Privacy policy

1. Introduction

This privacy policy explains how we collect, use and protect your personal data when you use our website. We are committed to the confidentiality and security of your personal data under the General Data Protection Regulation (GDPR) and other applicable data protection law.

2. Data controller

We are inciro K/S, based in Denmark. As data controller, we are responsible for the processing of your personal data.

3. Personal data we collect

We collect personal data in three places on our website: the contact form, the customer onboarding form and inciro AI. Each is described in more detail further down this page.

4. How we use your personal data

We use data from the contact form solely to:

• Respond to your enquiries and your communication with us
• Keep records of our communication

The legal basis for this processing is your consent (Article 6(1)(a)) combined with our legitimate interest in responding to enquiries (Article 6(1)(f)). The legal basis for the customer onboarding form and for inciro AI is described in their own sections below, because the purposes differ.

5. Data retention

We keep contact form enquiries that do not lead to a customer relationship for 12 months. If an enquiry leads to a customer relationship, we keep it for 5 years under the Danish bookkeeping act. We keep submissions through the customer onboarding form for 5 years under the same rule. You may request deletion of your personal data at any time, subject to the retention obligations of the bookkeeping act.

6. inciro AI

When you use inciro AI, we send your message text to Cloudflare Workers AI to generate a reply. Your replies are not stored: the message text is never written to any database or storage on our side.

What we do store is a SHA-256 hash of your IP address plus numeric rate-limit counters, in Cloudflare Workers KV, for at most 48 hours. Your raw IP address is never stored. A hashed identifier that can be used to recognise a user is still personal data under GDPR, so we disclose it explicitly rather than omitting it.

The legal basis is Article 6(1)(f), legitimate interests: operating and securing a free advisory tool you have chosen to use, including preventing abuse. No consent or cookie banner is required for this.

7. Customer onboarding

When you complete the customer onboarding form, we collect the company's VAT number, name, address, postcode, city, phone number, email and invoice email; the legally authorised signatory's full name, job title, email and phone number; and, where relevant, a daily contact person with the same four fields.

The legal basis is Article 6(1)(b) for steps taken at your request prior to entering into an agreement, since the form prepares a framework agreement, combined with Article 6(1)(c), legal obligation, for the 5-year retention under the Danish bookkeeping act.

The submission is sent through Brevo and received in our Microsoft 365 environment, in a Teams channel and a shared mailbox.

8. Customer data

Once a framework agreement is in place, we process customer data in the following systems:

• Microsoft 365 – our working environment.
• Visma e-conomic – invoicing and bookkeeping. This is where the 5-year retention period above applies.
• Cloud Factory – a Microsoft cloud indirect provider (distributor) with a Danish presence, which we use for customers who purchase licence subscriptions. Cloud Factory receives limited customer data, only what is necessary to assign Microsoft 365 services.

All three are based in the EU/Denmark. See their respective privacy policies for their current position.

9. Third-party providers

We use the following third-party providers to process your data:

10. Cookies

We use minimal cookies necessary for the functioning of the website:

We do not use tracking or marketing cookies on our website.

11. Your rights

Under GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate personal data
• Right to erasure ("the right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise any of these rights, you can contact us through the contact form on our website.

12. Data security

We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Data encryption
• Regular security assessments
• Access control
• Data processors chosen with EU data residency, see the international data transfers section

13. International data transfers

inciro operates no datacentres of its own and chooses data processors that offer EU data residency. Brevo and Microsoft 365 process data in the EU. Cloudflare runs the website on a global edge network, so a request may be answered from the location nearest to you; see Cloudflare's own documentation on data localisation for details.

14. Changes to this privacy policy

We reserve the right to update this privacy policy from time to time. Any change is published on this page with an updated revision date.

15. Supervisory authority

You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

• Datatilsynet
• Carl Jacobsens Vej 35
• 2500 Valby, Denmark
• Phone: +45 33 19 32 00
• Email: dt@datatilsynet.dk
• Website: www.datatilsynet.dk

16. Contact us

If you have questions about this privacy policy or our data processing, please contact us via:

• The contact form on our website
• Address: Borupvang 3, 2750 Ballerup, Denmark

Data protection commitment

inciro operates no datacentres of its own. Instead, we choose data processors that offer EU data residency: Brevo and Microsoft 365 process data in the EU, while Cloudflare runs a global edge network and may answer a request from the location nearest to you. This approach supports compliance with the General Data Protection Regulation (GDPR).

Information about our data processors is based on their own documentation as of 14 August 2026.