Privacy policy

Who is the data controller?

The data controller is Oxholm Agency, a Danish sole proprietorship (enkeltmandsvirksomhed), CVR 44915847 (Danish business register), Rådmandsløkken 5, 1. tv, 6400 Sønderborg. The business is run by Michael Oxholm Johansen.

Send questions about your information to hej@oxholm-agency.dk or call me on +45 93 60 64 39. It is me you will reach. I run the business on my own.

When you visit the website

The website is built without cookies, without analytics and marketing tools and without third-party scripts. Nothing is stored in your browser. Read more in the cookie policy.

When a page is loaded, Vercel Inc., which hosts the website, processes technical information, including your IP address, for operational and security reasons. This is necessary to deliver the page to you, and it happens for every website you open.

The site has links to my profiles on LinkedIn, Instagram and Facebook. The links do not load anything from the platforms until you click. If you click, you leave the website, and the platform's own privacy policy applies.

When you write or call me

If you contact me by email or phone, I receive what you tell me yourself: typically your name, your company, your contact details and the content of your message. Emails arrive in the mailbox hej@oxholm-agency.dk, which is hosted by Google (Google Workspace).

I use it to reply to you, to talk to you about a website for your company and, if you say yes, to build and run the site. I do not use it for anything else. I do not send newsletters, and I do not pass it on to others who want to sell you something.

The forms on the website

The website has two kinds of forms. The contact form has fields for company name, your name, phone number, email address, the address of your current website (if you enter it), what you would like help with, and your message. Each of the pages Contact and Changes has a form, and the fields are the same in Danish, Norwegian and English. The form for changes to an existing website has fields for company name, the website's address, your name, email or phone and a description of the change, and here you can also choose files.

What you write in a form is checked in your browser and is only sent when you press send. It is then sent as an email to me: the email is sent by the email service Resend and arrives in the mailbox hej@oxholm-agency.dk, which is hosted by Google (Google Workspace). The email contains what you filled in, which page and which language the form was on, and when it arrived. Files you choose in the form for changes are included as attachments. An enquiry from the contact form may also be forwarded to my own sales system, the call list and the onboarding system, which I run myself and which is hosted by Vercel, so that it can be followed up and does not get lost in an inbox.

Your IP address is used only to limit misuse of the forms: there is a limit on how many times a form can be sent from the same connection. The address is held only briefly in the server's memory and is written neither in the email nor in the sales system.

What I use the information for, and on what basis

• Replying to your enquiry and building a draft is done under Article 6(1)(b) of the General Data Protection Regulation: steps taken at your request before an agreement is entered into. If an agreement is made, the basis is performance of it.
• Contacting businesses that I approach myself (see the next section) rests on my legitimate interest in marketing my service to businesses, Article 6(1)(f).
• The IP address and the limit on the number of submissions rest on my legitimate interest in keeping robots out of the forms, Article 6(1)(f).

When I contact you first

I call businesses myself. For that I use publicly available information from the Central Business Register (Det Centrale Virksomhedsregister, CVR, the Danish business register) and from the business's own website: company name, CVR number, address, phone number, email address, industry and any website. If the business is a sole proprietorship, the information can at the same time be personal data about the owner. That is why it is stated here.

I respect the advertising protection in CVR and do not call businesses that have it.

If you do not want to be contacted, just say so, on the phone or at hej@oxholm-agency.dk. I will then delete what I have, apart from the minimum needed so that I do not call you again by mistake.

Who I share information with

I do not sell your information, and I do not pass it on to third parties for marketing purposes. These are the suppliers I use to run the business and handle enquiries:

Google, Vercel and Resend process the information on my behalf and may not use it for their own purposes.

Transfers outside the EU/EEA

Several of the suppliers above have a US parent company, so the information may be processed in the USA. The transfer takes place on the basis of the European Commission's standard contractual clauses and, where the supplier is certified, the EU-US Data Privacy Framework.

How long I keep information

• If no agreement is made: I keep the enquiry for up to 12 months and then delete it. If you ask me to delete it sooner, I do.
• If an agreement is made: I keep what belongs to the customer relationship for as long as it lasts, and for up to 12 months after it has ended.
• Invoices and other accounting records are kept for 5 years from the end of the financial year they belong to. This follows from the Danish Bookkeeping Act (bogføringsloven), and they therefore cannot be deleted sooner.

Security

Only I read and process the enquiries.

Your rights

Under the General Data Protection Regulation you have the right to:

• access the information I process about you
• have incorrect information corrected
• have information deleted
• have the processing restricted
• object to the processing
• receive your information in a commonly used format
• withdraw consent

Write to hej@oxholm-agency.dk if you want to use any of these rights. You will get a reply as soon as possible and no later than within one month.

Complaints

If you are not satisfied with how I process your information, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

Changes to this policy

I change this policy when something in it changes. The date at the top of the page shows when it was last changed.