Legal
Privacy Policy
How Capacit processes personal data - including when you use the contact form, download a white paper, sign up for our newsletter or book a meeting.
Capacit A/S · CVR 42607797 · Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark
1.Data controller#
Capacit A/S, CVR 42607797, Overgaden Neden Vandet 9A, 1414 Copenhagen, Denmark, is the data controller for the personal data processed on capacit.com and in the enquiries the site gives rise to.
If you have questions about how we process your personal data, write to info@capacit.com or call +45 32 26 90 01. We aim to reply within five working days.
We have not appointed a data protection officer (DPO). Privacy enquiries go to the address above.
2.What data we process#
The contact form: name, email address, company (optional), and the message you write. Alongside the enquiry we store the address of the page the form was sent from.
White papers: your email address and, if you fill them in, your name and organisation. With them we store which white paper you downloaded and the address of the page the form was sent from.
Newsletter: if you tick the newsletter box when you download a white paper, we store your consent together with the time and the wording you agreed to.
Meeting booking: if you follow the booking link on the contact page, the booking takes place at HubSpot, and the details you enter there - typically your name, email address and the time you choose - are processed on our behalf.
Correspondence: if you write or call, we process the content of the correspondence and the contact details it carries.
Client and partner relationships: ordinary business contact details about you as a contact person - name, title, work email, phone number and company - along with whatever else forms part of the agreement and the collaboration.
Technical data: when you visit the site, our hosting provider processes what is necessary to deliver the page and keep it stable and secure. That includes IP address, timestamp, the address requested, status code, browser type and any referring page. This data forms part of operational logs and is not used to profile you.
We do not ask for special-category data, national identity numbers or payment details on the site - and they do not belong in the message field.
3.Purpose and legal basis#
We process personal data in order to answer enquiries, arrange and hold meetings, enter into and perform agreements, run capacit.com responsibly and comply with the rules that apply to us.
The contact form, meeting booking and pre-contractual dialogue: Article 6(1)(b) of the GDPR, where the processing takes place at your request as a step towards an agreement - and otherwise our legitimate interest in answering your enquiry, Article 6(1)(f). If you would like your enquiry deleted, write to info@capacit.com.
White papers: we process the data to send you the document you asked for and to record who downloaded what. The legal basis is Article 6(1)(b), because the processing happens at your request, and our legitimate interest in knowing who is interested in our material, Article 6(1)(f). We do not send you marketing on the basis of a download.
Newsletter: we only send you the newsletter if you have consented to it, Article 6(1)(a) and section 10 of the Danish Marketing Practices Act. Consent is voluntary and is not a condition for downloading a white paper. You can withdraw it at any time through the link in the newsletter or by writing to info@capacit.com.
Client and partner relationships: Article 6(1)(b), where you are yourself a party to the agreement, and otherwise our legitimate interest in managing the relationship with the company you represent, Article 6(1)(f).
Operations and security: our legitimate interest in delivering a website that works, and in being able to detect and handle misuse, Article 6(1)(f).
Bookkeeping and other legal obligations: Article 6(1)(c).
We do not use the data for marketing without your consent, and we take no automated decisions producing legal effects or similarly significant effects under Article 22 of the GDPR.
4.Contact form and meeting booking#
When you send the contact form, it goes to our own server, which forwards the enquiry to HubSpot. There it becomes a contact in our CRM, which our team works from. No HubSpot JavaScript is loaded on the page, and the form sets no cookie.
We use the data to answer your particular enquiry and to follow up if a dialogue comes of it. You are not signed up to a newsletter, and we do not send you marketing on the basis of the form.
The booking calendar is not embedded on capacit.com. If you follow the booking link on the contact page, HubSpot's own booking page (meetings-eu1.hubspot.com) opens in a new window, and from there it is HubSpot that receives your IP address and browser details and sets its own cookies. If you pick a time, the booking itself is processed by HubSpot on our behalf.
5.White papers and newsletter#
When you download a white paper, the form goes to our own server, which forwards the data to HubSpot. There it becomes a contact in our CRM. As with the contact form, no HubSpot JavaScript is loaded on the page and the form sets no cookie.
Once the form is sent, you get a link to the document. The link works for 24 hours. The file itself is not publicly available and can only be downloaded through the link.
The newsletter is a separate choice. The box is not ticked in advance, and you get the document whether or not you tick it. If you tick it, we record your consent in HubSpot. Every newsletter contains a link where you can unsubscribe.
7.Recipients and processors#
We do not sell personal data and do not hand it to third parties for their own purposes. The suppliers who process personal data on our behalf when you use capacit.com are:
| Processor | Purpose | Location |
|---|---|---|
| HubSpot | Contact form, white papers, newsletter, meeting booking and CRM | EU data region (eu1) |
| Vercel | Hosting and delivery of capacit.com, including operational logs | EU (Stockholm) and global CDN |
A data processing agreement under Article 28 of the GDPR is in place with each of them, and they may process the data only on our instructions.
Beyond that, data may be shared with our auditor and other professional advisers under a duty of confidentiality, and with public authorities where the law requires it.
8.Transfers to third countries#
capacit.com is hosted in the EU, and the HubSpot portal sits in HubSpot's EU data region. The processing therefore takes place within the EU/EEA as a matter of course.
Our suppliers belong to groups with companies outside the EU/EEA, and support and operations may be carried out from there. Where personal data is transferred to a third country, it happens on a valid transfer basis - the European Commission's standard contractual clauses with the necessary supplementary measures, an adequacy decision, or an equivalent basis.
If you would like to see the safeguards for a particular transfer, ask for them at info@capacit.com.
9.Retention and deletion#
We keep personal data only for as long as there is a purpose for it, and delete it afterwards.
Enquiries through the contact form, and the correspondence about them, are kept for up to two years after the last contact if no client relationship comes of them. If you ask us to delete the enquiry, we do, unless we have an independent basis for keeping it.
Data from white paper downloads is kept for up to two years after the latest download, unless it leads to a dialogue or a customer relationship.
If you subscribe to the newsletter, we keep your email address and your consent for as long as you are subscribed. If you unsubscribe, sending stops immediately. We keep the record of your consent and unsubscription for up to two years after you unsubscribe, so that we can document that we have complied with the rules.
If a client relationship does come of it, contract and relationship records are kept for as long as the collaboration runs, and then for up to three years, so that we can establish, exercise or defend a legal claim.
Invoicing and accounting records are kept for five years from the end of the financial year they relate to, as the Danish Bookkeeping Act requires.
Operational logs held by our hosting provider are kept briefly and in any event for no more than 90 days.
10.Security#
All traffic to and from capacit.com is encrypted with HTTPS/TLS.
The contact form is sent to our own server and forwarded to HubSpot from there. The HubSpot access token lives on the server alone and is never handed to your browser.
The white paper form works the same way. The download link is signed and expires after 24 hours. After that it can no longer be used to fetch the document.
Access to the systems holding enquiries and client data is limited to the employees who need it for their work.
No system is completely secure. If we become aware of a personal data breach, we handle it under Articles 33 and 34 of the GDPR - including notifying the Danish Data Protection Agency and the people affected, where the rules require it.
11.Your rights#
You have the right to access the personal data we process about you, and to have inaccurate data corrected.
Under certain conditions you have the right to have data erased, to have the processing restricted, to object to processing that rests on our legitimate interests, and to data portability.
If you have given consent to a processing activity, you may withdraw it at any time. That does not affect the lawfulness of processing carried out before the withdrawal.
You exercise these rights by writing to info@capacit.com. We reply without undue delay and in any event within one month. If the request is complex, the deadline may be extended by up to two months, in which case we tell you within the first month.
We may need to verify your identity before disclosing data. Exercising your rights is free of charge.
12.Complaints to the Danish DPA#
If you are unhappy with how we process your personal data, we would like to hear from you first - that usually resolves it quickly.
You may always lodge a complaint with the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, datatilsynet.dk. If you live or work in another EU country, you may also complain to the supervisory authority there.
13.Changes to this policy#
We update this policy when our processing of personal data changes, or when legislation requires it.
The version in force is always published on this page, with the date it was last updated at the top. If we change something material that affects you directly, we say so where we are able to.
14.Contact#
Questions about this policy, or about how we process your personal data, can be sent to info@capacit.com or raised on +45 32 26 90 01.
Capacit A/S, Overgaden Neden Vandet 9A, 1414 Copenhagen K, Denmark. CVR 42607797.
Both documents