Privacy and cookie policy

1. Data controller

mondaybrew ApS is the controller of personal data processed on mondaybrew.dk and our other sites and landing pages, including digitalafdeling.mondaybrew.dk. This also applies when you contact us, book a meeting, respond to our ads, or when your company is our client.

mondaybrew ApS
Danish company registration no. 45 21 77 79
Vesterbrogade 74, 4th floor
1620 Copenhagen V, Denmark
kc@mondaybrew.dk
+45 42 21 10 65

2. Data we process

We may process:

• name, email, phone number, company and the information you enter in a form, such as a description of a task;
• information you provide in lead forms in our ads on Facebook and Instagram;
• information about meetings you book, such as time and meeting link;
• the page and campaign your enquiry came from, including UTM parameters and ad click IDs;
• technical information such as browser, device, IP address and consent choices;
• analytics and marketing data, if you have consented to those categories;
• when your company is a client: information about contact persons, invoicing and payment, and communication and tasks on the task board.

3. Purposes and legal bases

• Answering enquiries, booking and holding meetings and giving quotes: steps prior to entering into a contract and our legitimate interest in answering business enquiries (Article 6(1)(b) and (f)).
• Delivering and managing client agreements: performance of the contract and our legitimate interest in working with the client's contact persons (Article 6(1)(b) and (f)).
• Invoicing and bookkeeping: our legal obligation under the Danish Bookkeeping Act (Article 6(1)(c)).
• Analytics and ad measurement, including Google Analytics, Microsoft Clarity, Meta Pixel and Meta Conversions API: your consent (Article 6(1)(a)).
• Follow-up and marketing by email and text message: we only send marketing where the Danish Marketing Practices Act allows it, and you can always opt out. Reminders about booked meetings are not marketing.
• Operations, security and abuse prevention, such as spam filters and checks of contact details in forms: our legitimate interest (Article 6(1)(f)).

We do not use the data for decisions based solely on automated processing that have legal effects for you.

4. Recipients and service providers

We only share data when it is necessary for one of the purposes above. Our providers are:

• Vercel: hosting of our sites and our task tool;
• GoHighLevel/LeadConnector: CRM, booking calendar, and follow-up and reminders by email and text message;
• Google: Workspace for email, calendar and Google Meet, and Analytics and Ads for analytics and advertising;
• Microsoft: Clarity for heatmaps and recordings of how digitalafdeling.mondaybrew.dk is used;
• Meta: ads, lead forms and measurement via Pixel and Conversions API, where contact details are sent in hashed form;
• Anthropic and OpenAI: AI tools we use in our work, for example to prepare replies and tasks;
• our accounting system and bank for invoicing and payment.

We may also disclose data to advisers or authorities when required by law or when necessary to establish or defend a legal claim.

Some providers process data outside the EU/EEA, mainly in the United States. This is based on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

5. When we work in your company's systems

When we access personal data in a client's systems as part of a task, such as a CRM or a webshop, the client is the controller and we are the processor. That processing is governed by ourdata processing agreementwith the client (in Danish), not by this policy. Questions about such data should be sent to the company that is the controller.

6. Retention

• Enquiries and meetings that do not lead to an engagement are deleted no later than 3 years after the last contact.
• Information about client relationships is kept while the agreement runs and then for up to 3 years for documentation and possible claims.
• Accounting records are kept for 5 years from the end of the financial year they relate to.
• Your cookie choice is stored for up to one year.

A longer period may be necessary if a specific legal claim requires it. After that, we delete or anonymise the data.

7. Cookies and consent

Our sites use necessary cookies to remember your language and cookie choice. Analytics and marketing technology only loads after you select the matching categories in the consent banner. Each site has its own consent banner. You can withdraw your consent or choose again at any time.

On digitalafdeling.mondaybrew.dk we use Microsoft Clarity, with your analytics consent, to see how the page is used through heatmaps and recordings of clicks, scrolling and mouse movement. Form entries are masked and not recorded. Clarity sets cookies (_clck for up to one year and _clsk for one day). Microsoft keeps recordings for up to 30 days and aggregated statistics for up to 13 months, and may also use the data under theMicrosoft Privacy Statement.

8. Security

We protect the data with access control, encrypted connections and two-factor authentication where the services support it.

9. Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction or data portability and object to the processing. You can always withdraw consent without affecting the lawfulness of processing that has already taken place. We normally reply within one month.

Write to kc@mondaybrew.dk to exercise your rights or ask questions. You can also complain to the Danish Data Protection Agency.