Privacy policy

Acurcio (ACurcio Webservices), CVR 46182162, Jægersborggade 44, 1. th, 2200 København N, Denmark, is the data controller for the personal data described in this policy. You can reach us at adriana@acurcio.dk or +45 91 65 00 82.

This policy covers acurcio.dk and your contact with us. For websites we build and host for our customers, the customer is the data controller and its own privacy policy applies; we process that data only on the customer’s behalf, under our data processing agreement.

When you use our contact form, we receive your name, email address, company (if you fill it in) and your message. When you email or call us, we receive the information you give us.

We use the information to answer you and, if relevant, to prepare a quote. The legal basis is our legitimate interest in answering enquiries (Article 6(1)(f) GDPR) and, where your enquiry is about entering into an agreement, taking steps at your request before an agreement (Article 6(1)(b)).

Messages from the contact form are delivered to our inbox by the email service Resend. They are not stored in a database on the website.

Enquiries that do not lead to an agreement are deleted no later than 12 months after our last contact.

Please do not send us sensitive personal data, such as health information, through the contact form.

For customers, we process the names and contact details of contact persons, the agreement, invoices, payments and our correspondence.

The legal basis is the performance of our agreement (Article 6(1)(b) GDPR), our legal obligations under the Danish Bookkeeping Act (bogføringsloven) (Article 6(1)(c)), and, for contact persons at business customers, our legitimate interest in running the customer relationship (Article 6(1)(f)).

Accounting records are kept for five years from the end of the financial year they relate to, as the Bookkeeping Act requires. Other customer data is kept for as long as the customer relationship lasts, including any hosting, and for up to three years afterwards so that we can document the agreement.

Server logs. Our hosting provider, Vercel, logs technical information about each request — such as IP address, time, the page requested and browser information — to run the website and protect it against misuse. The logs are kept only for a short period.

Visitor statistics. We count visits ourselves to see how the website is used and which campaigns bring visitors. For each page you view we count the page, and for the first page of a visit also the website you came from, campaign parameters in the link you followed (UTM parameters), your country (worked out from your IP address) and whether you use a phone, tablet or computer. Only totals per day are stored.

The statistics use no cookies and store nothing on your device. To count unique visitors, we combine your IP address and browser information with a random value that changes every day and is deleted shortly after, and turn it into a one-way code that is never stored on its own. We therefore cannot identify you or follow you from one day to the next or across websites. The daily totals are kept for up to 13 months.

Performance. We use Vercel Speed Insights to measure how quickly pages load, together with the page, browser and device type, so we can keep the website fast. It also uses no cookies.

The legal basis for server logs, statistics and performance measurement is our legitimate interest in running a secure website, understanding how it is used and measuring our marketing (Article 6(1)(f) GDPR). You can object at any time, see section 6, and you can also block the statistics with a content blocker in your browser.

Language. Your browser remembers which language you read the website in, using its local storage. This stays on your device, is not sent to us, and can be deleted in your browser settings.

We do not use advertising cookies, social media pixels or third-party fonts, and we do not sell personal data.

Our website links to our profiles on Instagram and LinkedIn. If you follow those links, the privacy policy of that service applies.

We share personal data only with providers that process it on our behalf and under a data processing agreement:

• Vercel Inc. (USA) — hosting, server logs, performance measurement, and running the code that counts visits;
• Upstash, Inc. (USA) — storage of the daily visitor totals, in a database located in the EU (Frankfurt);
• Resend (USA) — delivery of messages from the contact form;
• our email provider, accounting system and accountant — for correspondence and bookkeeping.

Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses.

We also disclose personal data to public authorities where the law requires it.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have data erased;
• have the processing restricted;
• receive your data in a portable format (data portability);
• object to processing based on our legitimate interest, including the visitor statistics.

To use your rights, write to adriana@acurcio.dk. We answer within one month.

We do not use automated decision-making or profiling.

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

We update this policy when the way we process personal data changes. The date at the top shows when it was last updated.