Privacy Policy

2. Scope

This policy explains how we process personal data when you visit our website, search the site, contact us, request a proposal or strategy call, become or represent a client or supplier, apply for a role, subscribe to communications, or interact with our hospitality, website, growth, AI, automation and consulting services.

3. Personal data we collect

Data you provide

• Identity and contact data, such as name, company, job title, email address and telephone number.

• Enquiry and communication data, including business needs, correspondence, meeting notes and support requests.

• Commercial and transaction data, including proposals, contracts, billing contacts, invoices and payment status.

• Project data, including website content, brand assets, access details, feedback, business objectives, technical documentation and hospitality operational information.

• Recruitment data, including CV, cover letter, employment history, qualifications, references, portfolio, interview notes and availability.

• Marketing preferences and consent records.

Data collected automatically

Depending on the website configuration and your consent choices, we may collect IP address, device and browser information, operating system, approximate location derived from IP, timestamps, referring page, pages viewed, interactions, performance logs, consent records and identifiers stored or accessed through cookies or similar technologies.

Data from other sources

We may receive business contact data from your employer, colleagues, referral partners, public professional sources, clients, suppliers or recruitment references. Where Article 14 GDPR applies, we provide the required information within the applicable period unless an exemption lawfully applies.

Please do not send special-category data, national identification numbers, criminal-offence information or other highly sensitive material unless specifically requested and a lawful basis and secure channel have been confirmed.

4. Purposes, data and legal bases

Purpose and data

Legal basis

Typical retention

Respond to enquiries, arrange calls and prepare proposals; contact and communication data.

GDPR Art. 6(1)(b), steps before a contract; Art. 6(1)(f), legitimate interest in business communication.

Normally up to 24 months after the last meaningful contact, unless a contract or dispute requires longer.

Enter into and deliver services; identity, contract, project and communication data.

Art. 6(1)(b), contract; Art. 6(1)(f), managing B2B relationships and service quality.

Contract term plus normally 5 years for claims and documentation, adjusted to applicable limitation periods.

Invoices, accounting and tax compliance; identity, billing and transaction data.

Art. 6(1)(c), legal obligation.

Five years from the end of the financial year to which the accounting material relates, unless law requires longer.

Operate, secure and diagnose the website; IP, device, logs and essential identifiers.

Art. 6(1)(f), security and reliable operation; Art. 6(1)(c) where legally required.

Security logs normally 6–12 months unless an incident requires longer.

Analytics and non-essential cookies; usage and identifier data.

Art. 6(1)(a), consent, together with Danish cookie rules.

According to the cookie declaration and until consent withdrawal; identifiers expire as listed there.

Direct electronic marketing; contact and preference data.

Art. 6(1)(a), consent, or another basis only where Danish marketing law permits.

Until withdrawal/objection; suppression record retained as necessary to honour the choice.

Recruitment; application, interview and reference data.

Art. 6(1)(b), pre-contract steps; Art. 6(1)(f), recruitment; consent only where genuinely optional, such as a future-candidate pool.

Unsuccessful applications normally up to 6 months after the process; longer only with specific consent or legal need.

Establish, exercise or defend legal claims; relevant records.

Art. 6(1)(f), legal claims; Art. 9(2)(f) if special-category data are necessary.

For the applicable limitation/dispute period.

AI-assisted service delivery; project and communication data limited to what is necessary.

The same basis as the underlying service, usually Art. 6(1)(b) or (f); consent where specifically required.

According to the underlying purpose and the agreed service/data-processing terms.

Our legitimate interests include answering business communications, delivering and improving services, maintaining business relationships, preventing misuse, securing systems and establishing legal claims. We balance those interests against the individual’s rights and reasonable expectations. You may object as described below.

5. Website materials and artificial intelligence

Unless expressly stated otherwise, website text, imagery, graphics, layouts, concepts, examples, mock-ups, demo websites, case scenarios and journal materials have been generated or materially assisted by generative AI and then selected, edited or reviewed by NEVES. This disclosure concerns how content was created; it does not by itself mean personal data were used to create it.

Where AI tools process personal data for a client project, we minimise the data, apply the lawful basis for the underlying purpose, assess provider terms and transfer mechanisms, use appropriate contractual safeguards and apply human oversight. We do not knowingly use confidential client information or personal data to train public AI models without explicit written permission and an appropriate lawful basis.

NEVES does not make decisions producing legal or similarly significant effects about website visitors, applicants or client personnel solely by automated means. If this changes, we will provide the information and safeguards required by Articles 13–14 and 22 GDPR and applicable AI law.

6. Cookies and similar technologies

We use strictly necessary technologies to deliver and secure the website. Analytics, marketing, personalisation or other non-essential technologies are used only after valid consent where required. You can accept, reject or choose purposes through the consent interface and can withdraw or change consent at any time through a persistent “Cookie settings” link or icon.

A separate cookie declaration must identify each active technology and provider, purpose, data type, duration and whether data are shared or transferred. The declaration must be generated from the live configuration and kept current. Browser controls may delete cookies, but they are not a substitute for an accessible website consent control.

7. Recipients and service providers

We disclose personal data only as necessary to personnel, contractors, advisers, banks, auditors, insurers, public authorities and service providers that support hosting, email, productivity, CRM, analytics, payments, recruitment, design, security, AI, automation and project delivery. Providers acting as processors are bound by Article 28 GDPR terms. Some providers act as independent controllers for their own purposes, in which case their privacy notices apply.

The reviewed website is hosted and built using Framer technology. Before publication, NEVES should publish or maintain a verified processor/vendor list rather than naming tools that are merely possible. We do not sell personal data or disclose it to third parties for their independent advertising purposes.

8. International transfers

Where personal data are transferred outside the EEA, we rely on a European Commission adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, supplemented by additional measures where needed. You may contact us for information about the relevant transfer mechanism and, where available, a copy of the safeguards, subject to necessary redactions.

9. Security

We use technical and organisational measures appropriate to the risk, which may include encryption in transit, access controls, multi-factor authentication, least-privilege access, secure configuration, backups, supplier review, confidentiality obligations, logging, patching and incident procedures. No internet service is completely secure. Please avoid sending sensitive data through ordinary email unless agreed safeguards are in place.

10. Personal-data breaches

We investigate and mitigate suspected personal-data breaches. Where required, we notify Datatilsynet without undue delay and, where feasible, within 72 hours after becoming aware of a reportable breach. Where a breach is likely to result in a high risk to individuals, we notify affected people without undue delay unless a lawful exception applies.

11. Retention and deletion

We retain personal data only for the periods stated above or for as long as needed for the purpose, legal obligations, security, dispute resolution or establishment of claims. At the end of the period, data are deleted or irreversibly anonymised. Backup copies are isolated from normal use and expire according to backup cycles unless preservation is legally required.

12. Your rights

Subject to the conditions and exceptions in applicable law, you may request:

• Access to personal data and supplementary processing information.

• Correction of inaccurate or incomplete data.

• Deletion of data.

• Restriction of processing.

• Data portability for eligible data.

• Objection to processing based on legitimate interests, including direct marketing.

• Withdrawal of consent at any time, without affecting prior lawful processing.

• Human intervention and the other safeguards applicable to qualifying automated decisions.

To exercise a right, contact contact@neves.dk. We may need to verify identity and clarify the request. We respond without undue delay and normally within one month, subject to lawful extensions. Rights are not absolute, and we will explain any lawful refusal or limitation.

13. Complaints

You may complain to the Danish Data Protection Agency (Datatilsynet): Carl Jacobsens Vej 35, 2500 Valby, Denmark • dt@datatilsynet.dk • https://www.datatilsynet.dk/english. We encourage you to contact NEVES first so we can try to resolve the concern.

14. Children

The website and services are directed to businesses and adults. We do not knowingly collect personal data from children through the website. If you believe a child has provided data, contact us so we can assess and delete it where appropriate. This statement does not replace the correct Danish age threshold if NEVES later offers an online service directly to children.

15. Changes to this policy

We may update this policy to reflect changes in law, technology, vendors or processing. The current version and effective date will be published on the website. Where required, we will provide additional notice or obtain renewed consent before a material change takes effect.

16. Contact

Privacy questions and requests: Neves ApS, Kongebrogade 75, 6000 Kolding, Denmark • contact@neves.dk • CVR no. 46234588.