Privacy policy
Last updated: 8th of July, 2026. This privacy policy applies to visitors of https://crossbord.dk.
It describes what personal data we process when you use the website, why we process it, and what rights you have.
1. Data controller
Crossbord ApS
CVR 35851046
Hobrovej 42D, 3rd floor 9000 Aalborg, Denmark
Email: hello@crossbord.dk
Phone: +45 98 16 05 05
2. What we process and why
2.1 Question and contact forms
When you submit a question or enquiry through a form on the website, we process your name, email address, and the content of your message.
- Purpose: to answer your enquiry and follow up on it.
- Legal basis: your consent (GDPR Article 6(1)(a)), given when you submit the form. If your enquiry leads to a client relationship, further processing is based on steps taken prior to entering into a contract (Article 6(1)(b)).
- Systems involved: form submissions are transferred via Make (workflow automation) to monday.com, where we manage enquiries. Email correspondence is handled in Microsoft 365.
- Retention: we retain enquiry data for 12 months after our last contact with you, unless the enquiry leads to a client relationship.
2.2 Meeting bookings
When you book a meeting through our booking page, Microsoft Bookings processes your name, email address, and the details you provide about the meeting.
- Purpose: to schedule and hold the meeting you requested.
- Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b)).
- Retention: booking details are retained as part of our correspondence for 12 months after our last contact, unless a client relationship is established.
2.3 Website security
To protect the website against abuse, we process technical data such as your IP address, browser information, and request logs.
- Purpose: detecting and blocking malicious traffic, spam, and automated abuse.
- Legal basis: our legitimate interest in keeping the website secure (Article 6(1)(f)).
- Systems involved: Wordfence (Defiant Inc.) for firewall and login protection, and Google reCAPTCHA for form abuse prevention. reCAPTCHA transfers data to Google; see section 4.
- Retention: security logs are retained for up to 30 days.
2.4 Website statistics
We use Google Analytics 4 (via Google Site Kit) to understand how the website is used.
- Purpose: aggregated statistics on page visits and traffic sources, used to improve the website.
- Legal basis: your consent (Article 6(1)(a)), given via the cookie banner. Statistics cookies are only set if you accept them.
- Retention: event data is retained for 2 months and user data for 14 months in Google Analytics, after which it is deleted automatically.
2.5 Embedded content
Some pages embed content from third parties, including YouTube videos and Google Maps. When you load a page with embedded content, the provider may process your IP address and set cookies, subject to your consent via the cookie banner. Fonts are hosted on our own server; no font requests are sent to third parties.
- Legal basis: consent for embedded content that sets cookies (Article 6(1)(a)).
2.6 Cookies
The website uses cookies for functional and statistical purposes. See our cookie policy for details and to manage your consent.
3. Data processors
We use the following processors to operate the website and handle enquiries:
| Processor | Purpose | Location |
|---|---|---|
| Microsoft (Microsoft 365, Bookings) | Email, scheduling | EU data centres; US transfers possible |
| Make (Celonis) | Workflow automation for form submissions | EU |
| monday.com | Enquiry management | Hosted on AWS in the United States |
| Defiant Inc. (Wordfence) | Website security | United States |
| Google Ireland Ltd (reCAPTCHA, Analytics, Tag Manager, Maps, YouTube) | Form abuse prevention, statistics, tag delivery, embedded content | EU; US transfers possible |
We have data processing agreements in place with all processors.
4. Transfers outside the EU/EEA
Some of our processors transfer personal data to the United States. These transfers are based on the EU-US Data Privacy Framework where the processor is certified, or on the European Commission’s Standard Contractual Clauses combined with supplementary measures where required.
5. Your rights
You have the right to:
- Access the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data, where no legal ground requires us to retain it.
- Restriction of processing in certain circumstances.
- Data portability for data you have provided to us.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, email us at hello@crossbord.dk. We respond within one month.
6. Complaints
If you are dissatisfied with how we handle your personal data, we would like to hear from you first. Write to us at hello@crossbord.dk. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.
7. Changes to this policy
We update this policy when our processing activities change. The date at the top reflects the latest revision.