Privacy Policy

This policy explains how Branthiq ApS processes your personal data in compliance with the EU General Data Protection Regulation (GDPR) and Danish law.

Data controller

Branthiq ApS, CVR no. 45786943, is the data controller for the personal data we process. Contact: admin@branthiq.com.

What data we process

We process the following data:

• Contact details: Name, email and message when you fill in the contact form. If you email us, we process the details you give us, such as your phone number and company.
• IP address and browser information: Netlify, which hosts the site, receives your IP address when you visit. When you start filling in the contact form, the site loads Cloudflare Turnstile, which checks that the message does not come from a bot. Cloudflare receives your IP address and information about your browser. If you submit the form, we store your IP address in our database for 30 days. The IP address is used to limit messages to two per IP address per day.
• Statistics and ad measurement (consent only): Google Analytics 4 measures page views, scrolling, clicks, use of the contact form, device and browser information and approximate location (city). Google Ads measures whether your visit came from a Google ad and led to an enquiry. Both are loaded with the Google tag (gtag.js). Automatic collection of user-provided data is turned on, so if you submit the contact form after saying yes, Google may receive your email address in hashed form. Google signals is also turned on, so Google may combine data on usage across browsers and devices for Google users who allow personalised ads.
• Your choice in the cookie banner: Stored locally in your browser (localStorage) for 12 months.

Purpose and legal basis

• Running the website: Netlify receives your IP address to deliver the site - basis: GDPR art. 6(1)(f) (legitimate interest).
• Contact form and email: We respond to your enquiry, may form an agreement and protect the form against bots and spam - basis: GDPR art. 6(1)(b) (contract) and art. 6(1)(f) (legitimate interest).
• Statistics and ad measurement: We improve the site, understand usage and measure whether our ads lead to enquiries - basis: GDPR art. 6(1)(a) (consent).

Recipients and processors

We share data with the following processors, all under written agreement:

• Netlify, Inc. (USA, EU-US Data Privacy Framework) - hosting the website and running the contact form.
• Google LLC (USA, EU-US Data Privacy Framework) - Google Workspace (Gmail), where contact form messages and what you email us are received and stored.
• Google LLC (USA, EU-US Data Privacy Framework) - Google Analytics 4 (consent only).
• Supabase Inc. (EU region, Frankfurt) - database holding IP addresses from the contact form for 30 days.
• Cloudflare (USA, EU-US Data Privacy Framework) - Turnstile bot protection.

Enquiries from the contact form (name, email and message) received before 6 October 2026 are still held in our internal Slack channel with Slack (USA, EU-US Data Privacy Framework) until they are deleted at the first monthly review after they turn 12 months old.

In addition, Google receives data through Google Ads (consent only). Google lists Google Ads as a service for which Google itself is the controller. Cloudflare states that it is also a controller in its own right when it uses Turnstile data to improve the service.

Retention

• Correspondence and client data: as long as necessary for the client relationship, then deleted or anonymised.
• Enquiries from the contact form that do not become a client relationship: 12 months, then deleted at the first monthly review after that. If an enquiry becomes a client relationship, it is kept as correspondence with the client.
• IP address from the contact form in our database: 30 days, then deleted automatically.
• Accounting records: 5 years after end of fiscal year (Danish Bookkeeping Act).
• Statistical data in GA4: up to 14 months.

Transfers to third countries

Some processors are located outside the EU/EEA. Transfers happen either under the EU-US Data Privacy Framework or under EU Standard Contractual Clauses (SCCs).

Your rights

You have the right to:

• Access the data we hold about you (art. 15).
• Rectification of inaccurate data (art. 16).
• Erasure ("right to be forgotten", art. 17).
• Restriction of processing (art. 18).
• Data portability (art. 20).
• Object to processing based on legitimate interest (art. 21).
• Withdraw consent at any time (art. 7).

Email admin@branthiq.com to exercise your rights. We respond within 30 days.

Complaints

You may file a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, +45 33 19 32 00, datatilsynet.dk.

Changes

We may update this policy. The current version is always available on this page with the date of the latest update.