Legal Documentation
Privacy Policy
This Privacy Policy describes how Axiom ApS ("Axiom", "we", "our", "us"), registered in Denmark with CVR number 43218795, collects, uses, stores, and protects personal data when you visit our website, use our services, or communicate with us. We are committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven, Act No. 502 of 23 May 2018).
Table of Contents
- Data Controller Information
- Personal Data We Collect
- Legal Basis for Processing
- Purposes of Processing
- Data Retention Periods
- Sharing and Disclosure
- International Data Transfers
- Cookies and Tracking Technologies
- Your Rights Under GDPR
- Security Measures
- Children's Privacy
- Changes to This Policy
- Contact & DPO
1. Data Controller Information
The data controller responsible for your personal data is:
CVR: 43218795
Nørre Voldgade 84
1358 Copenhagen K
Denmark
Telephone: +45 70 83 29 17
Email: privacy@axiomanalysis.dk
Website: axiomanalysis.dk
If you have questions about how we handle your personal data or wish to exercise your rights, please contact us using the details above or write to our Data Protection contact at dpo@axiomanalysis.dk.
2. Personal Data We Collect
We collect personal data in the following circumstances:
2.1 Data You Provide Directly
- Contact form submissions: Full name, email address, telephone number (optional), message content, company name (optional), and country of residence.
- Subscription registrations: Full name, email address, billing address, payment method details (processed via our payment processor — we do not store raw card numbers), and chosen subscription tier.
- Report orders: Full name, email address, billing address, VAT number (if applicable), and order details.
- Newsletter sign-up: Email address and, optionally, first name and preferred content categories.
- Account creation: Username, email address, password (stored in hashed form), and profile preferences.
2.2 Data Collected Automatically
- Technical data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
- Usage data: Pages visited, time spent on pages, links clicked, search queries entered on-site, and download events.
- Cookie data: Session identifiers, preference tokens, and analytics identifiers. See Section 8 for details.
- Log data: Server access logs including timestamps, HTTP status codes, and requested resources. These logs are automatically purged after 90 days.
2.3 Data From Third Parties
We may receive data from third-party analytics providers (Google Analytics 4), advertising partners (Google Ads), and payment processors (Stripe Inc.). We use this data only for the purposes described in Section 4.
3. Legal Basis for Processing
We process your personal data only where we have a valid legal basis under Article 6 GDPR:
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Responding to contact enquiries | Legitimate interests / Contract performance | Art. 6(1)(b)(f) |
| Processing subscription orders | Contract performance | Art. 6(1)(b) |
| Sending marketing emails to subscribers | Consent | Art. 6(1)(a) |
| Website analytics and performance monitoring | Legitimate interests | Art. 6(1)(f) |
| Fraud prevention and security | Legitimate interests / Legal obligation | Art. 6(1)(c)(f) |
| Compliance with accounting and tax law | Legal obligation | Art. 6(1)(c) |
| Personalised advertising (Google Ads) | Consent | Art. 6(1)(a) |
4. Purposes of Processing
We use your personal data to:
- Provide and administer our financial analysis services, research reports, and subscription products.
- Process and fulfil orders, including delivery of digital content by email.
- Communicate with you regarding your enquiries, orders, or support requests.
- Send you editorial newsletters, market updates, and promotional communications where you have given consent or have an existing customer relationship (in accordance with the Danish Marketing Practices Act, Markedsføringsloven).
- Analyse website usage to improve the quality, relevance, and performance of our content and services.
- Comply with applicable Danish and EU law, including accounting regulations and VAT requirements.
- Detect, investigate, and prevent fraudulent transactions and other abusive activity.
- Serve relevant advertisements on third-party platforms where you have provided consent.
5. Data Retention Periods
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law:
| Data Category | Retention Period | Basis |
|---|---|---|
| Customer order records (invoices, billing) | 5 years from invoice date | Danish Bookkeeping Act (§10) |
| Active subscriber account data | Duration of subscription + 12 months after cancellation | Contract |
| Contact form submissions | 24 months from last interaction | Legitimate interests |
| Marketing consent records | Until withdrawal of consent + 3 years | Legal compliance |
| Server access logs | 90 days | Legitimate interests |
| Analytics data (aggregated) | 26 months (Google Analytics default) | Consent / Legitimate interests |
| Cookies (session) | Until browser session ends | Technical necessity |
| Cookies (persistent/analytics) | Up to 13 months from last visit | Consent |
When data reaches the end of its retention period, it is securely deleted or anonymised.
7. International Data Transfers
Some of our service providers are located outside the European Economic Area (EEA). Where personal data is transferred to a third country, we ensure an adequate level of protection through one of the following mechanisms:
- An adequacy decision by the European Commission (Art. 45 GDPR).
- Standard Contractual Clauses (SCCs) approved by the European Commission (Art. 46 GDPR).
- Binding Corporate Rules where applicable.
Transfers to the United States are governed by SCCs in conjunction with the EU-U.S. Data Privacy Framework. You may request a copy of the applicable transfer safeguards by contacting privacy@axiomanalysis.dk.
9. Your Rights Under GDPR
As a data subject, you have the following rights under the GDPR. To exercise any right, please contact privacy@axiomanalysis.dk with proof of identity. We will respond within 30 calendar days.
- Right of access (Art. 15): Request a copy of the personal data we hold about you and information about how we use it.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion of your data where there is no overriding legal ground for continued processing ("right to be forgotten").
- Right to restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format (applies to data processed by automated means on the basis of consent or contract).
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes at any time.
- Right to withdraw consent (Art. 7(3)): Withdraw consent for any processing based on consent at any time, without affecting prior processing.
- Rights related to automated decision-making (Art. 22): Right not to be subject to solely automated decisions that produce legal or similarly significant effects. We do not conduct such processing.
You also have the right to lodge a complaint with the Danish data protection authority:
10. Security Measures
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- TLS 1.3 encryption for all data in transit between your browser and our servers.
- AES-256 encryption for sensitive data stored in our databases.
- Access controls with role-based permissions and multi-factor authentication for staff systems.
- Regular security audits and penetration testing by an independent third party.
- Employee data protection training conducted annually.
- Incident response procedures aligned with GDPR's 72-hour breach notification requirement (Art. 33).
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Art. 34 GDPR.
11. Children's Privacy
Our services are intended for adults and are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us immediately at privacy@axiomanalysis.dk and we will delete such data without delay.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. The "Last updated" date at the top of this page indicates when the most recent revision was made.
We will notify you of material changes by posting a notice on our website and, where appropriate, by sending an email to registered subscribers. Continued use of our services after any update constitutes acceptance of the revised policy.
Previous versions of this Privacy Policy are archived and available on request by contacting privacy@axiomanalysis.dk.
13. Contact & Data Protection Contact
For all matters relating to personal data and privacy, including exercising your rights, please contact:
Nørre Voldgade 84, 1358 Copenhagen K, Denmark
Email: dpo@axiomanalysis.dk
Phone: +45 70 83 29 17
Response time: Within 30 calendar days
We take privacy enquiries seriously and aim to resolve all concerns promptly. If you are unsatisfied with our response, you retain the right to escalate your complaint to Datatilsynet.