01
Who we are
/dataansvarlig/
Alpha Data Consult decides why and how the personal data described on this page is used, which makes us the data controller for it. We are established in Denmark and work under the GDPR and the Danish Data Protection Act. Our supervisory authority is Datatilsynet.
CVR 44987317
Teglgården 49B
3460 Birkerød
Denmark
Privacy contact
privacy@alphadataconsult.dk
When we work inside a client’s own systems we act on their instructions under a written data processing agreement. The client stays the controller of that data, and their policy applies to it rather than this one.
02
What we process
/hvilke oplysninger/
Most of what we hold you gave us yourself. The rest is produced by the website, or comes from a client who asked us to work with their people.
- Identity and contact dataName, employer, job title, email address, telephone number, and, if you choose to tell us, whether your organisation is based in Denmark, elsewhere in the EU or EEA, or outside both. We use this to see whether an enquiry falls within our Danish and EU service scope. From you or from a colleague at your organisation.
- CommunicationsThe content of your enquiry, emails, meeting notes, and anything you send us during a project.
- Contract and billing dataSigned agreements, billing contact, invoice lines, and payment records. We invoice for our work; this site does not take card payments.
- Website usageIP address, request time, and browser type, recorded in server logs by our hosting provider.
- Subscription dataYour email address, the consent notice and tick box wording you accepted, the form you signed up on, and the times you signed up and confirmed.
- Client operational dataPersonal data inside the material a client gives us access to during an engagement.
03
Purposes and lawful basis
/formål og behandlingsgrundlag/
Every use of personal data needs a lawful basis. Where the basis is a legitimate interest, we name the interest so you can weigh it and object if it does not hold up for you.
| Activity | Lawful basis | Article |
|---|---|---|
| Answering enquiries | Steps taken at your request before a contract, or our legitimate interest in replying to people who contact us | 6(1)(b), 6(1)(f) |
| Delivering contracted services | Performance of a contract, with a processing agreement where we act for a client | 6(1)(b), 28 |
| Bookkeeping and tax | Compliance with a legal obligation under Danish law | 6(1)(c) |
| Newsletter and publication updates (book and Alpha-BAR reports) | Your consent | 6(1)(a) |
| Keeping proof of consent | Legal obligation, Article 6(1)(c), read with Article 7(1) | 6(1)(c) |
| Site security and server logs | Our legitimate interest in availability and in protecting the site against misuse | 6(1)(f) |
Each list is used only for its stated purpose: signing up for book publication updates or report notifications does not add you to the newsletter, or the other way round.
We do not sell personal data, and we do not share it for advertising.
04
Recipients, processors, and partners
/modtagere og databehandlere/
Every supplier that handles personal data for us does so under a written agreement, and may use it only for the service it provides to us.
- HostingRuns the website and keeps server logs.
- Email and collaborationCorrespondence, documents, and project material.
- Email deliveryOur hosting provider relays the subscription emails we send. We record consent in our own database, not in a third-party tool.
- Accounting and paymentsBookkeeping, statutory accounts, and payment records.
- AI and cloud providersRun the models behind the services in section 05, where an engagement uses them.
- RibeSoft ApSA trusted partner that may deliver parts of our services, and through which some sales are supported. The role each company holds depends on the engagement, and the contract for that engagement settles it. We will confirm which arrangement applies to you on request.
Disclosure required by law: we also disclose personal data where the law requires it, or where we need to establish or defend a legal claim. The current list of processors is available on request.
International transfers: we prefer to keep processing inside the EU and the EEA and choose European regions where a service offers them. Where a transfer outside the EEA takes place, we rely on an adequacy decision covering the receiving country, or on the European Commission’s standard contractual clauses together with an assessment of that specific transfer. Details of the safeguard covering a given service are available on request.
05
Data and AI services
/data- og AI-tjenester/
Our Data and AI Agent services may run on Azure AI Foundry, on Anthropic or OpenAI models, or on a runtime inside the client’s own environment, depending on the solution agreed with the client.
- RolesThe client decides what data enters the solution and stays its controller. We act on the client’s instructions, and any model provider involved is engaged as a sub-processor with the client’s authorisation.
- Where inference runsInside the client’s environment for an on-premises runtime, otherwise in the provider region agreed for that solution. The transfer safeguards in section 04 apply if the region sits outside the EEA.
- Provider termsRetention of content sent to a model, and whether it may be used for training, follow the provider’s terms and the agreement for the engagement. We state the position for each solution in its engagement documentation rather than as a blanket claim here.
- Data minimisationWe send a model only the data the task needs, and agent runs are logged so a result can be traced back to its inputs.
- Human approvalA named person reviews agent output before it is used. Model output can be wrong in ways that are not obvious, and the judgement a client pays for sits with the reviewer, not the model.
Security sits alongside this. Access is limited to the people who need it, business systems require multi-factor authentication, data is encrypted in transit and at rest in the services we use, and client material is kept separate. We describe our controls at this level on purpose, and clients can see the detail under an appropriate agreement.
06
Retention
/opbevaring/
We keep personal data for as long as the purpose needs, then delete it. Where the law sets the period, we follow the law.
- Enquiry recordsDeleted 24 months after the last contact if the enquiry does not become work.
- Client and contract recordsKept for the engagement and for as long afterwards as a claim under it remains possible.
- Bookkeeping recordsKept for the period Danish bookkeeping law sets, counted from the end of the financial year the record belongs to.
- Agent and technical logsKept for security, troubleshooting, and traceability, then overwritten on a rolling cycle.
- Email subscriptionsUntil you unsubscribe. After that we keep the record of your consent and its withdrawal for 24 months, so we can show that consent was given and honoured. We then remove the details that identify you. The remaining history is anonymous and no longer relates to you.
07
Cookies
/cookies/
This site does not set cookies for visitors. We use no analytics, advertising, or tracking cookies, so there is no consent banner and no cookie policy to read. If that changes, we will publish a cookie policy, ask for consent where the law requires it, and update this policy before doing so.
08
Your rights
/dine rettigheder/
Under the GDPR you have the following rights. To use any of them, write to privacy@alphadataconsult.dk. We answer within one month and charge nothing, unless a request is clearly excessive, in which case we would tell you first. If a request is complex, we will tell you within that month and may take up to two further months.
- Access: request a copy of the personal data we hold about you.
- Rectification: have inaccurate or incomplete information corrected.
- Erasure: have your data deleted where we no longer need it and no legal duty applies.
- Restriction: limit how we use your data while a question is being resolved.
- Portability: receive the data you provided in a machine-readable format.
- Objection: object to processing based on our legitimate interests. For marketing we stop without exception.
- Withdrawal of consent: withdraw consent at any time, with effect for future processing.
Where we hold the data as a processor for a client, we pass your request to that client and help them answer it.
Complaints: if you have a concern about how we handle your data, contact us first so we can look at it with you and find a solution. You can also complain to the Danish Data Protection Agency.
09
Changes
/ændringer/
We update this policy when a change to our services, suppliers, or systems affects personal data, and the version and effective date at the top of this page always show the current state. If a change materially affects how we use your data, we tell affected clients and subscribers directly. Updating this page does not extend any consent you have given. If we want to use your data for something new that needs consent, we ask first.