Privacy Policy
This policy explains how InitHere ApS handles personal data about people who visit our website, contact us, book a call, or work with us as clients, partners or suppliers. We have written it to be short and plain. If anything is unclear, email us at contact@inithere.com.
Who is responsible for your data
InitHere ApS is the data controller for the personal data described in this policy.
- InitHere ApS, CVR 46004043
- Løvetandsvej 22, 2700 Brønshøj, Copenhagen, Denmark
- contact@inithere.com · +45 91 75 94 25
We have not appointed a data protection officer, as we are not required to. Questions about privacy go to the email address above.
What we collect, why, and for how long
We only collect what we need, and we do not sell personal data, show advertising, or use analytics or tracking tools on our website.
When you visit our website
- Data: technical data your browser sends with every request, such as your IP address, browser type, the page you asked for and the time.
- Why: to deliver the website, keep it secure and protect it against attacks.
- Legal basis: our legitimate interest in running a secure website (GDPR article 6(1)(f)).
- How long: our hosting provider, Cloudflare, keeps these logs for a short period under its own retention rules. We do not use them to identify visitors.
When you use our contact form
- Data: your name, work email, company (optional), the service you are interested in and your message.
- Why: to answer your enquiry and, if you want, prepare an offer.
- Legal basis: steps at your request before entering into an agreement (article 6(1)(b)) and our legitimate interest in answering business enquiries (article 6(1)(f)).
- How long: if no collaboration follows, we delete the enquiry no later than 12 months after our last contact.
Messages reach us through Web3Forms, a form service that delivers them to our email (see “Who we share data with” below). Please do not send sensitive personal data (such as health information or national ID numbers) through the form.
When you book a call
- Data: your name, email, the time you choose and anything you write in the booking form.
- Why: to schedule and hold the call.
- Legal basis: steps at your request before entering into an agreement (article 6(1)(b)).
- How long: 12 months after the call, unless a collaboration follows.
Bookings are handled by Calendly. The calendar only loads when you open it, and Calendly may then set its own cookies (see “Cookies and local storage” below).
When you email or call us
- Data: your name, contact details and what you tell us.
- Why: to reply and follow up.
- Legal basis: our legitimate interest in communicating with you (article 6(1)(f)), or steps before an agreement (article 6(1)(b)).
- How long: 12 months after our last contact, unless a collaboration follows.
When you are a client, or a contact person at a client, partner or supplier
- Data: names, job titles, work contact details, agreements, project communication, and invoicing and payment information.
- Why: to deliver our services, manage the agreement, invoice and keep our accounts.
- Legal basis: to perform our agreement (article 6(1)(b)), our legitimate interest in managing the business relationship with the company you work for (article 6(1)(f)), and our legal obligations under the Danish Bookkeeping Act (article 6(1)(c)).
- How long: during the collaboration and up to 5 years after it ends, so we can document what was agreed and delivered. Accounting records are kept for 5 years from the end of the financial year they relate to, as Danish law requires.
Case studies and references
If you are one of our founding clients, or otherwise agree to it, we may publish a short case study and show your company’s name and logo. We only do this with your company’s agreement, and you can ask us to remove it at any time.
Data we handle on behalf of our clients
When we audit, fix, modernize or maintain a client’s software, we may get access to personal data inside that client’s systems, such as their customers’ or users’ data. In that situation the client is the data controller and we act as their data processor. We only process that data on the client’s instructions and under a data processing agreement (databehandleraftale) that we sign with the client. This policy does not cover that data; the client’s own privacy policy does.
We work with read-only access where possible, use test data instead of real data when we can, and remove our access when the work is done.
Who we share data with
We use a small number of trusted providers to run our business. They only process personal data on our behalf and according to our instructions:
- Cloudflare hosts our website and protects it against attacks.
- Web3Forms (operated from India) delivers messages from our contact form to our inbox. It stores messages for up to three years, unless we delete them earlier, and checks them for spam with CleanTalk and Akismet, which receive the sender’s IP address and email address.
- Calendly handles call bookings.
- Google Workspace stores our emails and documents.
- Our accountant and accounting system handle invoices and bookkeeping.
- Members of our engineering team may access client and project information when they work on a client’s project. They are bound by confidentiality.
We do not share personal data with anyone else unless the law requires it, for example with public authorities.
Transfers outside the EU/EEA
Some of our providers, and some members of our engineering team, are located outside the EU/EEA, for example in the United States and India. When personal data is transferred outside the EU/EEA, we make sure the transfer is covered by a valid legal basis under GDPR chapter V, such as an EU adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses. You can ask us for more information about the safeguards used.
Cookies and local storage
Our own website does not set any cookies, and we do not use analytics, advertising or tracking.
- Theme setting: if you switch between our dark and paper theme, your browser remembers the choice in its local storage. It stays on your device, is never sent to us, and you can delete it by clearing your browser’s site data.
- Calendly: when you open the booking calendar, it is loaded from Calendly, which may set its own cookies to make booking work. If you prefer to avoid this, email us instead and we will find a time with you.
- Cloudflare: our hosting provider may use strictly necessary security measures to protect the website against attacks.
Your rights
Under GDPR you have the right to:
- get access to the personal data we hold about you
- have incorrect data corrected
- have your data deleted
- restrict how we process your data
- object to processing based on our legitimate interests
- receive your data in a portable format (data portability)
- withdraw your consent at any time, where processing is based on consent
There can be conditions or limits to these rights, for example when we must keep accounting records by law. To use your rights, email us at contact@inithere.com. We will reply within one month.
Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections, access control and limited access on a need-to-know basis.
We do not make decisions about you based solely on automated processing, including profiling.
Complaints
If you are unhappy with how we handle your personal data, please contact us first so we can try to fix it. You also have the right to complain to the Danish Data Protection Agency:
Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark · datatilsynet.dk
Changes to this policy
We update this policy when the way we handle personal data changes. The date at the top shows when it was last updated.