SAFA Privacy & Cookies Policy

1. Data Controller and Contact Information

This Privacy & Cookies Policy explains how SAFA Team ApS collects, processes, and protects personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and the Danish Data Protection Act (Databeskyttelsesloven, Act No. 502 of 23 May 2018).

Data Controller: SAFA Team ApS

Central Business Register (CVR) No.: DK45137880

Address: Højbro Plads 10, 1200 København K, Denmark

General Inquiries & Privacy Contact: hello@safateam.com

Recruitment Contact: careers@safateam.com

2. Statutory Legal Bases for Processing

SAFA Team ApS processes personal data under the lawful bases set out in Article 6(1) of the GDPR:

Consent (Art. 6(1)(a) GDPR): Used when you grant explicit, affirmative consent for non-essential cookies, web analytics, interactive map tools, or optional communication channels.

Consent (Art. 6(1)(a) GDPR): Used when you grant explicit, affirmative consent for non-essential cookies, web analytics, or optional communication channels.

Contract Performance & Pre-Contractual Measures (Art. 6(1)(b) GDPR): Used to handle commercial inquiries, process "Book a Demo" requests, manage contact form submissions, and evaluate job applications.

Legal Obligations (Art. 6(1)(c) GDPR): Used where processing is required by EU or Danish national law, such as financial and accounting recordkeeping under the Danish Bookkeeping Act (Bogføringsloven).

Legitimate Interests (Art. 6(1)(f) GDPR): Used where necessary for legitimate business interests that are not overridden by individual fundamental rights, including securing web infrastructure, preventing abusive or malicious traffic, and providing map navigation.

2.1. Contractual and Statutory Obligations; Consequences of Non-Provision

SAFA Team ApS processes personal data subject to the following obligations and operational consequences:

Commercial Inquiries and Product Demonstrations: Providing your name, corporate email address, telephone number, and employer affiliation is a pre-contractual requirement under Article 6(1)(b) of the GDPR. If you do not provide this information, we will be unable to respond to your inquiry, evaluate your enterprise requirements, or schedule a product demonstration.

Candidate Applications: Providing identifying data, contact details, curriculum vitae, cover letters, and verified educational credentials is necessary to evaluate your suitability for employment. If this information is withheld, SAFA Team ApS cannot evaluate your candidacy, and your application will not be considered.

Corporate Accounting and Invoicing: Providing billing contacts, company identifiers, and fiscal billing data is a statutory obligation under Section 12 of the Danish Bookkeeping Act (Bogføringsloven, Act No. 700 of 24 May 2022). Failure to provide required invoicing data prevents the lawful execution of commercial transactions.

Technical Web Navigation: Providing technical metadata and server logging parameters is necessary to establish an HTTP connection with our hosting infrastructure. Where data collection relies on consent (such as analytics cookies under Article 6(1)(a) of the GDPR), withholding or revoking consent will not restrict your access to core website features.

3. Web Hosting Infrastructure

Our website is hosted using infrastructure provided by Vercel Inc., with server region hosting configured within Europe. When you visit our site, technical metadata and form interactions are processed on Vercel's European cloud infrastructure. Data handling is governed by a Data Processing Agreement (DPA) pursuant to Article 28 GDPR to guarantee data security, integrity, and compliance with EU data protection standards.

4. Server Log Files and Technical Metadata

When accessing our website, technical connection details transmitted by your browser are automatically recorded in server log files:

Timestamp and date of server access

Requested Uniform Resource Locator (URL) and referring address

HTTP response status code and volume of transmitted data

Web browser type, build, operating system, and user-agent string

Full Internet Protocol (IP) address of the connecting device

Purpose and Legal Ground: Logging is conducted to maintain server stability, prevent cyber attacks, and ensure network security under Art. 6(1)(f) GDPR. IP addresses and server log files are anonymized or deleted within seven (7) days, unless extended preservation is strictly necessary to investigate a specific security incident.

5. Terminal Storage, Cookies, Google Tag Manager, and Google Analytics

In accordance with the Danish Executive Order on Cookies (Cookiebekendtgørelsen, BEK nr. 1148 of 9 December 2011) and ePrivacy rules, storing or accessing data on terminal equipment is managed as follows:

Strictly Necessary Technical Mechanism: Technical session identifiers and security headers required for secure website operation do not require prior consent and operate under Art. 6(1)(f) GDPR and Section 3 of Cookiebekendtgørelsen.

Google Tag Manager (GTM): We utilize Google Tag Manager to deploy website scripts efficiently. GTM itself does not create user profiles or store tracking cookies; it functions as a script management tool that triggers secondary analytics tags.

Google Analytics (GA4): We use Google Analytics (provided by Google Ireland Limited) to analyze how visitors interact with our website. Google Analytics uses cookies to collect IP addresses (with active IP anonymization) and interaction statistics. GA4 scripts are initialized only if you provide explicit, prior consent via our cookie banner pursuant to Art. 6(1)(a) GDPR and Section 3 of Cookiebekendtgørelsen.

Consent Management: You may grant, adjust, or revoke your cookie consent at any time with prospective effect via the persistent cookie settings module in the website footer.

5.1. Detailed Terminal Cookie and Storage Schedule

The table below outlines all persistent and session storage identifiers deployed through this website:

6. Website Forms

When you submit inquiries through our contact form or request a product demonstration via our "Book a Demo" form, we process the personal information you supply (such as full name, corporate email address, telephone number, and message context) to address your request.

Google Maps Integration and Two-Click Consent Mechanism: Our contact and demo pages incorporate Google Maps (Google Ireland Limited) to display our physical office location. To protect terminal privacy, the interactive map remains inactive and blocked by default, showing only a static preview image. Technical connection data—including your IP address, browser metadata, and potential tracking cookies—is not transmitted to Google upon loading our contact pages. The interactive map and associated Google scripts are initialized only when you actively click the interactive map module, providing explicit consent pursuant to Article 6(1)(a) of the GDPR and Section 3 of the Danish Executive Order on Cookies (Cookiebekendtgørelsen). You may revoke this consent or hide the map at any time through our footer consent preferences.

7. Corporate Email Communication via Google

All enterprise email communication, including general correspondence sent to hello@safateam.com or form submissions, is managed through Google Workspace (Google Ireland Limited).

Email message content, sender addresses, timestamps, and attached documents are stored on Google’s enterprise cloud servers.

Where email data is processed or accessed outside the European Economic Area (EEA), transfers are protected by European Commission Standard Contractual Clauses (SCCs) and Google's Data Processing Addendum.

8. Applicant Privacy Policy

Job candidates submitting applications to careers@safateam.com are subject to the following processing terms:

Data Categories and Direct Ingestion: Full name, contact details, correspondence, CVs, cover letters, portfolios, educational history, and designated professional references provided directly by the applicant (processed under Art. 6(1)(b) of the GDPR, Art. 6(1)(f) of the GDPR, and Databeskyttelsesloven Section 12).

Indirect Collection and Professional Sources (Art. 14 GDPR): In evaluating candidate qualifications, SAFA Team ApS may review publicly available professional information posted on public business platforms (e.g., LinkedIn) under our legitimate interest in assessing applicant credentials (Art. 6(1)(f) of the GDPR and Databeskyttelsesloven Section 12). Furthermore, former employers and professional references will be contacted only after receiving candidate authorization.

Legal Ground: Processing candidate documents occurs under Art. 6(1)(b) GDPR (pre-contractual evaluation) and legitimate interests under Art. 6(1)(f) GDPR and Section 12 of Databeskyttelsesloven.

Danish Civil Registration Numbers (CPR Numbers): Applicants must not include CPR numbers (CPR-numre) in submitted CVs or emails. CPR numbers are requested solely upon formal employment onboarding for mandatory tax reporting to the Danish Tax Agency (SKAT) pursuant to Section 11(2)(1) of Databeskyttelsesloven and Art. 6(1)(c) of the GDPR.

Criminal Records Evaluation (Straffeattest): For positions involving sensitive access, candidates may be asked to present a private criminal record certificate (privat straffeattest) at the conditional offer stage. Where the certificate contains no entries (a clean record), processing occurs under our legitimate interest in maintaining organizational security pursuant to Art. 6(1)(f) of the GDPR. If the certificate contains entries regarding criminal offenses, processing by SAFA Team ApS is conducted exclusively with the candidate’s explicit consent pursuant to Section 8(3), 1st sentence, of Databeskyttelsesloven. The certificate is inspected by authorized personnel and destroyed immediately following verification.

Reference Verification: Former employers or third parties are contacted for references strictly after obtaining candidate authorization.

Data Retention Schedule: Candidate dossiers for unsuccessful applicants are retained for a default of six (6) months following the conclusion of the recruitment process to demonstrate compliance with Danish non-discrimination standards (Ligebehandlingsloven), after which all digital and physical files are permanently deleted. Retention beyond 6 months for future talent pools takes place only with consent under Art. 6(1)(a) GDPR.

9. Data Transfer to Third Parties and Processors

Personal data is not sold or disclosed to third parties without authorization. Data is shared strictly with vetted sub-processors bound by written Art. 28 GDPR Data Processing Agreements (such as Vercel for hosting infrastructure and Google for cloud workspace and analytics services) or where required by statutory legal mandates under Art. 6(1)(c) GDPR.

International Data Transfers and Inspection of Safeguards: Where personal data is transferred to or accessed by our cloud service providers (including Vercel Inc. and Google LLC) outside the European Economic Area (EEA), transfers operate pursuant to Chapter V of the GDPR:

Adequacy Decisions (Art. 45 GDPR): Transfers to Vercel Inc. and Google LLC located in the United States rely primarily on the European Commission’s Adequacy Decision for the EU-U.S. Data Privacy Framework (DPF). Both Vercel Inc. and Google LLC maintain active, verified certifications under the DPF.

Standard Contractual Clauses (Art. 46 GDPR): Where the DPF is inapplicable or where transfers occur to other non-adequate jurisdictions, data flows are secured under the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) accompanied by supplementary technical safeguards, including data encryption in transit and at rest.

Pursuant to Article 13(1)(f) of the GDPR, data subjects have the right to inspect or obtain a copy of the appropriate transfer safeguards and Data Processing Agreements implemented by SAFA Team ApS. To request documentation of these safeguards, please contact our privacy desk at hello@safateam.com.

10. Data Retention and Erasure Standards

Personal data is retained only for the duration necessary to satisfy the specific purpose of collection or as mandated by EU or Danish statutory retention laws:

Financial & Accounting Records: Commercial correspondence and transaction invoices are retained for five (5) full years following the end of the applicable financial year under Section 12 of the Danish Bookkeeping Act (Bogføringsloven, Act No. 700 of 24 May 2022).

General Inquiries: Email inquiries and form communications are deleted once the matter is fully resolved.

Recruitment Files: Applicant CVs and candidate dossiers are erased by default six (6) months after hiring decisions conclude.

Server Telemetry: Web server log files are anonymized or erased within three (3) months.

11. Your Rights as a Data Subject

Under Articles 15 through 22 of the GDPR, you possess the following rights regarding your personal data processed by SAFA Team ApS:

1. Right of Access (Art. 15 GDPR):

   Request confirmation of whether your data is processed and obtain a copy of held personal data.

2. Right to Rectification (Art. 16 GDPR):

   Require the prompt correction of inaccurate or incomplete personal records.

3. Right to Erasure (Art. 17 GDPR):

   Request the deletion of personal data when the processing ground no longer applies.

4. Right to Restriction of Processing (Art. 18 GDPR):

   Request the temporary suspension of processing under specific conditions.

5. Right to Data Portability (Art. 20 GDPR):

   Receive personal data provided to us in a structured, commonly used, machine-readable format.

6. Right to Object (Art. 21 GDPR):

   Object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR) or direct marketing.

7. Right to Withdraw Consent (Art. 7(3) GDPR):

   Withdraw granted consent at any time with prospective effect.

To exercise your statutory data subject rights, please email your request to hello@safateam.com.

Exercising Your Rights and Procedural Timelines (Art. 12 GDPR):

To exercise your rights under Articles 15 through 22 of the GDPR, submit your request to hello@safateam.com. We will handle your inquiry without undue delay and at the latest within one (1) calendar month of receipt, as mandated by Article 12(3) of the GDPR.

Where an inquiry is particularly complex or involves voluminous files, this period may be extended by up to two (2) additional months. If an extension applies, we will notify you of the delay and its underlying reasons within the initial one-month period.

Additionally, under Article 77 of the GDPR, you possess an unconditional right to lodge a formal complaint with the competent supervisory authority regarding our data practices, as detailed in Section 12 below.

12. Supervisory Authority and Complaint Options

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a competent supervisory authority. The competent supervisory authority for SAFA Team ApS is the Danish Data Protection Agency (Datatilsynet):

Datatilsynet

Carl Jacobsens Vej 35

2500 Valby

Denmark

Telephone: +45 33 19 32 00

Website: www.datatilsynet.dk

Email: dt@datatilsynet.dk

14. Automated Decision-Making

Automated individual decision-making or profiling pursuant to Article 22 GDPR is not conducted on this website.

15. Amendments to This Policy

We review and update this policy to reflect statutory developments and operational changes. The current version published on this page applies to your visit.

Policy Version: 2.0

Effective and Last Updated Date: 9 October 2026