Privacy notice

Contact details you give us: your name, your business name, your email address, and a phone number if you choose to send one.

Billing details needed to issue an invoice: the business name and address the invoice is made out to, and a VAT registration number where you have one. We never receive or hold your full card number.

Correspondence: the emails you send us and our replies, including the order itself and anything discussed while the work runs.

Material you send for a purchase: text, images, links, product information, and any audience or customer information you choose to share so the work can be planned.

Access to accounts: where the work runs inside your own advertising or business accounts, the user access you grant us and the records those platforms keep of what we did inside them.

Standard server logs from our hosting provider when someone visits our website, which include an IP address, the page requested, a timestamp and a browser identifier.

We do not collect special categories of personal data, and we ask you not to send them to us.

To answer an enquiry and quote for work. The basis is our legitimate interest in responding to people who contact us about buying.

To issue an invoice, take payment and deliver the purchase you ordered. The basis is performance of a contract with you, or steps taken at your request before entering into one.

To plan and run the advertising, including setting it up on platforms and reporting on it. The basis is performance of the contract.

To keep invoices and accounting records. The basis is compliance with a legal obligation, principally the Danish Bookkeeping Act and VAT rules.

To keep our systems and our website secure and available, using server logs. The basis is our legitimate interest in preventing abuse and diagnosing faults.

To establish, exercise or defend a legal claim, including a payment dispute. The basis is our legitimate interest in protecting the business.

We do not send marketing email, we do not build profiles of the people who contact us, and we do not sell, rent or share personal data for anyone else's marketing.

Our website sets no advertising cookies and no analytics cookies, so there is no consent banner to click through.

Your choice of a light or dark appearance is stored in your own browser's local storage. It stays on your device, it is never sent to us, and clearing your browsing data removes it.

Payment happens on a checkout page hosted by Stripe. Our website loads no payment scripts and sets no payment cookies.

Stripe sets its own cookies on its own checkout page, under its own privacy policy, which is published at stripe.com/privacy.

We run no analytics product on our website. There is no measurement script, no tag manager and no visitor tracking.

Where a purchase involves analytics inside your own website or app, that data is collected in your property, under your control, and you are the controller for it.

Advertising platforms report on the campaigns we run for you. Those reports are aggregated campaign figures produced by the platform, and we pass them to you as we receive them.

Card payments are processed by Stripe Payments Europe, Ltd., which is certified to the PCI DSS standard for handling card data.

Card details are entered on Stripe's page. We receive confirmation that a payment succeeded, the amount, the date, the last four digits of the card and the billing details you gave. We never receive the full card number, the expiry date or the security code.

For its own fraud prevention and regulatory duties, Stripe acts as an independent controller and collects device and behavioural signals on its checkout page under its own privacy policy at stripe.com/privacy.

Invoices and the accounting records behind them are stored in e-conomic, an accounting service provided by Visma e-conomic A/S in Denmark.

Where you pay by bank transfer, our bank and yours process the payment under their own terms and their own privacy policies.

For the personal data we hold about you as our customer, we are the controller and this notice applies.

For personal data inside your own advertising, analytics or business accounts, you are the controller and we act as your processor while we work in them.

As your processor we act only on your documented instructions, we keep the work confidential, and we apply the security measures described below.

We will enter into a data processing agreement with you on request, before the work starts.

Send us only what the work actually needs. If you send us a customer list, send the fields required for the campaign and nothing else.

When the purchase is delivered we ask you to remove our access, and we delete the files you sent us.

Vercel Inc., United States. Hosts our website and produces the server logs described above.

Google Ireland Limited, Ireland. Provides Google Workspace, which we use for email, calendar and file storage, so correspondence and material you send us is stored there.

Stripe Payments Europe, Ltd., Ireland. Processes card payments and issues the payment links we send with an invoice.

Visma e-conomic A/S, Denmark. Stores our invoices and accounting records.

AgileBits Inc., Canada. Provides 1Password, where the credentials our business uses are stored.

The advertising platforms used for your purchase, which we agree with you before the work starts. Each one processes campaign data under its own terms and privacy policy.

We use these providers because the work requires them. We do not add a provider that handles your personal data without a reason connected to delivering or accounting for a purchase.

Google Ireland, Stripe Payments Europe and Visma e-conomic hold data within the European Economic Area.

Vercel is established in the United States. Transfers to Vercel rely on the standard contractual clauses approved by the European Commission, together with Vercel's certification under the EU to US Data Privacy Framework.

Where Google or Stripe route data to the United States within their own groups, the same combination applies: standard contractual clauses and Data Privacy Framework certification.

AgileBits is established in Canada, which the European Commission has found to provide an adequate level of protection for data transferred to commercial organisations.

Advertising platforms may process campaign data outside the EEA under their own transfer mechanisms, which are set out in their terms.

We will tell you which safeguards apply to your data if you ask.

Enquiries that do not lead to a purchase: twelve months from the last message, then deleted.

Client correspondence and delivered work: three years after your last purchase.

Invoices and accounting records: five years from the end of the financial year they belong to, as required by the Danish Bookkeeping Act.

Access to your accounts: removed when the purchase is delivered.

Files you sent us for a purchase: deleted when the purchase is delivered, other than what is reproduced in the report.

Server logs: kept by Vercel on its standard short retention schedule and not copied by us into any other system.

Where a dispute or a legal claim is open, we keep what is relevant to it until it is resolved.

We work on the principle of least access: each account has only the access the work needs, and it is removed when the work ends.

Credentials are stored in 1Password. Every account has a unique password and two factor authentication where the provider supports it.

Data is encrypted in transit with TLS, and encrypted at rest by the providers listed above.

We never ask for your passwords and we do not accept them. Access to your accounts is granted by invitation, as a user, and revoked the same way.

Devices used for the work are encrypted and kept up to date.

If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we notify Datatilsynet within seventy two hours of becoming aware of it, and we notify you without undue delay where the breach affects your data.

We make no decisions about you by automated means, and we do not carry out profiling that produces legal or similarly significant effects.

Advertising platforms use automated systems to decide which of their users see an ad. Those decisions concern the platform's own audience, not you, and they are made by the platform under its own terms.

You can ask for a copy of the personal data we hold about you.

You can ask us to correct data that is wrong or incomplete.

You can ask us to delete data, and we will, except where we are required to keep it, such as invoices under bookkeeping law.

You can ask us to restrict how we use your data while a question about it is being resolved.

You can object to processing we carry out on the basis of legitimate interests, and we will stop unless we have grounds that override your objection.

You can ask for the data you gave us in a structured, commonly used, machine readable format, or ask us to send it to someone else where that is technically feasible.

To use any of these rights, email hello@blasfame.com and say what you want. We do not charge for this, and we reply within one month. If a request is unusually complex we may extend that and we will tell you why.

We ask for proof of identity only where we cannot otherwise be confident who is asking, and we ask for no more than we need to be sure.

We sell to businesses. Our service is not directed at children and we do not knowingly collect personal data from anyone under sixteen.

We do not plan or run advertising aimed at children.

If you are unhappy with how we have handled your personal data, email hello@blasfame.com first. We will look into it and reply within two business days.

You can also complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk.

If you live or work in another EEA country, you can complain to the supervisory authority there instead.

We update this notice when what we do with personal data changes, or when a provider we rely on changes.

Every version carries an effective date, and we keep the earlier versions.

If a change materially affects how we handle data we already hold about you, we tell you by email before it takes effect.