Last updated: [DATE]
Privacy Policy
This policy explains how Alkymist handles personal data in connection with this website. It covers the marketing site only. Processing in the Alkymist platform, and processing that happens when someone scans a tag on a physical product, are covered separately — see section 10.
In case of any discrepancy, the Danish version of this policy prevails.
1.Data controller
Anna Anchers Vej 267
DK-9200 Aalborg SV
Denmark
Company reg. no. (CVR): [CVR NUMBER]
Email: [CONTACT EMAIL]
We are the controller for the processing described here. We are not required to appoint a Data Protection Officer and have not done so. Please direct data protection enquiries to the email address above.
2.What we process
Information you give us. When you submit a form on the site or write to us, we process what you provide — typically name, email address, company name, sometimes a phone number, and the content of your message. We also record the time of submission.
Information collected automatically. When you visit the site, our hosting provider processes technical information in server logs: IP address, timestamp, requested URL, HTTP status code, browser and device type, and referring page.
Abuse prevention. To stop automated abuse of our forms, we store a value derived from your IP address together with the time of submission. It is used solely to limit how many submissions can come from the same source.
We do not process special categories of personal data (sensitive data) through this site, and we ask that you not send such data to us through the forms.
3.Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to your enquiry and discussing possible work together | Contact details and message content | GDPR Art. 6(1)(b) — steps taken at your request prior to entering into a contract; alternatively Art. 6(1)(f), our legitimate interest in responding |
| Operating and securing the site, including troubleshooting | Server logs | Art. 6(1)(f) — our legitimate interest in a reliable, secure site |
| Preventing spam and automated abuse | Derived IP value and timestamp | Art. 6(1)(f) — our legitimate interest in protecting our systems |
| [Newsletter / marketing email, if applicable] | Email address | Consent — Art. 6(1)(a) and section 10 of the Danish Marketing Practices Act |
Where we rely on legitimate interests, we have assessed the processing as necessary and not overridden by your rights. You can object — see section 8.
4.Recipients and processors
We do not sell personal data and do not share it with third parties for their own purposes. We use the following suppliers as data processors. Each processes data on our instructions under a data processing agreement:
- Vercel Inc. — hosting and delivery of the site, including server logs.
- Supabase Inc. — the database in which form submissions are stored.
- [EMAIL PROVIDER] — sending and receiving email.
We may also disclose data where we are legally required to do so.
5.International transfers
Our databases and hosting regions are located within the EU/EEA. Some of our suppliers are established outside the EU/EEA or have group companies there, and personal data may be transferred to third countries — including the United States — particularly in connection with support and operations.
Such transfers take place on the basis of the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Write to us at the address in section 1 for details of the mechanism applying to a specific supplier.
6.Retention
Enquiries and form submissions: kept while the conversation is active and then for up to [24] months after our last contact, after which they are deleted. If the enquiry leads to a customer relationship, retention follows the rules for that relationship — including the Danish Bookkeeping Act's requirement to retain records for five years from the end of the financial year concerned.
Server logs: kept for our hosting provider's standard period — typically up to [30] days.
Abuse prevention data: deleted automatically shortly after submission.
8.Your rights
Under the GDPR you have the right to:
- Access — to know what data we hold about you and receive a copy.
- Rectification — to have inaccurate data corrected.
- Erasure — to have data deleted where the conditions are met.
- Restriction — to have processing restricted in certain circumstances.
- Data portability — to receive data you provided in a machine-readable format and have it transmitted to another controller.
- Object — to object to processing based on legitimate interests, and to processing for direct marketing.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before.
Write to [CONTACT EMAIL] to exercise any of these. We respond within one month. We may ask for information to confirm your identity before disclosing data.
9.Complaints
You may complain about our processing of your personal data to the Danish Data Protection Agency:
DatatilsynetCarl Jacobsens Vej 352500 Valby, DenmarkPhone: +45 33 19 32 00Email: dt@datatilsynet.dkwww.datatilsynet.dkWe would appreciate the chance to resolve the matter first, so please consider contacting us before you do.
10.The Alkymist platform and scannable product tags
This policy covers the marketing site. Two related activities are documented elsewhere:
- The Alkymist platform (accounts, organisations, products and batches) — see [platform privacy policy / DPA: LINK].
- Scanning a physical product tag. When an end customer scans a tag, a scan event is recorded. For that processing Alkymist acts as a processor on behalf of the producer who issued the tag, and that producer is the controller. Questions about it should go to the producer, who is identified on the page the tag resolves to.
11.Changes
We may update this policy, for example if we change the tools we use or how we process data. The current version is always on this page with the date it was last updated. Where a change materially affects you, we will notify you separately if practicable.