1. Introduction
This Privacy Policy explains how Actnation ApS ("Actnation", "we", "our", or "us") collects, uses, and protects the personal data of users, including company employees, companies, and NGOs using our payroll impact platform.
We also use third-party systems such as Google Analytics and HubSpot to manage customer relationships and analyse platform usage. These platforms process data to enhance our services, communications, and performance monitoring.
2. Data Collection & Usage
We collect the following categories of personal data to operate, improve, and secure our services:
- Employee Information: Name, email, CPR number (for tax reporting purposes), donation preferences, and account settings.
- Company Information: Name, CVR number, invoicing details, payment history, and subscription preferences.
- NGO Information: Name, CVR number, uploaded campaigns, and donation tracking data.
- Usage Data: Platform interactions, log files, IP addresses, browser type, device type, pages visited, time on page, and referral sources.
- Cookies & Tracking Technologies: Information collected through cookies, tracking pixels, and similar technologies.
- Technical & Diagnostic Data: Performance metrics, system logs, error reports, and crash diagnostics.
- CRM Data (HubSpot): Customer interactions, communications, and engagement history.
- Support & Communication Data: Customer service inquiries, chat conversations, and email communications.
- Marketing & Engagement Data: User engagement with emails, newsletters, and promotional offers.
Users Without Payroll Integration
For users who choose not to integrate their payroll system, we collect only name, email address, and donation transactions made via the Company Wallet. CPR numbers and payroll-related data are not collected or processed for these users.
ⓘ GDPR / Danish Law Note
CPR numbers constitute sensitive personal identification data under Section 11 of the Danish Data Protection Act (Databeskyttelsesloven). Processing of CPR numbers is only carried out where expressly authorised by law — specifically for the purpose of generating tax-deductible donation receipts in accordance with the Danish Tax Assessment Act (Ligningsloven § 8 A and § 12). Actnation processes CPR numbers solely on the documented instruction of the Customer acting as data controller and only to the extent required by applicable tax legislation.
3. Legal Bases for Processing
In accordance with Article 6 of the GDPR, we rely on the following legal bases:
- Performance of a contract (Art. 6(1)(b)): Processing necessary to deliver the platform services agreed with the Customer, including account management, donation facilitation, and invoicing.
- Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable law, including Danish tax reporting obligations and accounting legislation.
- Legitimate interests (Art. 6(1)(f)): Processing for platform security, fraud prevention, service analytics, and CRM communications — where these interests are not overridden by the rights of the data subjects.
- Consent (Art. 6(1)(a)): Processing for direct marketing and non-essential cookies, where users have provided explicit, freely given consent.
ⓘ GDPR Note
Where processing is based on consent, data subjects have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal requests may be sent to safiya@actnation.io.
4. Purpose of Processing
We process personal data for the following purposes:
- Facilitating payroll-based donations and employer contributions.
- Generating tax receipts for NGOs and employees.
- Managing company subscriptions, invoicing, and payment processing.
- Providing personalised user experiences and improving platform usability.
- Conducting analytics to enhance platform performance and security.
- Managing customer relationships and communications (HubSpot CRM).
- Detecting, preventing, and responding to fraud and security breaches.
- Sending transactional communications and service updates.
- Ensuring compliance with legal and regulatory obligations.
5. Data Sharing
We do not sell personal data. We may share data under the following conditions:
- With NGOs: Employee donation details (if not anonymised) for tax reporting.
- With Payment Providers: Secure processing of payments.
- With Authorities: If required by law (e.g. the Danish Tax Authority — SKAT).
- With Payroll Systems: To ensure accurate payroll deductions and data management.
- With CRM Systems (HubSpot): For managing customer interactions and marketing communications.
- With Analytics Providers (Google Analytics): To analyse user behaviour and improve the platform.
- With Cloud & IT Service Providers: For hosting, database management, and security services.
For users without payroll integration, no CPR numbers or payroll-related data are shared. Only name, email, and Company Wallet donation transactions are processed.
6. Cookies & Tracking Technologies
We use cookies and tracking technologies for the following purposes:
- Essential Cookies: Necessary for authentication, security, and fraud prevention.
- Performance Cookies: Analytics on user behaviour to improve platform functionality (Google Analytics).
- Functionality Cookies: User preference storage to enhance user experience.
- Marketing Cookies: Tracking engagement with promotional content.
Users can manage cookie preferences through our consent banner or their browser settings. Non-essential cookies are only activated following explicit user consent in accordance with the Danish Executive Order on Cookies (Cookiebekendtgørelsen).
7. Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected and in compliance with applicable legal obligations:
- Account data: Retained for the duration of the subscription. Deleted upon request, subject to mandatory legal retention requirements.
- Transaction & invoicing data: Retained for 5 years in accordance with the Danish Bookkeeping Act (Bogføringsloven).
- CPR numbers: Retained only for as long as required to fulfil tax reporting obligations; deleted promptly thereafter.
- Usage logs & analytics data: Retained for up to 26 months for security monitoring and service improvement.
- Support & communications data: Retained for 3 years for service continuity.
- CRM data: Retained as long as there is an active customer relationship or legitimate business interest.
8. Security Measures
We implement technical and organisational security measures to protect personal data, including:
- Encryption of sensitive data in transit and at rest.
- Secure authentication and role-based access controls.
- Regular security audits and vulnerability assessments.
- Monitoring and detection of unauthorised access or suspicious activity.
- Personnel training and confidentiality obligations for staff handling personal data.
9. Your Rights under GDPR
Under the GDPR and Danish data protection law, you have the following rights:
- Right of Access (Art. 15): Request a copy of your personal data.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
- Right to Restriction (Art. 18): Request limited processing in certain circumstances.
- Right to Data Portability (Art. 20): Request transfer of your data to another service provider.
- Right to Object (Art. 21): Object to processing for specific purposes, including direct marketing.
- Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time where processing is consent-based.
- Right to Lodge a Complaint (Art. 77): File a complaint with the Danish Data Protection Agency (Datatilsynet).
To exercise your rights, contact our Data Protection Officer: safiya@actnation.io
10. International Data Transfers
Personal data is primarily processed within the EU/EEA. Where data is transferred outside the EU/EEA, Actnation ensures adequate protection through:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Data Processing Agreements (DPAs) with service providers ensuring GDPR compliance.
- Technical safeguards including encryption and secure access controls.
11. NGO Listings & Public Information
We include publicly available information from NGO websites to promote collaboration and transparency. This includes NGO name, website, registration number, publicly listed mission, and generic contact information.
This processing is conducted under legitimate interest (Art. 6(1)(f) GDPR), in alignment with Recital 47. NGOs listed on our platform are never charged for inclusion. They may create an account to manage their campaigns.
In accordance with GDPR Article 14(5)(b), individual notification is not required where doing so would involve disproportionate effort and where transparent public notice (such as this policy) is provided. You may exercise your right to object at any time under Article 21 by contacting support@actnation.io.
12. Automated Decision-Making & Profiling
ⓘ GDPR Article 22 Disclosure
Actnation does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals, as defined under Article 22 of the GDPR. Platform analytics are used solely for aggregated service improvement and do not constitute individual profiling for decision-making purposes.
13. Changes to this Policy
We may update this Privacy Policy periodically to reflect changes in our services or legal requirements. Users will be notified of significant changes via email or platform notifications at least 30 days before changes take effect.
14. Contact & Supervisory Authority
ⓘ Supervisory Authority
You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):
Carl Jacobsens Vej 35, 2500 Valby, Denmark — www.datatilsynet.dk — dt@datatilsynet.dk — Tel: +45 33 19 32 00
1. Introduktion
Denne privatlivspolitik forklarer, hvordan Actnation ApS ("Actnation", "vi", "vores" eller "os") indsamler, anvender og beskytter personoplysninger om brugere, herunder virksomhedsmedarbejdere, virksomheder og NGO'er, der anvender vores platform.
Vi anvender desuden tredjepartssystemer som Google Analytics og HubSpot til at administrere kunderelationer og analysere platformsanvendelse.
2. Dataindsamling & anvendelse
Vi indsamler følgende kategorier af personoplysninger:
- Medarbejderoplysninger: Navn, e-mail, CPR-nummer (til skatterapportering), donationspræferencer og kontoindstillinger.
- Virksomhedsoplysninger: Navn, CVR-nummer, faktureringsoplysninger, betalingshistorik og abonnementspræferencer.
- NGO-oplysninger: Navn, CVR-nummer, uploadede kampagner og donationssporingsdata.
- Brugsdata: Platforminteraktioner, logfiler, IP-adresser, browsertype, enhedstype og besøgte sider.
- Cookies og sporingsteknologier: Oplysninger indsamlet via cookies og lignende teknologier.
- Tekniske og diagnostiske data: Performancemålinger, systemlogfiler og fejlrapporter.
- CRM-data (HubSpot): Kundeinteraktioner, kommunikation og engagementshistorik.
- Support- og kommunikationsdata: Kundeservicehenvendelser og e-mailkommunikation.
- Marketing- og engagementsdata: Brugerengagement med nyhedsbreve og tilbud.
Brugere uden lønintegration
For brugere, der vælger ikke at integrere deres lønsystem, indsamler vi kun navn, e-mailadresse og donationstransaktioner via Virksomhedens Wallet. CPR-numre og lønrelaterede data indsamles ikke for disse brugere.
ⓘ GDPR / Dansk lovgivning
CPR-numre udgør følsomme personidentifikationsdata i henhold til § 11 i databeskyttelsesloven. Behandling af CPR-numre foretages kun, hvor det er udtrykkeligt hjemlet i loven — specifikt med henblik på at generere skattefradragsberettigede donationskvitteringer i overensstemmelse med ligningslovens §§ 8 A og 12. Actnation behandler CPR-numre udelukkende efter dokumenteret instruks fra kunden som dataansvarlig.
3. Retsgrundlag for behandling
I overensstemmelse med GDPR artikel 6 anvender vi følgende retsgrundlag:
- Opfyldelse af en kontrakt (art. 6(1)(b)): Behandling nødvendig for at levere de platformsydelser, der er aftalt med kunden.
- Retlig forpligtelse (art. 6(1)(c)): Behandling krævet for at overholde gældende lovgivning, herunder danske skatte- og bogføringsregler.
- Legitim interesse (art. 6(1)(f)): Behandling til platformssikkerhed, svindelforebyggelse, serviceanalyse og CRM-kommunikation.
- Samtykke (art. 6(1)(a)): Behandling til direkte markedsføring og ikke-essentielle cookies, hvor der er givet udtrykkeligt samtykke.
ⓘ GDPR-note
Hvor behandling er baseret på samtykke, har den registrerede ret til at tilbagekalde samtykket til enhver tid uden at det berører lovligheden af behandlingen forud for tilbagekaldelsen. Anmodning om tilbagekaldelse sendes til safiya@actnation.io.
4. Formål med behandling
- Facilitering af lønbaserede donationer og arbejdsgiverbidrag.
- Generering af skattekvitteringer til NGO'er og medarbejdere.
- Håndtering af virksomhedsabonnementer, fakturering og betalingsbehandling.
- Levering af personaliserede brugeroplevelser og forbedring af platformens brugervenlighed.
- Udførelse af analyser til forbedring af platformens ydeevne og sikkerhed.
- Håndtering af kunderelationer og kommunikation (HubSpot CRM).
- Opdagelse og forebyggelse af svindel og sikkerhedsbrud.
- Udsendelse af transaktionskommunikation og serviceopdateringer.
- Overholdelse af juridiske og regulatoriske forpligtelser.
5. Deling af data
Vi sælger ikke personoplysninger. Vi kan dele data under følgende betingelser:
- Med NGO'er: Medarbejderes donationsoplysninger (medmindre anonymiseret) til skatterapportering.
- Med betalingsudbydere: Sikker behandling af betalinger.
- Med myndigheder: Hvis krævet ved lov (f.eks. Skattestyrelsen).
- Med lønsystemer: For at sikre korrekte løntræk og datahåndtering.
- Med CRM-systemer (HubSpot): Til håndtering af kundeinteraktioner og marketingkommunikation.
- Med analyseleverandører (Google Analytics): Til analyse af brugeradfærd og platformsforbedring.
- Med cloud- og IT-tjenesteudbydere: Til hosting, databasestyring og sikkerhed.
6. Cookies & sporingsteknologier
Vi anvender cookies til følgende formål:
- Essentielle cookies: Nødvendige for autentifikation, sikkerhed og svindelforebyggelse.
- Performancecookies: Analyse af brugeradfærd til forbedring af platformens funktionalitet.
- Funktionalitetscookies: Lagring af brugerpræferencer.
- Marketingcookies: Sporing af engagement med reklamerende indhold.
Brugere kan administrere cookiepræferencer via vores samtykke-banner eller browserindstillinger. Ikke-essentielle cookies aktiveres kun efter udtrykkeligt samtykke i overensstemmelse med cookiebekendtgørelsen.
7. Opbevaringsperioder
- Kontodata: Opbevares i abonnementsperioden og slettes efter anmodning.
- Transaktions- og faktureringsdata: Opbevares i 5 år i overensstemmelse med bogføringsloven.
- CPR-numre: Opbevares kun så længe det er nødvendigt til skatterapporteringsformål og slettes herefter.
- Brugslogfiler og analysedata: Opbevares i op til 26 måneder.
- Support- og kommunikationsdata: Opbevares i 3 år.
- CRM-data: Opbevares så længe der er en aktiv kunderelation eller legitim forretningsinteresse.
8. Sikkerhedsforanstaltninger
- Kryptering af følsomme data under transmission og opbevaring.
- Sikker autentifikation og rollebaseret adgangskontrol.
- Regelmæssige sikkerhedsrevisioner og sårbarhedsvurderinger.
- Overvågning og opdagelse af uautoriseret adgang.
- Medarbejdertræning og fortrolighedsforpligtelser for personale, der behandler personoplysninger.
9. Dine rettigheder
Under GDPR og dansk databeskyttelseslovgivning har du følgende rettigheder:
- Ret til indsigt (art. 15): Anmod om en kopi af dine personoplysninger.
- Ret til berigtigelse (art. 16): Anmod om korrektion af unøjagtige oplysninger.
- Ret til sletning (art. 17): Anmod om sletning af dine personoplysninger ("retten til at blive glemt").
- Ret til begrænsning (art. 18): Anmod om begrænset behandling i visse tilfælde.
- Ret til dataportabilitet (art. 20): Anmod om overførsel af dine data til en anden tjenesteudbyder.
- Ret til indsigelse (art. 21): Gør indsigelse mod behandling til specifikke formål, herunder direkte markedsføring.
- Ret til at trække samtykke tilbage (art. 7(3)): Tilbagekald samtykke til enhver tid.
- Ret til at klage (art. 77): Indgiv klage til Datatilsynet.
Kontakt vores databeskyttelsesrådgiver: safiya@actnation.io
10. Internationale overførsler
Personoplysninger behandles primært inden for EU/EØS. Hvor data overføres uden for EU/EØS, sikrer Actnation passende beskyttelse via:
- Standard Contractual Clauses (SCC'er) godkendt af Europa-Kommissionen.
- Databehandleraftaler med tjenesteudbydere, der sikrer GDPR-overholdelse.
- Tekniske sikkerhedsforanstaltninger inkl. kryptering og adgangskontrol.
11. NGO-opslag og offentlig information
Vi inkluderer offentligt tilgængeligt information fra NGO-websteder for at fremme samarbejde og gennemsigtighed, herunder NGO-navn, websted, registreringsnummer og offentliggjort mission.
Denne behandling foretages på grundlag af legitim interesse (art. 6(1)(f) GDPR). NGO'er opkræves aldrig betaling for optagelse. De kan oprette en konto for at administrere deres kampagner. Du kan til enhver tid gøre indsigelse mod denne behandling ved at kontakte support@actnation.io.
12. Automatiserede beslutninger og profilering
ⓘ GDPR Artikel 22
Actnation foretager ikke automatiserede individuelle afgørelser eller profilering, der frembringer retsvirkninger eller på tilsvarende vis væsentligt påvirker enkeltpersoner, som defineret i GDPR artikel 22. Platformsanalyser anvendes udelukkende til aggregeret serviceforbedring.
13. Ændringer til denne politik
Vi kan opdatere denne privatlivspolitik for at afspejle ændringer i vores tjenester eller juridiske krav. Brugere underrettes om væsentlige ændringer via e-mail eller platformsnotifikationer mindst 30 dage inden ændringerne træder i kraft.
14. Kontakt & tilsynsmyndighed
