Crediwire ApS is the controller for the processing described in this notice where we determine the purposes and means, including our own customer and user administration, enquiries, recruitment and website activities.
When we process personal data on behalf of a customer under its instructions, that customer is the controller and our processing is governed by the applicable data processing agreement. This includes customer financial records, uploaded documents and analyses processed under those instructions. Please consult the relevant customer's privacy information for that processing. We assist customers with privacy requests concerning their data.
Crediwire ApS
Gothersgade 14, 4. sal
1123 København K, Denmark
CVR no.: 37264628
Telephone: +45 91 54 09 65
Email: info@crediwire.com
You can send privacy questions and requests to info@crediwire.com.
We process the name, email address, telephone number and message information you provide so that we can answer your enquiry and follow up on it. Our legal basis is our legitimate interest in responding to people who contact us, under Article 6(1)(f) of the GDPR.
We receive this information directly from you. Please provide a way for us to reply and enough information to understand your enquiry. Additional contact details are optional unless the relevant form or request states otherwise. Without the necessary information, we may be unable to answer.
We retain ordinary enquiry records for three months from receipt or until the correspondence ends, whichever is later. If the enquiry becomes part of a customer relationship, a recruitment process or a specific dispute, the relevant retention rules below apply to the records needed for that purpose.
We process information you provide in your application and recruitment communications, such as your name, contact details, CV, qualifications, experience and interview information. We may also receive a date of birth or other information you include in your application. Please avoid providing information that is unnecessary for assessing your suitability.
We use the information to assess applications, communicate with applicants and take steps at their request before entering an employment contract, under Article 6(1)(b) of the GDPR. Where necessary to establish, exercise or defend a specific legal claim, we rely on our legitimate interest under Article 6(1)(f). Necessary information about your qualifications and experience is required for us to assess an application; other information is voluntary unless we explain a specific requirement.
Unsuccessful application records are deleted no later than six months after the recruitment process ends. With your separate, voluntary consent, we may retain an application for future opportunities for the period stated when we request that consent, under Article 6(1)(a). You can withdraw that consent at any time. Specified records may be retained longer where a particular legal obligation or unresolved claim requires or justifies this; this does not extend retention of the entire application file automatically. For successful applicants, necessary records are transferred to the employee file and covered by our employee privacy information.
We process business contact details, company and CVR identifiers, information about your role and our communications, and details needed to administer a prospective or existing commercial relationship. This may include contract information, prices, invoices, payment details and financial information about sole traders.
We receive information from you, your employer or another authorised business contact, and relevant public business sources, such as company websites and the Danish Central Business Register (CVR). Required company, contact and billing details enable us to administer the relationship and fulfil legal duties; without them, we may be unable to enter into or perform the agreement. Consent to marketing is optional and is not a condition of using the service.
We retain ordinary contact and administration information while needed for the relationship, then review and delete information whose purpose has ended. We review inactive prospect records at least annually and delete them after 12 months without meaningful business contact, unless a specific later follow-up has been agreed. An agreed follow-up does not justify indefinite retention: we review the record when it takes place or is cancelled.
Bookkeeping records are retained for five years from the end of the financial year to which each record relates. This period does not apply automatically to every contact, profile or communication. Relevant contract and dispute records may be retained for the period necessary to establish, exercise or defend a specific claim, under Article 6(1)(f), or to meet a legal duty under Article 6(1)(c).
For our own user and service administration, we process names, email addresses, telephone numbers where supplied, workplace and role information, login details and relevant account, support and activity information. We use this to administer access, protect the service, provide support and communicate relevant service information.
For users appointed by a company, our legal basis is our legitimate interest in administering and securing the service and supporting authorised users, under Article 6(1)(f). Article 6(1)(b) applies only where the user personally is party to the relevant contract and the processing is necessary for it. Data processed solely on a customer's instructions remains subject to the distinction in section 1.
We obtain information from you, the company or administrator inviting or managing your account, your interactions with the service and related technical records. Information needed to identify and authenticate you and establish your authorised access is necessary to provide an account. Optional profile or contact information is voluntary unless otherwise indicated.
We retain account information while your account exists. When the account is deleted, the associated account data is removed at the same time; remaining backup copies expire within a maximum of 30 days after the deletion request. This does not erase records retained lawfully for a separate purpose, such as bookkeeping or a particular claim, or customer-controlled service data governed by the customer's instructions and the data processing agreement. Backup copies remain protected during their remaining retention period.
You may unsubscribe from marketing using the link in a message or by contacting us. We stop using your information for direct marketing when you withdraw marketing permission or object. We delete information held solely for marketing when it is no longer needed. We retain evidence of the consent and its withdrawal for two years after withdrawal to document compliance. We may retain minimal suppression information to respect your choice and avoid contacting you again.
When you visit our website, technical information may include your IP address, browser and device information, pages requested and interaction information. We use necessary technical information to deliver and protect the website, under our legitimate interest in operating a reliable and secure website, Article 6(1)(f).
Cookies and similar technologies that are strictly necessary to provide a service you request do not require cookie consent. Optional preference, statistics and marketing technologies require consent where applicable. For personal data processed through those optional technologies, we rely on your consent under Article 6(1)(a). A cookie is not treated as strictly necessary merely because it offers a useful function.
The Cookie Policy and cookie settings provide the applicable cookie purposes, providers, durations and choices. You can change or withdraw your optional cookie choices through the cookie settings. Refusing optional cookies does not prevent use of the basic website, although features depending on them may not be available. The retention of cookie-related information depends on the technology and purpose described in that information.
Where an optional third-party feature sends personal data to its provider, the information for that feature explains the recipient, purpose and relevant responsibilities. Cookie consent does not by itself determine whether a provider acts as a processor, independent controller or joint controller.
We restrict access to people who need the information for their work. We use service providers to support the activities described above, including IT hosting, business email and collaboration, email delivery and customer communication. The relevant providers depend on the activity: an applicant's information is not automatically disclosed to every provider used elsewhere in the business.
Providers processing personal data on our behalf are subject to applicable processing agreements and instructions. A supplier may act separately as controller for its own account administration, billing or other purposes described in its own privacy information. The supplier arrangements for customer data processed on instructions are set out separately in the customer data processing agreement; they do not automatically define the recipients of every activity covered by this notice.
We may disclose information to public authorities where required by law, under Article 6(1)(c). We may share necessary information with lawyers, auditors and other professional advisors where needed for legal obligations or our legitimate interest in obtaining professional advice, documenting compliance or handling legal claims, under Article 6(1)(c) or 6(1)(f), as applicable.
Some providers and their affiliates or service providers process information outside the EU/EEA, including through international support access. An Irish supplier or European hosting location does not itself mean that all processing stays in the EU/EEA.
We rely on adequacy decisions only within their scope. Reliance on the EU–US Data Privacy Framework requires a valid certification covering the relevant US recipient and transfer. Where no applicable adequacy decision covers a transfer, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses adopted under Decision (EU) 2021/914 and any supplementary measures required for the circumstances.
Contact info@crediwire.com for information about the recipients, processing and access countries and transfer mechanisms relevant to your information, and to obtain a copy of the applicable safeguards, subject to necessary redactions.
For the activities covered by this notice, we do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. AI-assisted extraction and summaries produced on customer instructions are part of the customer service processing described in section 1; they do not replace the customer's responsibility for its own decisions and privacy information.
Subject to the applicable conditions and exceptions, you may request access to your personal data, correction of inaccurate or incomplete information, erasure, restriction of processing, and portability of qualifying data in a structured, commonly used and machine-readable format.
You may object to processing based on legitimate interests because of your particular situation. You may object to direct marketing at any time, including associated profiling, and we will stop processing your information for that purpose.
Where we rely on GDPR consent, including for optional cookies or retaining an application for future opportunities, you may withdraw it at any time using the method provided when we request consent or by contacting us. Marketing permission can be withdrawn using the unsubscribe link or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We stop the consent-based use; information may still be retained where another applicable basis permits or requires it for a separate purpose.
Send requests to info@crediwire.com. We may request proportionate information to verify your identity. We respond without undue delay and within one month. Where a permitted extension of up to two further months is necessary because of the complexity or number of requests, we explain the reason within the first month.
If a request concerns data we process on behalf of a customer, we will assist in directing it to the relevant customer controller and assist that customer under the data processing agreement.
You may complain directly to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark. See www.datatilsynet.dk for information and contact options. You do not need to contact Crediwire before complaining. You may also complain to another competent supervisory authority, in particular in the country of your habitual residence, workplace or the alleged infringement.
.svg)
