Privacy policy

This privacy policy explains how COPP ("COPP", "we", "us" or "our") collects and uses personal data when you visit our website https://www.bycopp.com/, contact us through the contact form or by email, work with us, or follow our social media profiles.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Danish Data Protection Act (databeskyttelsesloven) and the Danish Executive Order on cookies (cookiebekendtgørelsen).

CONTENT

1. Who is responsible for your data?
2. Overview
3. When you contact us
4. When we work together
5. Cookies and similar technologies
6. Our social media profiles
7. Who we share your data with
8. Transfers outside the EU/EEA
9. How long we keep your data
10. How we keep your data secure
11. Your rights
12. Changes to this policy
13. How to contact us

1. Who is responsible for your data?

The data controller for the processing described in this policy is:

COPP
Sole proprietorship (enkeltmandsvirksomhed) owned by Frederik H. Lacoppidan
Thoravej 10, 2. 2
2400 København NV
Denmark
CVR: 41984112
Email: media@bycopp.com

We are a small business and are not required to appoint a Data Protection Officer. If you have any questions about how we handle your personal data, you are welcome to contact us at the email address above.

2. Overview

We process personal data for the following purposes:

• Answering enquiries sent via the contact form or by email — Name, email address, company, budget range, your message — GDPR Art. 6(1)(b) or Art. 6(1)(f) — Up to 12 months after our last contact, unless we start working together
• Delivering and invoicing our services — Contact details, correspondence, agreements, invoices — GDPR Art. 6(1)(b) and Art. 6(1)(c) — Accounting records: 5 years from end of financial year. Other project data: up to 3 years after project ends
• Website statistics (Google Analytics) — Online identifiers, device and browser information, usage data — Your consent, GDPR Art. 6(1)(a) — See section 5
• Advertising and retargeting (Meta, Google Ads, LinkedIn, TikTok) — Online identifiers, IP address, device and browser information, pages visited — Your consent, GDPR Art. 6(1)(a) — See section 5

We do not process sensitive personal data, and we do not use automated decision-making or profiling with legal effects on you.

3. When you contact us

Which data we collect

When you fill in the contact form on our website, we collect your name, email address, company, the budget range you select and your message. If you email us directly, we collect your email address and whatever you choose to include in your email. Providing this information is voluntary, but we need at least your name and email address to be able to reply. Please do not include sensitive personal data in your message.

Why we use it

We use the information to answer your enquiry, assess whether and how we can help with your project, and prepare a proposal or quote.

Legal basis

When your enquiry concerns a possible project or collaboration, we process your data to take steps at your request before entering into a contract (GDPR Art. 6(1)(b)). For other enquiries, we rely on our legitimate interest in answering the messages we receive (GDPR Art. 6(1)(f)).

Who processes it

The contact form is provided and hosted by Webflow, which stores the submission and sends it to our inbox on our behalf. Our email is provided by Google Workspace. Both act as data processors for us (see sections 7 and 8). We do not add you to a newsletter or mailing list, and the content of the form is not shared with advertising platforms.

4. When we work together

If your enquiry leads to a collaboration, we process the contact details of you and your colleagues, our correspondence, agreements, briefs and invoices so that we can deliver the agreed services (GDPR Art. 6(1)(b)). We keep accounting records, such as invoices, because the Danish Bookkeeping Act (bogføringsloven) requires us to (GDPR Art. 6(1)(c)). Where necessary, data may be shared with our providers of accounting and IT services and with public authorities such as the Danish Tax Agency (Skattestyrelsen) when required by law.

5. Cookies and similar technologies

What cookies are

Cookies are small text files that are stored on your device when you visit a website. Similar technologies, such as pixels and tags, read or store information on your device in the same way. In this policy, we refer to all of them as "cookies".

How you give and withdraw consent

Under the Danish cookie rules, we may only store or read cookies that are not strictly necessary if you have given your consent. When you first visit our website, a cookie banner lets you accept all cookies, decline all non-necessary cookies, or choose which categories you accept. You can change or withdraw your consent at any time by clicking "Cookie settings" at the bottom of every page.

5.1 Necessary cookies

These cookies are required for the website to work and do not require consent.

• Cookie consent — COPP — Remembers your cookie choices so the banner is not shown on every visit — 12 months

5.2 Statistics cookies (require consent)

We use Google Analytics 4 to understand how visitors use our website. Google Analytics 4 does not log or store IP addresses. Google acts as our data processor, and analytics data is automatically deleted after no more than 14 months.

• _ga — Google — Distinguishes unique visitors — 2 years
• _ga_<ID> — Google — Keeps track of the session state — 2 years

Provider: Google Ireland Limited, Ireland, and Google LLC, USA. Privacy policy: policies.google.com/privacy

5.3 Marketing cookies (require consent)

We advertise on Meta, Google, LinkedIn and TikTok. If you accept marketing cookies, these platforms' pixels and tags are loaded on our website to measure whether our ads lead to visits, and to show our ads to people who have visited our website (retargeting).

• _fbp — Meta — Identifies browsers for ad measurement and retargeting — 3 months
• _fbc — Meta — Stores the click identifier when you arrive from a Meta ad — 3 months
• _gcl_au — Google Ads — Measures conversions from Google ads — 3 months
• _gcl_aw — Google Ads — Stores the click identifier when you arrive from a Google ad — 3 months
• li_sugr — LinkedIn — Browser identifier used to match visitors for advertising — 3 months
• bcookie — LinkedIn — Browser identifier — 1 year
• lidc — LinkedIn — Routing and data centre selection — 24 hours
• li_fat_id — LinkedIn — Member identifier used for conversion tracking — 30 days
• UserMatchHistory — LinkedIn — Syncs LinkedIn ad identifiers for retargeting — 30 days
• AnalyticsSyncHistory — LinkedIn — Stores when the last sync with LinkedIn took place — 30 days
• _ttp — TikTok — Measures and improves the performance of TikTok ads — 13 months
• _tt_enable_cookie — TikTok — Checks whether the browser accepts TikTok cookies — 13 months

Joint controllership: For Meta, LinkedIn and TikTok, we are joint controllers with the platform for the data collection step. We are responsible for informing you and obtaining your consent; the platform handles your rights requests. Google acts as an independent controller. Platforms: Meta Platforms Ireland Limited — facebook.com/privacy/policy | Google Ireland Limited — policies.google.com/privacy | LinkedIn Ireland Unlimited Company — linkedin.com/legal/privacy-policy | TikTok Technology Limited — tiktok.com/legal. You can also manage personalised advertising at youronlinechoices.com.

6. Our social media profiles

We have profiles on Instagram and LinkedIn. When you visit or interact with them, Meta and LinkedIn process your data under their own privacy policies. The platforms provide us with aggregated statistics about profile visits; for these statistics we are joint controllers with the platform. If you send us a message through one of these platforms, we use it to reply to you on the same legal basis as described in section 3.

7. Who we share your data with

We never sell your personal data. We only share it with the following recipients:

• Data processors under a data processing agreement: Webflow, Inc. (website hosting and contact form), Google (Google Workspace for email, and Google Analytics), and providers of accounting and IT services.
• Joint and independent controllers: Meta, Google, LinkedIn and TikTok in connection with marketing cookies, if you have consented (see section 5.3).
• Public authorities, when required by law.

8. Transfers outside the EU/EEA

Some of our providers are based in the USA or transfer data there, including Webflow, Google, Meta and LinkedIn. These transfers are based on the European Commission's adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework, and otherwise on Standard Contractual Clauses. TikTok may transfer data to countries outside the EU/EEA and bases such transfers on Standard Contractual Clauses. You can request a copy of the relevant safeguards by contacting us.

9. How long we keep your data

We only keep personal data for as long as it is needed:

• Enquiries that do not lead to a collaboration are deleted no later than 12 months after our last contact.
• Client and project data is kept for up to 3 years after the project ends.
• Accounting records are kept for 5 years from the end of the financial year they relate to, as required by the Danish Bookkeeping Act.
• Cookies are stored for the durations listed in section 5, and analytics data in Google Analytics is deleted after no more than 14 months.

When the retention period expires, the data is deleted or anonymised.

10. How we keep your data secure

We use appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration and unauthorised access. These include encrypted connections (HTTPS), limiting access to accounts and systems that hold your data, and only working with providers who have committed to protecting it under a data processing agreement.

11. Your rights

Under the GDPR, you have the following rights:

• Right of access: You can request access to the data we process about you and receive a copy of it.
• Right to rectification: You can have inaccurate data corrected.
• Right to erasure: In certain cases, you can have your data deleted.
• Right to restriction of processing: In certain cases, you can have the processing of your data restricted.
• Right to object: You can object to processing based on our legitimate interests.
• Right to data portability: In certain cases, you can receive the data you provided in a structured, commonly used and machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you can withdraw it at any time, for cookies via "Cookie settings" at the bottom of the website.

To exercise your rights, send an email to media@bycopp.com. We will respond within one month, and it is free of charge. We may ask you to confirm your identity before we handle your request.

You can read more about your rights on www.datatilsynet.dk.

Complaints

If you are dissatisfied with how we process your personal data, you can lodge a complaint with the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark. Phone: +45 33 19 32 00. Email: dt@datatilsynet.dk. Website: www.datatilsynet.dk. If you live in another EU/EEA country, you can also lodge a complaint with the data protection authority in that country.

12. Changes to this policy

We update this privacy policy when our processing of personal data changes or when the law requires it. The date at the top shows when the policy was last updated. If we make significant changes, we will ask for your consent again where required.

13. How to contact us

If you have any questions about this policy or how we process your personal data, please contact us:

‍COPP,

Thoravej 10, 2. 2,

2400 København NV,

Denmark.

Email: media@bycopp.com

CVR: 41984112.

‍