Controller
Ectocsitol Barbershop Design Studio ApS, Nørrebrogade 127, 2200 København N, Denmark. CVR 38294761. Contact [email protected]. Processing under GDPR and Danish Data Protection Act supplemented by EU ePrivacy rules on storage access localStorage consent banner implements for transparency exceeding strict necessity for essential storage alone.
Data Collected
Name, email, phone, business name, project address, lease documentation you share, and correspondence. Website server logs ninety days. No advertising profiles. No sale of data. Project photography of completed shops only with written operator consent specifying usage scope commercial publication portfolio versus internal archive only distinction respected per consent form checkbox operator signs separate from design contract though often simultaneous signing during contract meeting convenience.
Legal Bases
Contract Article six one b for design services. Legitimate interest for enquiry response and invoice recovery. Consent for portfolio photography and non-essential storage ectocsitol_design_consent localStorage key. Consent withdrawable anytime via email without affecting lawful prior processing or completed project archive obligations statutory retention imposes ten years Danish bookkeeping law compliance.
Rights
Access, rectification, erasure, restriction, portability, objection contact [email protected] thirty-day response. Complaint Datatilsynet Carl Jacobsens Vej 35 2500 Valby. Erasure limited by accounting retention and professional indemnity limitation periods requiring project correspondence retention until expiry plus safety margin legal counsel advised studio adopts seven-year correspondence ten-year financial conservative approach documented internal retention schedule staff trained annually privacy refresher mandatory since two thousand eighteen Datatilsynet guidance update.
Processors
EU hosting, email, accounting under Article twenty-eight agreements. No transfers outside EEA. Subconsultants lighting acoustic receive project data under confidentiality agreements deleted at project completion except aggregated anonymised learnings internal training use not identifiable operator data mixed into training materials without explicit consent for case study educational publication separate consent if ever sought future not current practice as of policy revision date eight July two thousand twenty-six stated explicitly for forward transparency should practice evolve with prior banner update commitment.