Personal data
Privacy policy
This page explains what personal data Klarity Consulting processes, why, how long we keep it, and what rights you have.
Last updated 7 October 2026.
Data controller
Klarity Consulting is the data controller for the personal data described here. When we work with a client's own data, we act as the client's processor under a data processing agreement.
- Business
- Klarity Consulting · CVR 42228184 · 8641 Sorring
- [email protected]
What we process
- When you write through the contact form: name, organisation, email, phone (optional), your message, and how you heard about us.
- When we work together: names, roles and contact details of the client's contact persons.
- During an engagement: notes from meetings and workshops and — when agreed — recordings and transcripts.
- For billing: registered time, agreements and time specifications.
- Technical data: server logs (IP address, time, page) kept briefly to keep the site secure and stable.
Why we process it
- To reply to your enquiry and arrange an intro call.
- To plan and deliver the agreed engagement.
- To invoice and to comply with the Danish Bookkeeping Act.
- To improve our methods — only with anonymised, aggregated data that cannot be traced back to you or your organisation.
Legal basis
- Preparing and performing an agreement with you or your organisation (GDPR Art. 6(1)(b)).
- Legal obligation, for example the Danish Bookkeeping Act (Art. 6(1)(c)).
- Legitimate interest in answering enquiries, managing client relationships and keeping the site secure (Art. 6(1)(f)).
- When we process a client's data for the client, we do so on the client's instructions under a data processing agreement (Art. 28).
How long we keep it
- Contact details and correspondence: reviewed 5 years after the latest activity.
- Meeting recordings and transcripts: reviewed 3 years after the engagement ends.
- Accounting material — signed agreements and data processing agreements, time specifications and emails that document agreed terms: at least 5 years from the end of the financial year they relate to (Danish Bookkeeping Act, section 12(1)).
- Our own methods and anonymised experience are kept without time limit, as they contain no personal data.
At a review we delete or anonymise the data unless there is still a legitimate purpose. Nothing is deleted automatically without an assessment.
Professional network
We keep information about people we know professionally: name, workplace and title, work email, phone and LinkedIn link, how we know each other, and notes on professional interests. The information comes from you or from our own contact list.
- The purpose is to keep in touch with our professional network and know who might benefit from our services.
- The basis is legitimate interest (GDPR Art. 6(1)(f)). We keep no sensitive data and nothing about private life.
- The information is reviewed five years after the last contact; we then decide to delete it, anonymise it or keep it with a reason.
- You can object at any time. We will then not contact you again and keep only what is needed to honour your wish. You can also see or have deleted everything we hold about you.
Processors
We use the following providers to process personal data on our behalf. The list is updated automatically from our register. We only use services we have a data processing agreement with, and choose settings with no training on data where possible.
| Provider | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Resend | Sending email (sign-in links, messages to clients) | Name, email address, message content | USA (AWS us-east-1) | EU-US Data Privacy Framework + SCCs |
| Anthropic (Claude) | Language model (meeting notes, summaries, writing assistant) | Meeting content, document text | USA | EU-US Data Privacy Framework + SCCs (Anthropic commercial terms + DPA) |
| Fellow | Meeting transcripts and meeting notes | Names, meeting content | Canada / USA | EU adequacy (Canada) / SCCs (Fellow terms + DPA) |
| OpenAI (transcription) | Transcription of meeting recordings (audio → text) | Voice, meeting content | USA | EU-US Data Privacy Framework + SCCs (OpenAI API terms + DPA) |
| pCloud (encrypted backup) | Encrypted off-site backup (disaster recovery of database and files) | Encrypted data only — file names and contents are encrypted before upload, pCloud does not hold the key | EU (Luxembourg data centre, EU API endpoint; provider pCloud AG, Switzerland) | EU storage; Switzerland has an EU adequacy decision |
Your rights
Under the GDPR you have the right to:
- Access the data we hold about you.
- Have inaccurate data corrected.
- Have data erased when we no longer have a legitimate purpose or a duty to keep it.
- Have the processing restricted.
- Receive your data in a common format (data portability).
- Object to processing based on legitimate interest.
Write to [email protected]. We reply within one month.
Complaints
If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. Please write to us first so we can put it right.
Cookies
The website uses no cookies and no analytics or tracking tools, so there is no cookie banner. All files — fonts included — are served from our own server.