Legal
Privacy Policy
How Capacit processes personal data - including when you use the contact form or book a meeting.
Capacit A/S · CVR 42607797 · Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark
1.Data controller#
Capacit A/S, CVR 42607797, Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark, is the data controller for the personal data processed on capacit.com and in the enquiries the site gives rise to.
If you have questions about how we process your personal data, write to info@capacit.com or call +45 32 26 90 01. We aim to reply within five working days.
We have not appointed a data protection officer (DPO). Privacy enquiries go to the address above.
2.What data we process#
The contact form: name, email address, company (optional), the area of interest you may select, and the message you write. Alongside the enquiry we store the consent text you were shown and the address of the page the form was sent from.
Meeting booking: if you book a meeting through the calendar on the contact page, we process the details you enter there - typically your name, email address and the time you choose.
Correspondence: if you write or call, we process the content of the correspondence and the contact details it carries.
Client and partner relationships: ordinary business contact details about you as a contact person - name, title, work email, phone number and company - along with whatever else forms part of the agreement and the collaboration.
Technical data: when you visit the site, our hosting provider processes what is necessary to deliver the page and keep it stable and secure. That includes IP address, timestamp, the address requested, status code, browser type and any referring page. This data forms part of operational logs and is not used to profile you.
We do not ask for special-category data, national identity numbers or payment details on the site - and they do not belong in the message field.
3.Purpose and legal basis#
We process personal data in order to answer enquiries, arrange and hold meetings, enter into and perform agreements, run capacit.com responsibly and comply with the rules that apply to us.
The contact form: the processing rests on your consent, Article 6(1)(a) of the GDPR. You tick the box yourself before the form can be sent, and you may withdraw your consent at any time by writing to info@capacit.com.
Meeting booking and pre-contractual dialogue: Article 6(1)(b), where the processing takes place at your request as a step towards an agreement - and otherwise our legitimate interest in answering your enquiry, Article 6(1)(f).
Client and partner relationships: Article 6(1)(b), where you are yourself a party to the agreement, and otherwise our legitimate interest in managing the relationship with the company you represent, Article 6(1)(f).
Operations and security: our legitimate interest in delivering a website that works, and in being able to detect and handle misuse, Article 6(1)(f).
Bookkeeping and other legal obligations: Article 6(1)(c).
We do not use the data for marketing without your consent, and we take no automated decisions producing legal effects or similarly significant effects under Article 22 of the GDPR.
4.Contact form and meeting booking#
When you send the contact form, it goes to our own server, which forwards the enquiry to HubSpot. There it becomes a contact in our CRM, which our team works from. No HubSpot JavaScript is loaded on the page, and the form sets no cookie.
We use the data to answer your particular enquiry and to follow up if a dialogue comes of it. You are not signed up to a newsletter, and we do not send you marketing on the basis of the form.
Alongside the enquiry we store the consent text you were shown, in the language version you saw it in. That is the record of what you agreed to.
The booking calendar on the contact page is embedded from HubSpot (meetings-eu1.hubspot.com) and loads only once you scroll down to it. From that moment HubSpot receives your IP address and browser details, as any other server you fetch content from does, and sets its own technical cookies inside the frame. If you pick a time, the booking itself is processed by HubSpot on our behalf.
6.Recipients and processors#
We do not sell personal data and do not hand it to third parties for their own purposes. The suppliers who process personal data on our behalf when you use capacit.com are:
| Processor | Purpose | Location |
|---|---|---|
| HubSpot | Contact form, meeting booking and CRM | EU data region (eu1) |
| Vercel | Hosting and delivery of capacit.com, including operational logs | EU (Stockholm) and global CDN |
A data processing agreement under Article 28 of the GDPR is in place with each of them, and they may process the data only on our instructions.
Beyond that, data may be shared with our auditor and other professional advisers under a duty of confidentiality, and with public authorities where the law requires it.
7.Transfers to third countries#
capacit.com is hosted in the EU, and the HubSpot portal sits in HubSpot's EU data region. The processing therefore takes place within the EU/EEA as a matter of course.
Our suppliers belong to groups with companies outside the EU/EEA, and support and operations may be carried out from there. Where personal data is transferred to a third country, it happens on a valid transfer basis - the European Commission's standard contractual clauses with the necessary supplementary measures, an adequacy decision, or an equivalent basis.
If you would like to see the safeguards for a particular transfer, ask for them at info@capacit.com.
8.Retention and deletion#
We keep personal data only for as long as there is a purpose for it, and delete it afterwards.
Enquiries through the contact form, and the correspondence about them, are kept for up to two years after the last contact if no client relationship comes of them. If you withdraw your consent, we delete the enquiry unless we have an independent basis for keeping it.
If a client relationship does come of it, contract and relationship records are kept for as long as the collaboration runs, and then for up to three years, so that we can establish, exercise or defend a legal claim.
Invoicing and accounting records are kept for five years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires.
Operational logs held by our hosting provider are kept briefly and in any event for no more than 90 days.
9.Security#
All traffic to and from capacit.com is encrypted with HTTPS/TLS.
The contact form is sent to our own server and forwarded to HubSpot from there. The HubSpot access token lives on the server alone and is never handed to your browser.
Access to the systems holding enquiries and client data is limited to the employees who need it for their work.
No system is completely secure. If we become aware of a personal data breach, we handle it under Articles 33 and 34 of the GDPR - including notifying the Danish Data Protection Agency and the people affected, where the rules require it.
10.Your rights#
You have the right to access the personal data we process about you, and to have inaccurate data corrected.
Under certain conditions you have the right to have data erased, to have the processing restricted, to object to processing that rests on our legitimate interests, and to data portability.
If you have given consent - through the contact form, for instance - you may withdraw it at any time. That does not affect the lawfulness of processing carried out before the withdrawal.
You exercise these rights by writing to info@capacit.com. We reply without undue delay and in any event within one month. If the request is complex, the deadline may be extended by up to two months, in which case we tell you within the first month.
We may need to verify your identity before disclosing data. Exercising your rights is free of charge.
11.Complaints to the Danish DPA#
If you are unhappy with how we process your personal data, we would like to hear from you first - that usually resolves it quickly.
You may always lodge a complaint with the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, datatilsynet.dk. If you live or work in another EU country, you may also complain to the supervisory authority there.
12.Changes to this policy#
We update this policy when our processing of personal data changes, or when legislation requires it.
The version in force is always published on this page, with the date it was last updated at the top. If we change something material that affects you directly, we say so where we are able to.
13.Contact#
Questions about this policy, or about how we process your personal data, can be sent to info@capacit.com or raised on +45 32 26 90 01.
Capacit A/S, Overgaden Neden Vandet 9A, 1414 Copenhagen K, Denmark. CVR 42607797.
Both documents