Privacy policy

Data controller

The data controller is Oxholm Agency, company registration number (CVR) 44915847, Rådmandsløkken 5, 1. tv, 6400 Sønderborg, Denmark. Questions about your data go to hej@oxholm-agency.dk — there is nobody else.

When you fill in the contact form

I receive what you write yourself:

• Company name
• Your name
• Phone number
• Email address, if you enter one
• Your line of work, if you enter it
• The address of your current website, if you enter it
• The message you write

Plus three things you do not type yourself:

• That you ticked the consent box, and the exact wording you agreed to. It is stored as documentation of the consent.
• Which page you sent the form from, when you sent it, which domain you may have come from, and any campaign parameters in the address (utm_source and similar). It is read at the moment you submit — nothing is stored in your browser along the way. See the cookie page.
• Your IP address. It is used to limit abuse of the form, and it appears in the email the enquiry triggers.

What it is used for, and on what basis

The data is used to contact you about a website for your business, to build a draft and — if you say yes — to deliver and run the site. It is not used for anything else. There are no newsletters, and it is not passed on to anyone who wants to sell you something.

Three things rest on separate legal bases:

• Answering your enquiry and building a draft is done under Article 6(1)(b) of the GDPR — steps taken at your request prior to entering into a contract. If a contract is entered into, the basis is the performance of it.
• The tick box is your consent to being contacted by phone and email about the offer, under section 10 of the Danish Marketing Practices Act. You can withdraw it at any time by writing to hej@oxholm-agency.dk. That does not affect the lawfulness of what has happened until then.
• The IP address and the spam filter rest on the legitimate interest in keeping robots out of the form, Article 6(1)(f).

The reason they are listed separately: if you withdraw the consent, I stop contacting you — but that does not in itself end a contract already made, or an invoice already issued.

When I contact you first

I call businesses myself. For that I use publicly available information from the Danish Central Business Register (CVR) and from the company’s own website: company name, registration number, address, phone number, email address, line of work and any website. For a sole proprietorship, that information can at the same time be personal data about the owner — which is why it is stated here.

The basis is the legitimate interest in marketing the service to businesses, Article 6(1)(f). I respect advertising protection in the CVR register and do not call businesses that have it.

If you do not want to be contacted, just say so — on the phone or at hej@oxholm-agency.dk — and I delete what I have, apart from the minimum needed to make sure I do not call you again by mistake.

Visitor statistics with Vercel Web Analytics

I use Vercel Web Analytics to get general statistics about how the website is used, for example which pages are visited and where the traffic comes from. The tool does not use cookies and does not store information in your browser to follow you across websites.

As part of providing the service, Vercel may process technical information, including your IP address and a rough geographic location derived from it. The statistics are used to understand and improve the website.

Who the data is shared with

Your data is not sold, and it is not passed to third parties for marketing. These suppliers are used to run the site and handle enquiries:

• Vercel Inc. — hosting of the website and visitor statistics (Vercel Web Analytics, see the section above). Processes technical information, including IP address and a rough geographic location derived from it, when the page is loaded and when the form is sent.
• Google Ireland Ltd. / Google LLC (Google Workspace) — email. The enquiry arrives and stays in the mailbox hej@oxholm-agency.dk.
• Resend — sends the emails the form triggers: the message to me and the receipt to you.
• My own sales system — the call list and onboarding system, which I run myself and which is hosted at Vercel. The enquiry is sent there so it can be followed up and not get lost in an inbox.

All four process the data on my behalf and may not use it for their own purposes.

Transfer outside the EU/EEA

Vercel, Resend and Google all have American parent companies, and the data may therefore be processed in the USA. The transfer takes place on the basis of the European Commission’s standard contractual clauses and — where the supplier is certified — the EU-US Data Privacy Framework. My own sales system is hosted at Vercel and is covered by the same.

How long it is kept

• If no agreement is made: the enquiry is kept for up to 12 months and then deleted. If you ask me to delete it sooner, I do.
• If an agreement is made: what belongs to the customer relationship is kept for as long as it runs, and for up to 12 months after it ends.
• Invoices and other accounting material are kept for 5 years from the end of the financial year they belong to. That follows from the Danish Bookkeeping Act, so they cannot be deleted sooner.

Security

The website runs over an encrypted connection (HTTPS). Enquiries sit in the mailbox and in the sales system at the suppliers listed above, and access is protected with a password and two-factor authentication. Michael Oxholm Johansen is the only person with access. The form also has a spam filter and a limit on how many times it can be sent from the same connection.

Your rights

Under the GDPR you have the right to:

• access the data processed about you
• have incorrect data corrected
• have data deleted
• have the processing restricted
• object to the processing
• receive your data in a machine-readable format (data portability)

Write to hej@oxholm-agency.dk to use one of these rights. You get an answer as soon as possible and no later than within one month.

Complaints

If you are unhappy with how your data is handled, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.

Language

This is an English translation of the Danish privatlivspolitik. In the event of any discrepancy between the two versions, the Danish version prevails. The translation is provided so that you can read in English how your data is handled; it does not create a separate policy.