Human Risks Privacy Policy

Introduction

Effective Date: 2023.10.06

Contact Person: Mads Pærregaard mp@humanrisks.com

Classification: Internal Use Only

Last Review: 2026.06.08

Approved By: Mads Pærregaard mp@humanrisks.com

Description: The External Privacy Policy of Human Risks Aps

Version: 1.3

This Privacy Policy (the "Policy") describes how Human Risks ApS ("us", "we" or "our"), acting in the role of data controller, collects and processes your personal data in connection with the purchase or use of our services, products, and website. This Policy is prepared and made available to comply with the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and the information requirements set out therein.

 

What personal data we process

We process personal data about you only when necessary and in accordance with applicable legislation. Depending on the circumstances, this may include:

• Name and telephone number

• E-mail address

• Username

• Invoicing and accounting data and documentation

• Account status and IP address

If we need to collect more personal data than described above, we will inform you by updating this Policy.

 

Why we process your personal data

We process your personal data only where we have a legitimate purpose and in accordance with the GDPR. We process personal data for the following purposes:

• To deliver our products and services

• To facilitate a sales process

• To respond to inquiries, questions, and complaints

• To provide service messages, updates, and information about our products and services

• To send newsletters by e-mail (where you have subscribed)

• To improve our products, services, and website

• To comply with applicable legal requirements, such as bookkeeping obligations

 

Legal basis for processing

We process your personal data on one or more of the following legal bases under the GDPR: Consent (Article 6(1)(a)). You may withdraw your consent at any time using the contact details at the end of this Policy.

If you withdraw consent, the data processed on that basis will be deleted unless it can or must be retained to comply with a legal obligation. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Performance of a contract to which you are a party (Article 6(1)(b)).

Compliance with a legal obligation to which we are subject (Article 6(1)(c)). Legitimate interests pursued by us, where these are not overridden by your interests or fundamental rights and freedoms (Article 6(1)(f)).

 

Location data

Our platform includes an optional GPS tracking function that customers can choose to activate. Where this feature is enabled, location data is processed and made available within our systems. We collect your consent before processing this data, and you can disable the feature at any time.

 

Cookies and website analytics

Our website uses cookies and similar technologies to operate the site, remember your preferences, and understand how the site is used. You can manage or 4 decline non-essential cookies through the consent banner on our website or through your browser settings. Declining non-essential cookies will not affect your ability to use core parts of the site.

 

Who we share your personal data with

We share personal data with other parties only where legally permitted or required. We use selected sub-processors to deliver our services:

• Platform users: your personal data is processed by our hosting provider (Microsoft Azure, or an on-premises provider where applicable), our customer support provider (Intercom Inc.), and our internal e-mail and file storage system (Microsoft).

• Current and prospective customers: the personal data of key decisionmakers within customer or prospective customer organisations is processed in our CRM system (HubSpot).

• Newsletter subscribers and free-trial users: your personal data is processed by our marketing automation provider (HubSpot) and our internal e-mail system (Microsoft).

Where transfers of personal data outside the EU/EEA occur, we ensure an appropriate transfer mechanism is in place, such as the EU Standard Contractual Clauses or an adequacy decision.

 

How long we keep your personal data

We aim to delete personal data as soon as it is no longer necessary for the purposes described above.

• Data retained to comply with the Danish Bookkeeping Act is kept for 5 years after the end of the accounting year in which it was collected.

• Personal data relating to commercial customers is kept for as long as the customer relationship is active and the data remains relevant to managing that relationship and performing our contractual obligations.

• If you are not part of a customer organisation and are stored as a contact in our CRM following engagement with our marketing, your data is erased after 12 months of inactivity.

If you have questions about our retention periods, please contact us using the details below.

 

Your rights

As a data subject under the GDPR, you have the right to:

• Request access to the personal data we hold about you, the purposes of processing, and any disclosures or transfers

• Have inaccurate data corrected

• Have certain data erased

• Request restriction of processing

• Object to processing based on reasons relating to your particular situation

• Not be subject to a decision based solely on automated processing, unless it is necessary for a contract with us, authorised by law, or based on your explicit consent

• Receive the data you have provided to us in a structured, commonly used, and machine-readable format (data portability)

• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us using the details below. We will do our best to accommodate your request.

 

Correcting your information

If you are a platform user and find that the data we hold is incorrect, you can update it directly by logging in and going to Organization / Users.

If you are a prospective customer, newsletter subscriber, or free-trial user and find that your data is incorrect, contact us and we will correct it promptly and confirm once done.

If our processing of your personal data is ever found to be unlawful, we will immediately revise our internal procedures and inform all relevant Human Risks staff.

 

Complaints

You have the right to lodge a complaint with a supervisory authority. In Denmark, this is the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk). You may also complain to the supervisory authority in your country of residence or workplace.

 

Changes to this Policy

We may update and amend this Policy from time to time. When we do, we will update the date and version number at the top. If we make significant changes, 6 we will provide notice, for example through a visible notice on our website or by direct message.

 

Contact

If you have questions or comments about this Policy, or wish to exercise any of your rights, please contact us at info@humanrisks.com