1. Data controller
Trappnarco ApS
Vesterbrogade 108
1620 København V
Denmark
CVR: 38472915
Email: [email protected]
Phone: +45 33 21 48 67
We have not appointed a Data Protection Officer (DPO) as we do not meet the statutory threshold requiring one under Article 37 GDPR. Privacy enquiries may be directed to the contact details above.
2. Categories of personal data we process
2.1 Website visitors
- Technical data: IP address, browser type, operating system, referring URL, pages visited, date and time of access
- Cookie data: consent status stored in localStorage (key: trappnarco_life_consent)
- Analytics data: anonymised usage statistics if you accept cookies
2.2 Contact and enquiry data
- Identity data: name, email address, phone number
- Project data: project type, property address, project description, budget range, architectural drawings (if submitted)
- Communication records: email correspondence, consultation notes
2.3 Client and contractual data
- Billing data: name, address, CVR/CPC number (for business clients), invoice history, payment records
- Project deliverables: site photographs, floor plans, correspondence with third parties (architects, electricians)
3. Purposes and legal bases for processing
We process personal data only where a legal basis under Article 6 GDPR applies:
- Contract performance (Art. 6(1)(b)): Processing enquiry and client data to provide lighting design services, issue quotes, deliver projects, and manage billing.
- Legitimate interests (Art. 6(1)(f)): Website security, fraud prevention, internal record-keeping, and anonymised analytics to improve our website. Our legitimate interests do not override your fundamental rights.
- Legal obligation (Art. 6(1)(c)): Retention of accounting records under the Danish Bookkeeping Act (Bogføringsloven) and tax legislation.
- Consent (Art. 6(1)(a)): Non-essential cookies and analytics. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
4. Recipients of personal data
We do not sell personal data. We may share data with:
- IT service providers: Email hosting, cloud storage, and backup providers (EU/EEA-based or with Standard Contractual Clauses)
- Professional advisers: Accountants and legal counsel bound by confidentiality
- Project collaborators: Architects, electricians, and suppliers where necessary for project delivery and with your knowledge
- Public authorities: When required by Danish law (e.g. SKAT, Datatilsynet)
All processors act on our instructions under data processing agreements compliant with Article 28 GDPR.
5. International transfers
We primarily store and process data within the EU/EEA. If data is transferred to countries outside the EEA, we ensure appropriate safeguards under Chapter V GDPR, including Standard Contractual Clauses approved by the European Commission or adequacy decisions.
6. Retention periods
- Enquiry data (no engagement): Deleted after 24 months
- Client project data: Retained for 5 years after project completion (limitation period under Danish law)
- Accounting records: Retained for 5 years after the end of the financial year (Bogføringsloven § 10)
- Website logs: Retained for 90 days
- Cookie consent records: Retained for 12 months, then re-prompted
7. Your rights under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): Request a copy of personal data we hold about you
- Right to rectification (Art. 16): Request correction of inaccurate data
- Right to erasure (Art. 17): Request deletion where no legal basis for retention exists
- Right to restriction (Art. 18): Request limited processing in defined circumstances
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interests
- Right to withdraw consent (Art. 7(3)): Withdraw cookie consent by clearing localStorage or contacting us
To exercise your rights, email [email protected]. We respond within 30 days. We may request identity verification before processing your request.
8. Right to lodge a complaint
If you believe we have processed your data unlawfully, you may lodge a complaint with:
Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby
Denmark
Website: www.datatilsynet.dk
Phone: +45 33 19 32 00
Email: [email protected]
9. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Article 22 GDPR.
10. Security measures
We implement appropriate technical and organisational measures under Article 32 GDPR, including encrypted email transmission (TLS), access controls on cloud storage, password-protected workstations, and staff confidentiality obligations. No system is completely secure; we notify Datatilsynet and affected individuals of personal data breaches within statutory timeframes where required.
11. Children's data
Our services and website are not directed at individuals under 18. We do not knowingly collect data from children. Contact us if you believe we have inadvertently collected such data.
12. Changes to this policy
We may update this Privacy Policy to reflect legal or operational changes. Material changes will be indicated by updating the date above. Continued use of our website after changes constitutes acceptance of the updated policy for website-related processing.
13. Contact
For privacy-related questions or to exercise your rights:
Trappnarco ApS · [email protected] · +45 33 21 48 67 · Vesterbrogade 108, 1620 København V, Denmark