Last updated: 29 September 2026
This policy explains what personal data Novodan collects through novodan.eu, why, how long we keep it, who else handles it for us, and what you can ask of us. If something here is unclear, write to [email protected].
Who is responsible
The data controller is Novodan ApS, CVR 42569909, Herningvej 296, 9220 Aalborg East, Denmark. E-mail: [email protected].
What we collect and why
1. When you send us a request or write to us
When you use a form on this site, we store what you wrote in the form (for example your name, e-mail address, phone number, organisation and the description of what you need), any files you attached, and the time the request arrived. When you e-mail us, we receive your message and address in our mailbox.
We use this to answer you and, if it leads to an engagement, to keep a record of what was agreed. The legal basis is steps taken at your request before a possible contract (GDPR Article 6(1)(b)) and our legitimate interest in answering enquiries (Article 6(1)(f)).
Attachments are stored outside the public web space, can be opened only by the people at Novodan who handle requests, and are deleted 12 months after the request arrives. The request itself is reduced to a record that no longer identifies you after 24 months, unless it became a contract, in which case we keep what the Danish Bookkeeping Act requires (five years from the end of the financial year). You can ask us to delete your request sooner, or to send you a copy, at any time.
2. Visitor statistics, heatmaps and session recordings (only if you accept)
If you click Accept in the cookie banner, we use two tools to understand how visitors use the site so we can improve it:
- Google Analytics 4 counts page views and what visitors do on the site: which pages they open, where they came from, how far they scroll, which buttons and outside links they click, whether a form was sent, and general device information (browser, screen size, language, approximate country and city derived from the IP address). Google Analytics does not store IP addresses.
- Microsoft Clarity records how the page is used (mouse movements, clicks, scrolling) and turns it into heatmaps and replays of visits. Everything you type into a form is masked before it leaves your browser, so recordings do not show what you enter.
Before anything is sent to either tool, our site removes the part of the page address that could identify you: every query parameter except campaign tags (utm_ parameters) and anything after #. We do not send your name, e-mail address or search words to either tool, and we do not use them for advertising: advertising features are switched off in both.
The legal basis is your consent (GDPR Article 6(1)(a) and the Danish cookie rules). If you click Reject, or do nothing, neither tool is loaded and no analytics cookies are set. You can change your choice at any time with the Cookie settings link at the bottom of every page. Withdrawing consent does not affect data already collected.
Retention: Google Analytics keeps event data for 14 months. Clarity keeps recordings for 30 days and heatmap data for up to 13 months.
3. Running and protecting the site
Like any website, the server and our security tools process your IP address and browser details to deliver pages, block attacks and spam, and limit repeated login attempts. The legal basis is our legitimate interest in keeping the site available and secure (Article 6(1)(f)). These logs are kept only as long as needed for that purpose and are deleted on a rolling basis.
Cookies and similar storage
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
novodan_consent (browser storage, not a cookie) | novodan.eu | Remembers whether you accepted or rejected analytics, so we do not ask on every page | 6 months |
__cf_bm, cf_clearance | Cloudflare | Set only when Cloudflare needs to tell people apart from automated bots, and to remember that your browser passed that check; needed for security | 30 minutes to 1 year, depending on the check |
_ga, _ga_VXDGCLXXVM | Google Analytics (only after Accept) | Distinguishes visits and sessions for statistics | 13 months |
_clck | Microsoft Clarity (only after Accept) | Keeps the same Clarity ID for your browser across visits | 1 year |
_clsk | Microsoft Clarity (only after Accept) | Links page views within one visit into one recording | 1 day |
Staff who log in to manage the site also get the standard WordPress login cookies. Visitors do not.
Who handles data for us
We do not sell personal data. These companies process it on our behalf, under data processing agreements:
| Company | What they do for us | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosts the website and its database | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | Delivers the site quickly and protects it against attacks | Global network; United States |
| Microsoft Ireland Operations Ltd | Our e-mail (Microsoft 365), including the messages the site sends when you submit a form | EU; United States possible |
| Google Ireland Ltd | Google Analytics (only after Accept) | EU; United States |
| Microsoft Ireland Operations Ltd | Microsoft Clarity (only after Accept) | EU; United States |
Where data may be transferred to the United States, the transfer is covered by the EU-U.S. Data Privacy Framework, under which Cloudflare, Google and Microsoft are certified, and by the European Commission’s Standard Contractual Clauses in their data processing terms.
Your rights
You have the right to see the personal data we hold about you and get a copy, to have it corrected or deleted, to restrict or object to how we use it, and to receive data you gave us in a machine-readable format. Where we rely on your consent, you can withdraw it at any time. Write to [email protected] and we will answer within one month.
If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would appreciate the chance to put it right first.
Changes to this policy
When we change how we handle personal data, we update this page and the date at the top.