Collection: Personal data

Last updated: October 2026

This personal data protection policy describes how trustmade.dk (“the site”, “we”, “us” or “our”) collects, uses and discloses your personal information when you visit or use our services or make a purchase from www.trustmade.dk (“the site”) or otherwise communicate with us in connection with the website (collectively, “the services”). In connection with this personal data protection policy, “you” and “your” are used to refer to you as a user of the services, regardless of whether you are a customer, a visitor to the website or another person whose information we have collected in accordance with this personal data protection policy.

Please read this personal data protection policy carefully.

Our role and the company’s role

We are the data controller for our own management of subscriptions, inquiries, security and the processing in the review service for which we determine the purpose, including publication and moderation.

When we process a company’s customer list or send out invitations solely on the company’s documented instructions, the company is the data controller, and Trustmade is the data processor for that activity. The company must inform its customers about this processing. The processing is governed by the data processing agreement.

The role is determined for each specific activity. A data processing agreement does not in itself give Trustmade the right to use a customer list for its own purposes. If information from an integration is also to be used for processing for which we are independently the data controller, the purpose, disclosure and legal basis must be stated separately.

Information and sources

We receive information directly from you when you contact us, create an account, write a review, respond to a review or participate in a complaint dialogue. The information may include your name, email address, phone number, company details, account details, messages and relevant documentation.

We may receive necessary information about an order or customer relationship from the company you have traded with or from an integration that the company has connected. This may include email, order or invoice numbers, date and status. The information that is actually received and for what purposes must be stated in the information about the specific integration and processing.

Information about companies can be obtained from public registers, for example, the Danish Central Business Register (CVR). Such information may also constitute personal data, particularly for sole proprietorships. Payment providers may send us payment status and information necessary for invoicing.

When using the services, we may process technical information such as IP address, time, browser, device and security logs. Statistics and marketing tracking are only activated on the basis described in the cookie policy.

When we receive information from other sources, we provide the required information within a reasonable timeframe and no later than one month after receipt, unless a legal exception applies. If the information is used for contact or disclosure, the information must be provided no later than at the first contact or disclosure.

You can choose not to provide information. However, if information is necessary for an account, the verification of a customer relationship or the processing of a case, we cannot perform the relevant function without it. At the time of collection, it must be stated which fields are necessary and why. Marketing consent and consent to optional cookies are voluntary.

Purposes and legal basis for processing

Management of companies and subscriptions: We process contact details, account details, agreement details and payment status to manage the account, provide services and communicate about the agreement. For contact persons at a company, the legal basis is our legitimate interest in managing the customer relationship, pursuant to GDPR Article 6(1)(f). If the data subject themselves is a party to the agreement, necessary processing may take place pursuant to Article 6(1)(b).

Reviews and verification: We process information about the customer relationship, confirmation, the content of the review and relevant technical information to verify the basis, publish customer experiences and counteract manipulation. For the activities for which we are the data controller, the stated legal basis is our legitimate interest in a trustworthy review service and useful consumer information, pursuant to Article 6(1)(f). We must specifically balance this interest against your rights, limit the amount of data and process objections.

Support and complaint dialogue: We process contact details, correspondence and relevant attachments to answer inquiries and support the dialogue you or the company has requested. The legal basis is generally our legitimate interest in handling inquiries and disputes, pursuant to Article 6(1)(f), or the necessary performance of an agreement with you pursuant to (b). When we work solely on a company’s instructions, the company’s processing legal basis and the data processing agreement apply.

Security and misuse: We process necessary access and incident information to protect the service, investigate misuse and prevent fake reviews. The legal basis is our legitimate interest in secure operation and protecting users, pursuant to Article 6(1)(f).

Record-keeping and regulatory requirements: We process the information that is necessary to fulfil our legal obligations, pursuant to Article 6(1)(c). Processing in connection with a specific legal claim may take place pursuant to (f) and the special rules applicable to the personal data concerned.

Marketing and optional cookies: Consent-based processing takes place pursuant to Article 6(1)(a). The rules on electronic marketing and access to your device must also be met. The specific processing activities are described below and in the cookie policy.

Public information and private attachments

When you submit a review for publication, the fields and scope shown in the review rules and submission process will be displayed. Public content can be read, shared and potentially indexed by search engines. It is therefore important that you do not include private information in the review text.

Email addresses, confirmation codes and documentation for verification must not be in public review fields. Relevant information may be processed by employees who handle verification or a specific case. In a complaint dialogue, the information necessary for the dialogue is shared with the company and customer concerned. It must be clear at the time of submission which information is shared.

We ask that you do not send CPR numbers, full credit card details or special categories of personal data, such as health information, in general reviews or support inquiries. If we receive such information, we will assess separately whether it may be lawfully processed and delete or restrict it if the processing is not necessary or lacks a valid legal basis.

Recipients and processors

We use processors for website and hosting, email, operations, support and payment. Data processors may only process information according to our documented instructions and a data processing agreement. Other recipients may have independent data controller responsibility for specific purposes, such as a payment provider’s statutory verification. The role is assessed for the specific service.

Information is shared with the relevant company or customer when necessary for the described function. We may also share necessary information with advisers, courts or authorities if legislation or a specific case permits. General access to disclose private customer lists to marketing partners is not granted.

Processing outside the EU and EEA

Storage on a server in the EU does not necessarily mean that information is processed solely in the EU. Remote access, support and onward transfer must also be assessed.

A transfer to a country outside the EU/EEA may only take place on a valid transfer basis. This may be a relevant adequacy decision or the EU Commission’s standard contractual clauses with necessary assessments and supplementary measures. A reference to the EU-US Data Privacy Framework may only be used for a recipient and processing that is actually covered.

Storage and deletion

We do not store personal data longer than is required by the described purposes. There must be separate timeframes for different types of data. Information that must be retained for legal requirements or a specific dispute should be separated from general operations as far as possible.

 

Information	Period or criterion
Subscription and company account	For the duration of the agreement and thereafter only for the fixed period required for completion, documentation and any claims.
Invoices and other accounting material	Generally five years from the end of the financial year to which the material relates.
Public reviews and responses	As long as publication has a lawful and relevant purpose; deletion requests and objections are assessed individually.
Private order data and verification attachments	Only for the fixed period necessary for verification and any specific objections.
Support and complaints	While the case is being handled and for the specified period after its conclusion, for documentation and any claims.
Logs and backups	After separate, specified periods and with limited use of backups.
Marketing consents and opt-outs	Necessary documentation is retained for a specified period; information needed to respect an opt-out is limited to what is necessary.

 

Security

We must implement appropriate technical and organisational security measures in light of the risks and restrict access to people who need it for their work. Processing on behalf of companies is also covered by the security appendix to the data processing agreement. Contact us immediately at kontakt@trustmade.dk if you discover possible unauthorised access or another security incident. Do not send sensitive information by ordinary email unless we have provided a suitable channel.

Your rights

Under the GDPR, you have the right to access your information, rectify inaccurate information and, where the conditions are met, erase or restrict the processing of your information.

You may object to processing based on our legitimate interests on grounds relating to your particular situation. We will then assess whether the processing should cease. You may always object to processing for direct marketing, including associated profiling, in which case that processing must stop.

You may have the right to data portability for information you have provided to us where the processing is automated and based on your consent or an agreement with you. Where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before the withdrawal.

Write to kontakt@trustmade.dk to exercise your rights. We may ask for information that is necessary and proportionate to verify your identity. We will respond to your request without undue delay and generally within one month of receiving it. If the rules allow an extension due to the complexity or number of requests, the deadline may be extended by up to a further two months. In that case, we will notify you of the extension and the reasons for it within the first month.

If Trustmade acts solely as a data processor for the relevant activity, we will assist the controller company in handling the request and inform you who to contact. You do not lose your rights by making a complaint or unsubscribing from marketing.

Complaints and changes

You can contact us regarding our processing of your information. You can also complain directly to the Danish Data Protection Agency via www.datatilsynet.dk. You are not required to complain to Trustmade first.

We update the policy when the processing or applicable rules change and state the date of the current version. In the event of material changes, we will inform affected individuals as appropriate. An update to the policy does not constitute new consent. A new purpose must have a valid legal basis and be communicated before processing begins.

 

Sub-processors

Company	Company Registration No.	Description of processing
Stripe, Inc.   1 Wilton Park,   Wilton Place,   Dublin 2, D02 FX04,   Ireland.	IE3396855EH	Stripe, Inc. acts as Trustmade’s payment solution and processes payments on behalf of Trustmade. In this capacity, Stripe, Inc. handles payment information and processes transactions as a data processor in accordance with the data processing agreement entered into and applicable data protection legislation.
OVH Groupe SA   2 rue Kellermann,   59100 Roubaix,   France.	537407926 (SIREN)	OVH Groupe SA is a global cloud server provider and supplies the infrastructure on which Trustmade´s platform runs. The data center used is located in 59100 Roubaix, France.
Mailgun Technologies, Inc.   112 E Pecan St. #1135,   San Antonio, TX 78205,   United States.	32062902609 (Texas TIN)	Mailgun is a company that provides email delivery services. Trustmade uses the company to send emails from our platform. All emails are sent through Mailgun’s EU region.
Microsoft Ireland Operations Ltd   One Microsoft Place,   South County Business Park,   Leopardstown,   Dublin 18,   D18 P521 Ireland.	IE8256796U	Trustmade uses Microsoft’s Office 365 cloud service for email and cloud storage. As part of the setup, the location of the data is selected to be in the EU.