWatch ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or use our services ("Service"). We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Danish data protection law.

Data Controller

The data controller responsible for your personal data is:
Ulhaq IT Consulting ApS
CVR: 44153068
Gymnasievej 149 1tv, 4600 Køge, Denmark
Email: info@cvrwatch.dk

Data We Collect

We may collect the following types of information:

• Personal data - your name, email address and billing information.
• Customer data - data you or your users input into the system as part of using the Service, stored and processed only to provide the Service and related services to you.
• Usage data - information about how you interact with the Service, such as log files, IP addresses, browser types, device information, and pages visited.
• Enquiries - the name, email address and message you send us through the contact form on this website.

Personal Data from the CVR Register

The Service stores snapshots of companies retrieved from the public CVR register operated by the Danish Business Authority (Erhvervsstyrelsen) via Virk. Where a monitored company is a sole trader or small partnership, these snapshots may contain personal data about identifiable natural persons, such as their name, business address, and registration status. This data is obtained from the public register, not from the persons themselves, and is already publicly available by law. We process it on the basis of our legitimate interest (Art. 6(1)(f)) in providing the monitoring service our customers subscribe to.

Controller and Processor Roles

For the personal data described above that appears on your watchlist, you are the data controller and we act as your data processor. That processing is governed by the Data Processing section of our Terms of Service. For account, billing, usage and enquiry data we are the data controller.

Legal Basis for Processing

• Performance of a contract (Art. 6(1)(b)) - account data and usage data are processed to deliver the service you have subscribed to.
• Legal obligation (Art. 6(1)(c)) - billing records are retained to comply with Danish bookkeeping law (bogføringsloven).
• Legitimate interest (Art. 6(1)(f)) - transactional emails (password reset, change alerts), service-related communications and replies to your enquiries are sent on the basis of our legitimate interest in operating the service; CVR register data is processed as described above.

Data Processors and Third-Party Services

We share personal data only with processors necessary to deliver the service. All processors are bound by data processing agreements (DPAs) in accordance with Art. 28 GDPR:

• Stripe - payment processing. Receives billing contact information and processes card data on our behalf. EU customers are served by Stripe Payments Europe, Ltd. (Ireland).
• Hetzner Online GmbH - cloud infrastructure and hosting. Stores and processes data on servers located in the EU on our behalf.
• Transactional email provider - delivery of system emails. Receives your email address and the content of system notifications. The provider is located outside the EU/EEA; see International Data Transfers below.
• tawk.to inc. - live chat support inside the signed-in application. Loaded only with your consent via the cookie banner; receives the messages you send and technical data required to operate the chat session.

We do not sell or share your personal data with third parties for marketing purposes.

International Data Transfers

Some of our processors transfer personal data outside the EU/EEA. Transfers to Stripe's US entities are safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) approved by the European Commission. Transfers to our transactional email provider and to tawk.to (US) are safeguarded by Standard Contractual Clauses. In all cases an adequate level of protection for your data is ensured.

Cookies, Analytics, and Chat

This website sets no cookies. For web statistics we use a self-hosted, cookieless analytics tool running on our own EU-hosted infrastructure. It stores nothing on your device, collects only aggregated usage statistics, and shares no data with third parties.

The signed-in application uses a session cookie strictly necessary for authentication, and offers an optional live support chat (Tawk.to). The chat widget is loaded only if you accept optional cookies in the app's cookie banner; until then no data is shared with the chat provider. When loaded, Tawk.to sets cookies required to operate the chat session. Your choice is stored on your device for up to 12 months, and you can change it at any time via "Cookie settings" in your account's privacy settings.

Data Retention

Account and usage data is retained for as long as your account is active. Audit logs, including IP addresses, are kept while your account is active and are included in your data export. When an account is deleted it is permanently purged, including audit logs, after a 30-day grace period. Billing records are retained for 5 years from the end of the financial year they concern, to comply with Danish bookkeeping requirements. Enquiries are kept only as long as needed to handle them.

Security

We protect personal data with appropriate technical and organisational measures (Art. 32 GDPR), including encryption in transit (TLS), role-based access controls, and hosting on EU-located infrastructure.

Automated Decision-Making

We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent - for optional cookies, use "Cookie settings" in your account's privacy settings
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk

You can exercise these rights from your account settings under Privacy & Data, or by contacting us at info@cvrwatch.dk.

Changes to This Policy

We may update this policy from time to time. Material changes will be announced by email and reflected in the "Last updated" date at the top of this page.

Contact

For privacy-related inquiries please contact us at info@cvrwatch.dk.