1 Introduction and scope
This notice explains how Verheim ApS collects and uses personal data when you visit our website, contact us, discuss a business relationship, request materials or take part in an event we organize. It explains the purposes of processing, the information involved, how it is shared and retained, and your rights.
It applies to website visitors, prospective customers, customer and partner representatives, people requesting downloads and event participants. It does not cover recruitment, freelance consultant profiles, customer support or personal data processed on behalf of customers within SAGA.
2 Data controller and privacy contact
Verheim ApS is the data controller for the processing described in this notice.
Address: Vasekær 10, 2730 Herlev, Denmark
Company registration number (CVR): 46447794
Privacy contact: mads.lindeneg@verheim.ai
Contact us at this email address with questions about the notice or to exercise your data protection rights.
3 Sources of personal data
We receive information directly from you through website forms, email, meetings and conversations. We may also receive relevant business contact information through LinkedIn, events, business partners and professional referrals. Our correspondence and meeting notes may add information about the professional interests and business needs you discuss with us.
Website and consent-management services also collect technical information and record privacy choices. The tables on the following pages describe the purposes, data categories, legal bases and retention approach for each activity.
4 Business contacts and requested activities
We use information relevant to the particular enquiry, relationship or requested activity. The following activities are covered where they take place.
| Activity and purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Enquiries and demonstrations Respond to questions, arrange requested demos and follow up on a specific discussion. | Name, work email, telephone number, job title, company, enquiry content and relevant meeting notes. | Article 6(1)(f) GDPR. Our legitimate interest in responding to relevant professional enquiries. | For inactive discussions without an ongoing relationship: normally no more than 24 months after the last substantive interaction; earlier if no longer needed. See Section 7. |
| Customer and partner relationships Communicate with representatives and manage the professional relationship. | Business contact details, correspondence, relevant meeting notes and professional interests. | Article 6(1)(f) GDPR. Our legitimate interest in managing professional relationships. | While relevant to the active relationship. We review outdated contacts and unnecessary notes every six months. Specific legal records may need longer retention. |
| Requested materials and downloads Deliver material you request and handle related practical questions. | Name, business contact details, company, requested material and related correspondence. | Article 6(1)(f) GDPR. Our legitimate interest in providing requested business information. | Until delivery and necessary follow-up are complete. Relevant information from a separate business discussion follows the enquiry rule. |
| Events Administer registration, participation and practical event communications. | Name, business contact details, job title, company, registration and participation information. | Article 6(1)(f) GDPR. Our legitimate interest in administering events people choose to attend. | Until the event and necessary practical follow-up are complete, unless a separate relevant business discussion continues. |
Providing information is voluntary. Required fields are identified at collection. Without necessary contact details, we may be unable to respond, deliver requested material or manage participation. Please keep website enquiries free of patient information, sensitive personal data and confidential project documents.
A download, event registration or enquiry does not subscribe you to a newsletter. Separate marketing activities requiring consent will have their own information and choice.
5 Website technologies and privacy choices
We use Cookie Information to manage website privacy choices. Webflow Analyze and LinkedIn Insight Tag are selected for optional statistics and advertising measurement. Their activation is being prepared. Where enabled, they are subject to the consent controls described below.
| Activity and purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Website delivery and protection Deliver requested pages and support secure, reliable operation. | Technical connection information, which may include IP address, request time and browser or device information. | Article 6(1)(f) GDPR. Our legitimate interest in operating and protecting the website. | Limited to operational and security needs, including investigating relevant technical issues or incidents. Necessary records are reviewed against that purpose. |
| Consent management Remember choices and document the consent or refusal on which processing relies. | Consent identifier, choice, time, domain or page and technical information needed to document the choice. | Article 6(1)(c) GDPR. Compliance with our obligations to record and respect privacy choices. | Browser-storage expiry is shown in the cookie declaration. Separate proof records are retained for the need to document the choices relied on; see Section 7. |
| Optional statistics Understand website use and improve pages through Webflow Analyze. | Visits, pages viewed, clicks, scrolling and device or browser information. Analyze uses browser local storage. | Article 6(1)(a) GDPR. Your consent. | Browser-storage duration is shown in the cookie declaration. Service-side records are subject to separate retention and deletion arrangements; see Section 7. |
| Optional advertising measurement Measure LinkedIn advertising through the Insight Tag. | Page URL, referrer, timestamp, IP address and browser or device information. LinkedIn may associate visits with a member account. | Article 6(1)(a) GDPR. Your consent. | LinkedIn describes removal of direct identifiers within 7 days and deletion of remaining pseudonymized tag data within 180 days. Cookie durations are listed separately. |
You can refuse optional tracking and use Cookie settings to change or withdraw your choice. Withdrawal does not affect earlier lawful processing. The cookie declaration provides details about enabled technologies and browser-storage durations. Declining optional tracking does not prevent you from browsing the website.
6 Sharing and international processing
Within Verheim, access to business enquiries is limited to people who need the information for their work. We use service providers for website hosting and forms, business email, calendar and document services, and consent management. The current providers are Webflow, Google Workspace and Cookie Information.
Contact form notifications are addressed to mads.lindeneg@verheim.ai. A Webflow form record and its email notification may be stored separately. Providers processing data on our behalf are subject to applicable data processing terms and instructions.
LinkedIn processes relevant Insight Tag data under its separate controller terms, rather than solely on our instructions. Its privacy information explains how it uses that information for its services and advertising-related purposes. We may disclose specific records when required by law or necessary to establish, exercise or defend a legal claim.
Providers may process information outside the European Economic Area, including in the United States. Webflow states that customer and website visitor data is stored in the United States. LinkedIn also describes US storage for Insight Tag data. Cookie Information describes CMP hosting in the Netherlands, with possible US access in specified circumstances.
Webflow and LinkedIn Corporation participate in the EU-US Data Privacy Framework for covered data. Their contractual terms also address international transfers, including the use of EU Standard Contractual Clauses where applicable. The applicable mechanism depends on the recipient and processing concerned. Contact our privacy contact for further information about relevant safeguards and how to obtain a copy.
7 Retention and deletion
We delete or anonymize information when it is no longer needed. The periods and criteria in Sections 4 and 5 apply to each purpose. For inactive enquiries, the normal 24-month limit runs from the last substantive interaction. An outbound reminder or advertising impression alone does not restart that period.
Redundant Webflow form submission records are deleted manually within 90 days of receipt. Relevant enquiries may be retained in Webflow for as long as needed under the enquiry or relationship rules above, including the normal 24-month limit for inactive discussions.
We review enquiry records regularly. A specific, documented need can justify retaining relevant records longer, such as an agreed future discussion, an applicable legal obligation or a legal claim. We retain only information necessary for that need.
Event and download administration records are deleted when the activity and necessary follow-up are complete. If a separate business discussion develops, we retain only the information relevant to that discussion. We assess obsolete contacts and unnecessary notes even when a business relationship continues.
Browser-storage expiry and server-side retention are different. Consent records document the choices relied on for processing; analytics and advertising services may hold separate records. Their retention must reflect the specific purpose, the applicable service arrangements and any necessary documentation of consent or legal claims. You can contact us for information about the records concerning you.
8 Your rights and complaints
Depending on the circumstances and applicable law, you can:
- Ask for access to your personal data and information about its processing.
- Ask us to correct inaccurate or incomplete personal data.
- Request deletion or restriction of processing where the conditions are met.
- Object to processing based on legitimate interests. Where information is used for direct marketing, you can object to that use at any time.
- Request a portable copy where the right to data portability applies.
- Withdraw consent at any time where processing relies on consent, without affecting earlier lawful processing.
Send requests to mads.lindeneg@verheim.ai. We may need information to confirm your identity. Some rights are subject to conditions, and records may need to be retained for an applicable legal obligation or legal claim.
You can complain to a supervisory authority, including where you live or work or where you believe an infringement occurred. In Denmark, contact Datatilsynet through datatilsynet.dk/kontakt.
9 Automated decisions
Business enquiries are assessed manually. We do not make decisions about your enquiry solely by automated means that produce legal or similarly significant effects. This is separate from the optional analytics and advertising processing described in Section 5.
10 Changes to this notice
We update this notice when relevant changes occur in how we handle personal data. The version date identifies the current text.