Privacy policy

This is a translation for convenience. The Danish version is the legally binding one: Privatlivspolitik. In case of any discrepancy, the Danish text prevails.

Last updated: 24 September 2026

This policy describes how NVA-DESIGNS v/ Nicklas Andreasen (hereinafter “I”) processes personal data when you visit this website or contact me.

Data controller

NVA-DESIGNS v/ Nicklas Andreasen
CVR (the Danish business registration number): 46755197
Address: Orionvej 87, 4700 Næstved
Email: information@nva-designs.dk
Telephone: 28 29 22 83

What data I process

When you visit the site: technical data such as IP address, browser type and time. It is recorded in server logs when the page is served.
When you write through the form or by email: name, company name, email, telephone number, type of assignment and the message.
When you ask for a meeting: name, company name, email, telephone number, meeting type, requested day and time and any message.
When a meeting is held online: name and possibly email, what is said and shown during the meeting, and technical data such as the IP address. They are processed by the video-meeting provider.

If you say no in the banner, or if you have not answered yet, the site sets no cookies and loads no scripts or fonts from other domains. If you say yes, Google's tag is loaded, and it sets cookies — see “Statistics and ads”.

You are under no obligation to provide the data. Without a name and an email address, the form cannot be sent. A meeting request also requires a telephone number, meeting type, day and time.

Why I process them

The legal basis is stated with each purpose and refers to Article 6(1) of the General Data Protection Regulation.

Server logs are used to serve the site and keep it secure. Point (f): legitimate interest in operating the site securely.
Enquiries and meeting requests are used to answer you, to arrange and hold a meeting and possibly to enter into and perform an agreement with you. Point (b): contract. Point (f): legitimate interest in answering enquiries.
Correspondence about an agreement is kept after the agreement so that it can be documented. Point (f): legitimate interest in the establishment, exercise or defence of legal claims.
Accounting records are kept when we have entered into an agreement, because bogføringsloven (the Danish Bookkeeping Act) requires it. Point (c): legal obligation.

Who receives them

The data is not sold. These providers process it on my behalf:

The hosting provider serves the site, keeps server logs and passes the content of the form on to my mailbox.
The email provider holds the mailbox where enquiries are kept.

The hosting provider also uses traffic data such as the IP address for its own purposes such as operation and security and is itself a data controller for that part.

The video-meeting provider runs online meetings. I am the data controller for the meeting I hold with you, and the provider is itself a data controller for what is processed in its service. Under its own privacy policy it also uses the data for its own purposes such as operating, securing and developing the service, and it decides for itself how long the data is kept. You can ask me which provider it is.

The hosting provider, the video-meeting provider and Google belong to groups headquartered in the USA, so the data may be processed there. The transfer takes place on the basis of the adequacy decision for the USA under Article 45 of the General Data Protection Regulation. The decision applies to certified companies, and all three are certified.

How long I keep them

Server logs that I have access to are kept for a maximum of 30 days.
Enquiries and meeting requests that do not lead to an agreement are deleted after 12 months at the latest.
Agreements: the correspondence is kept for as long as claims can be raised under the agreement, and accounting records for 5 years from the end of the financial year to which they relate.

Statistics and ads

If you accept in the banner, the site counts visits with a statistics function at the hosting provider, and it measures which ads lead to an enquiry. When the site measures with Google Analytics, it also measures the visit there. None of them are loaded before you have answered, and if you say no, none of them are loaded. One yes applies to all of them, and one no applies to all of them.

The statistics

What is recorded: the page view and the time, the address of the page, the page you came from, approximate location (country, region and city), browser, operating system and device type.
Anonymous and aggregated: the data is not linked to you or to your IP address, and I see it only as aggregated figures. Visits are distinguished by a code that is generated from the request and discarded after 24 hours. No cookies are used.
Legal basis: your consent, cf. Article 6(1), point (a). You can withdraw it at any time with the “Statistics and ads” link at the bottom of the page. The statistics are then not loaded from the next page view onwards. This does not affect the lawfulness of the processing before the withdrawal.
Recipient: the hosting provider, which processes the statistics on my behalf. The transfer to the USA is described under “Who receives them”.
Storage: the statistics can be viewed for 12 months. The provider states that data may be stored for longer, but not for how long.

Google Analytics

When the site measures with Google Analytics, it measures the visit in addition to the counting above, so that I can see which pages are read and where people drop off. It is not loaded until you have said yes, and it sets cookies.

What is recorded: which pages you view and when, the page you came from, how long you stay, approximate location based on the IP address, browser, operating system, device type and language. The IP address is not stored — it is used to derive the location and is discarded.
Cookies: cookies are set in your browser that recognise your browser again across page views and visits, so that two page views can be counted as one visit. They expire by themselves, and you can delete them in the browser at any time.
Legal basis: your consent, cf. Article 6(1), point (a). You can withdraw it at any time with the “Statistics and ads” link at the bottom of the page. The measurement then stops using cookies immediately, and from the next page view it is not loaded. This does not affect the lawfulness of the processing before the withdrawal.
Recipient: Google, which processes the measurement on my behalf. The transfer to the USA is described under “Who receives them”.
Storage: the measurement can be viewed for 14 months. Aggregated figures for visits and page views remain in the reports after that.

The ad measurement

I advertise on Google. In order to be able to see which ads work, Google's ad tag is loaded when you have said yes. It sets cookies; the hosting provider's statistics above do not.

What is recorded: that you have visited the site, which page you entered on, and whether you send a form (a message or a meeting request) or tap the telephone number. If you have clicked on an ad, the visit is linked to that click.
Cookies: the tag sets a cookie in your browser that recognises your click on the ad again, and it can read Google's own cookies if your browser allows them. They expire by themselves, and you can delete them in the browser at any time.
Legal basis: your consent, cf. Article 6(1), point (a). You can withdraw it at any time with the “Statistics and ads” link at the bottom of the page. The tag then stops using cookies immediately, and from the next page view it is not loaded. This does not affect the lawfulness of the processing before the withdrawal.
Recipient: Google, which is an independent data controller for what the tag sends. The transfer to the USA is described under “Who receives them”. What Google itself uses the data for is set out in Google's own privacy policy.
Storage: Google determines for how long. I see only aggregated figures for how many enquiries an ad has produced — not who was behind them.

Your choice is stored in your browser. It is not a cookie and is not sent anywhere. If your browser sends a signal that you opt out of tracking, it is treated as a refusal.

Each cookie and each item in the browser's storage is listed with its name, provider and duration in the cookie policy.

Your rights

You have the right of access to, rectification of and erasure of your data, the right to restriction of processing, the right to data portability and the right to object. Write to me to exercise them.

If you are dissatisfied with how I process your data, you can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

Right to object

If I process your data on the basis of a legitimate interest, you can object to the processing at any time. That applies to server logs, enquiries, meeting requests and correspondence about an agreement. Write to me.

When I build and maintain your website

If I build a website for you, the data in it is yours: you are the data controller, I am the data processor, and I process it only on your instructions, when I have access to the site.

Domain, web hosting, SSL and email are your own subscriptions with a provider of your choice, cf. clause 9a of the terms and conditions. The agreement with the provider is yours, including as regards the data held on its servers.