Privacy policy
Last updated 4 September 2026
Apptivate operates this website. This policy explains what personal data the site collects, why we collect it, who processes it on our behalf and what rights you have.
It covers apptivate.dk only. Systems we build and operate for clients are governed by our agreement with that client. In those engagements the client decides how personal data is used, and this policy does not apply to them.
Who is responsible
Apptivate is the data controller for the processing described below.
Apptivate
Copenhagen, Denmark
[email protected]
We have not appointed a data protection officer, because we are not required to (Article 37 GDPR). Privacy questions go to the address above and are handled by a named person internally.
What we collect
Information you give us
Enquiries. The contact form asks for your name, your work email, your company and your message. All four are required. The submission is sent to us as an email at [email protected]; it is not written to a database or a customer relationship system. A copy of that email is held in the sending log at Resend, which is described under suppliers and in the retention table below. You can email that address directly if you prefer not to use the form.
We do not ask for special category data (Article 9 GDPR) at any point, and we ask that you do not include it in an enquiry.
Information collected automatically
Delivery and security logs. The site is served by Cloudflare. Its infrastructure logs request data, including your IP address, the page requested, the time of the request and your browser's user agent, so that pages can be delivered and abuse can be identified. We do not use these logs to build profiles.
The spam check. When you press Send, Cloudflare Turnstile checks that the submission comes from a person. It runs only at that moment, shows you a challenge only if it cannot tell without one, and may store a value in your browser to record that a check passed. Its processing is described in Cloudflare's Turnstile privacy addendum.
Rate limiting. Each submission writes a counter keyed on your IP address to a Cloudflare Workers KV store, so that a sixth message from the same address within ten minutes is refused. The counter holds no part of your message and is deleted automatically after ten minutes.
Statistics. Cloudflare Web Analytics tells us, in aggregate, how many people visit and which pages they read. For each request it records the page address, the referring page where there is one, and the approximate country, browser and device type derived at that moment. It sets no cookie, writes no identifier to your device and does not retain your IP address, so it cannot follow you between visits or across sites.
We do not run advertising on this site, and we do not sell personal data.
Cookies and similar technologies
We set no cookies. The spam check may store one strictly necessary value in your browser, described above, for the sole purpose of recording that a check passed; it is not used for anything else. The statistics are collected without any identifier on your device. Nothing on this site needs your consent under the Danish executive order on cookies (bekendtgoerelse nr. 1148 of 9 December 2011), which is why there is no cookie banner.
Why we process your data, and on what basis
| What we do | Legal basis |
|---|---|
| Reply to an enquiry and follow up on it | Our legitimate interest in responding to business enquiries, Article 6(1)(f), and, where a contract is being discussed, the steps taken at your request before entering into it, Article 6(1)(b) |
| Serve the site and keep it secure, including the spam check and rate limiting | Our legitimate interest in operating a functioning, secure website, Article 6(1)(f) |
| Measure how the site is used, in aggregate | Our legitimate interest in understanding the use of our own website, Article 6(1)(f), weighed against your rights by the absence of any identifier, any profile and any retained IP address |
Where we rely on legitimate interests, we have weighed our interest against your rights and will explain the assessment on request. We do not profile you and we make no automated decisions with legal effect (Article 22 GDPR).
Who else processes your data
We use a small number of suppliers, each under terms that limit them to processing on our instructions (Article 28 GDPR).
Cloudflare, Inc., hosting and delivery of the website, the delivery and security logs, the spam check (Turnstile), the rate limiting store (Workers KV) and the statistics (Web Analytics).
Resend (Plus Five Five, Inc.), which transmits your enquiry to us as an email, from an EU region.
Google Ireland Limited, which provides the mailbox that receives enquiries, because an enquiry reaches us as email and is answered from there.
We also disclose data where the law requires it, and to professional advisers where we need advice on a matter that involves your data.
Transfers outside the EU and EEA
Cloudflare and Resend are based in the United States, and some of their infrastructure is there. Where personal data reaches the United States, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR) when the recipient is certified under it, and on the Commission's standard contractual clauses (Article 46(2)(c) GDPR) where it is not. You can ask us for a copy of the mechanism that applies to a specific supplier.
How long we keep it
| Data | Retention |
|---|---|
| Enquiries and the correspondence that follows | For as long as the conversation is live, then 24 months after the last contact |
| Records of an engagement that results | For the period the Danish Bookkeeping Act requires, currently five years from the end of the financial year |
| Delivery and security logs | As retained by Cloudflare under its own terms |
| The copy of your enquiry in the sending log at Resend, which holds your name, your work email, your company and your message | As retained by Resend under its own terms |
| The rate limiting counter | Ten minutes from the submission, then deleted automatically |
| Statistics | In aggregate only, for a rolling period of at most six months; nothing in it can be resolved to a person |
Where we have a legal obligation to keep something longer, we keep that record for as long as the obligation lasts and no longer.
Your rights
Under the GDPR you have the right to:
- ask what personal data we hold about you and receive a copy (Article 15)
- have inaccurate data corrected (Article 16)
- have data deleted, where we have no continuing basis to keep it (Article 17)
- ask us to restrict processing while a dispute is resolved (Article 18)
- receive data you gave us in a portable format (Article 20)
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21)
Write to [email protected] to exercise any of these. We answer within one month (Article 12(3) GDPR). There is no charge unless a request is manifestly unfounded or excessive, and we will say so before doing anything.
If you are not satisfied with how we handle your data, you can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, [email protected] (Article 77 GDPR). Complaints about cookies specifically go to the Danish Business Authority, Erhvervsstyrelsen.
Security
The site is static, served over HTTPS with strict security headers, and it holds no database of its own. Form submissions travel over TLS to the email service and on to our mailbox. Access to enquiries is limited to the people at Apptivate who need it. We review the site's dependencies and the one third party script it loads as part of ordinary maintenance.
Children
This site is aimed at people acting in a professional capacity. It is not directed at children, and we do not knowingly collect data about them.
Changes
We update this policy when the site changes what it collects or which suppliers it uses. The date at the top shows the current version. Material changes are described briefly here rather than announced separately.
Contact
Apptivate
Copenhagen, Denmark
[email protected]