Privacy Policy

1. Who is responsible for your data

The data controller is Stake rådgivning og invest ApS, Anpartsselskab (ApS) — Danish private limited company, registered in the Danish CVR register under number 43059955, EU VAT DK43059955, with its registered office at Kong Georgs Vej 38, 2000 Frederiksberg, Denmark. You can reach us at marketing@stakeradgivning.com.

We have not appointed a Data Protection Officer, because our processing does not meet the criteria in Article 37 GDPR. Data-protection questions go to the address above and are answered by the company.

2. What we collect, why, and on what legal basis

2.1 Executive consultation request form

The form appears on the home page, the three practice pages and the contact page. It is the same form everywhere and collects exactly the fields below and nothing else.

The six required fields rest on Article 6(1)(b) GDPR — processing necessary for steps taken at your request before entering into a contract. The business phone number is optional, so it cannot be “necessary” for that purpose: it rests instead on Article 6(1)(f), our legitimate interest in arranging the conversation by phone when you have asked for that by giving a number. You may object to it under Article 21 GDPR at any time and we will delete it.

We do not rely on consent for this form, and it has no consent tick-box: consent is not the basis for answering a business enquiry, and consent required as the price of sending one would not be freely given (Article 7(4) GDPR). The database has a consent_given column because the original data model specified one; it is always stored as 0 and nothing in this website relies on it. Each stored request records the lawful basis that applied and the version of the privacy notice shown beside the form (currently advisory-notice-2026-10-09).

2.2 General contact form

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in reading and answering correspondence addressed to the company. You may object under Article 21 GDPR.

2.3 Email

If you write to marketing@stakeradgivning.com, we process your address and message to answer you: Article 6(1)(b) GDPR where you are asking about our services, and otherwise Article 6(1)(f). The mailbox is hosted by Namecheap, Inc. (Private Email service) as our processor.

2.4 Anti-abuse and security

To stop automated abuse of the forms, we store a salted one-way hash of your IP address with a timestamp. The hash cannot be reversed to an address, and the address itself is never written to the database or to our application log. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in keeping the service available and free of abuse. You may object under Article 21. These records expire within a rolling window of minutes.

2.5 What we do not do

We do not sell personal data. We do not share it for anyone else’s advertising. We do not build profiles, and we carry out no automated decision-making within the meaning of Article 22 GDPR. We use no third-party analytics service, CRM, chat widget, social plug-in, content delivery network or externally hosted font. We do not ask for, and you should not send, information about any individual’s personal finances: our services are for companies.

3. Cookies and Microsoft Consent Mode v2

This site sets no advertising or analytics cookie before you consent. Microsoft Consent Mode v2 is initialised with ad_storage denied by default, before any tag could load, and only your acceptance changes that signal. Every cookie and storage item is listed in the Cookie Policy.

4. Who else sees your data

Your data is handled by Stake rådgivning og invest ApS and by Namecheap, Inc., which operates the server and the mailbox on our instruction under a data processing agreement meeting Article 28 GDPR. We use no other processor. Your data is not disclosed to third parties for their own purposes. If you consent to advertising measurement, Microsoft Ireland Operations Limited acts as an independent controller for the measurement data its UET tag collects; that is described in the Cookie Policy.

5. Hosting and international transfers

This website and its API run on a virtual server operated by Namecheap, Inc. in the United States. Everything you submit through the forms is stored in a database on that same machine. We identified the provider and country from the network registration and the network path of the server’s address on 2026-10-09; we state the country only, not a city, because public geolocation databases disagree about cities for this provider’s address ranges.

The United States is outside the European Economic Area, so storing your data there is a transfer to a third country under Chapter V of the GDPR. We do not rely on the EU-U.S. Data Privacy Framework for it. The transfer rests on Article 46(2)(c) GDPR: the Standard Contractual Clauses adopted by the European Commission, which are incorporated in the hosting provider’s Data Processing Addendum. The server is administered by us; the provider supplies the machine and the network, not access to the database. You may ask us for a copy of the safeguards at the address in section 1.

We do not describe this website as EU-hosted or EEA-hosted, because the machine serving it is in the United States. The company itself, Stake rådgivning og invest ApS, is registered and established in Denmark.

6. How long we keep it

• Consultation requests: 12 months from receipt, unless the request leads to a contract, in which case the correspondence becomes part of the engagement file.
• General messages: 12 months from receipt.
• Rate-limiting hashes: a rolling window measured in minutes.
• Your cookie choice: stored in your own browser until you clear it or change it.

Each stored record carries the date on which it must be deleted, and a scheduled job on the server removes expired records daily. Records that the Danish Bookkeeping Act (bogføringsloven) requires us to keep — for example invoices for an engagement — are kept for the period that law sets and for no other purpose.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15);
• have inaccurate data corrected (Article 16);
• have data erased (Article 17);
• restrict processing (Article 18);
• receive your data in a portable format (Article 20);
• object at any time to processing based on our legitimate interests (Article 21);
• withdraw any consent you have given, without affecting processing already carried out.

Write to marketing@stakeradgivning.com or use the contact form with the topic “Data-protection request”. We answer within one month, as Article 12(3) GDPR requires, and tell you if we need the extension that article allows. You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, or to the supervisory authority of the EU country where you live or work.

8. Security

The site is served over HTTPS with HSTS. Form submissions are protected by a double-submit CSRF token and rate limiting. The database listens only on the server’s loopback interface. Access to submitted data is limited to the people at Stake rådgivning og invest ApS who need it to answer you. The application log records that a submission happened — never its contents.

9. Children

This is a business-to-business website. It is not directed at children, and we do not knowingly collect personal data from anyone under 15. If you believe a child has sent us data, write to us and we will delete it.

10. Changes

If this policy changes materially, the revised version is published here with a new review date, and the notice beside each form carries its own version identifier so you can tell which text applied when you submitted.