Doc. L-002 · LegalDRAFT — NOT YET REVIEWED BY A SOLICITOR
Privacy Policy
WHAT CHANGED IN THIS VERSION
- First published version for the United Kingdom (v1.0). Every material change to how we handle personal data will appear in this box.
EVERY CLAUSE HAS A PLAIN-ENGLISH NOTE — HOVER OR FOCUS TO READ IT →
1 Who we are
1.1Clausebook ApS (Danish company number (CVR): to be confirmed before launch), postal address to be confirmed before launch, Copenhagen, Denmark, is the controller of the personal data processed through clausebook.co. Contact: privacy@clausebook.dk.
What this meansThe controller is who is responsible — and who you write to when you use your rights.
1.2Because we offer our service to people in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to what we do with your data. Because we are established in Denmark, the EU General Data Protection Regulation applies as well. Our representative in the United Kingdom under Article 27 of the UK GDPR: to be confirmed before launch.
What this meansTwo sets of rules, the same rights for you. A company outside the UK must name a representative here; ours is not appointed yet, and we say so rather than invent one.
2 What we collect, and why
2.1Document data: the names and details you type into a guided set-up. We use them to generate your document. Legal basis: the contract (UK GDPR, Art. 6(1)(b)). We never ask for a National Insurance number, a passport or driving licence number, or bank details: where a document needs one, it prints a line to fill in by hand.
What this meansYou type it, we put it in your document. It exists for no other reason — and the most sensitive numbers never reach us.
2.2Order data: your email address, what you bought and when, the request you made by pressing the button at checkout (in the words under it), and your receipts. If you type your email in the checkout and leave before paying, we keep that email and the name of the document you were drafting (§ 3.2). Legal basis: the contract, and our legitimate interests in keeping the accounting records the Danish Bookkeeping Act requires of us and in seeing which checkouts are left unfinished (Art. 6(1)(b) and (f)).
What this meansDanish bookkeeping law makes us keep order records — that part is not optional for us.
2.3Technical data: your IP address and browser details are processed in server logs and to protect our forms against abuse, and a message sent through the contact form is stored with the sender’s IP address. Our pages load their typefaces from Google Fonts, so your browser also sends your IP address to Google when it fetches them. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f)). We use no analytics or tracking service.
What this meansNo statistics service, no trackers. Only what a server needs to answer and to stop abuse — and the fonts, for now.
2.4We do not sell personal data. We do not use the contents of your documents for marketing, profiling or training of any kind, and we send no marketing emails.
What this meansYour power of attorney is nobody’s training data. Full stop.
3 How long we keep it
3.1Orders and the documents bought with them: five years from the end of the financial year of the order, because the Danish Bookkeeping Act (§ 12) requires us, as a Danish company, to keep our accounting records that long. There is no account to delete: your order link stays valid for the same period, and you can ask us to remove the document itself sooner.
What this meansFive years is the law that binds us, not our preference.
3.2An email typed into the checkout without a purchase is deleted after 30 days; if you complete the purchase, it is removed from that list straight away.
What this meansWe send nothing to it in the meantime.
4 Who we share it with
4.1We share personal data only with the processors we need to run the Service, under data processing agreements.
What this meansProcessors act on our instructions — they cannot use your data for themselves.
4.2Current processors: payments (Stripe), transactional email (Resend), hosting (Vercel) and database (Supabase, EU region). Your browser also fetches our typefaces from Google Fonts (§ 2.3). An up-to-date list is available on request.
What this meansNamed, not “trusted partners”. If the list changes, this clause changes.
5 Your rights
5.1You can ask for a copy of your personal data, and have it corrected, erased, restricted or sent to you in a portable form, or object to our use of it, by writing to privacy@clausebook.dk. We answer within one month, free of charge.
What this meansYour UK GDPR rights, without having to cite the UK GDPR to use them.
5.2If you think we have handled your data wrongly, you can complain to us at privacy@clausebook.dk or through the contact form: we acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission (ico.org.uk) and, because we are a Danish company, to Datatilsynet, the Danish Data Protection Agency.
What this meansCome to us first if you like — the law now makes us answer properly. The regulators’ doors stay open either way.
6 International transfers
6.1Your data is stored in the European Union; under the Data Protection Act 2018 (Sch. 21) a transfer to a country of the European Economic Area is treated as approved under Article 45A of the UK GDPR. Where a processor transfers personal data to another country, we rely on transfers approved under Article 45A or on the safeguards of Article 46, such as standard data protection clauses, and you can ask us for a copy of them.
What this meansThe legal plumbing that makes it lawful to use tools with links to the United States, for example.
QUESTIONS? HELP@CLAUSEBOOK.DK — A HUMAN ANSWERS WITHIN ONE WORKING DAY.
DATA RIGHTS: PRIVACY@CLAUSEBOOK.DK · EARLIER VERSIONS AVAILABLE ON REQUEST.
DATA RIGHTS: PRIVACY@CLAUSEBOOK.DK · EARLIER VERSIONS AVAILABLE ON REQUEST.