1. Introduction
Satrap ApS ("Satrap", "we", "us" or "our") is committed to protecting personal data and respecting the privacy of individuals who interact with our business.
This Privacy Policy explains how we collect, use, store, share and protect personal data when acting as a data controller.
It applies to personal data processed in connection with our corporate website, business relationships, sales, contracts, billing, customer support, marketing and internal administration.
We process personal data in accordance with the EU General Data Protection Regulation ("GDPR"), the Danish Data Protection Act and other applicable legislation.
Where Satrap processes personal data on behalf of a customer, the processing is governed by the applicable Data Processing Agreement ("DPA") and the customer's documented instructions.
2. Data Controller
The data controller for the processing described in this Privacy Policy is:
Satrap ApS
CVR: 46434307
Englandsvej 194, 1. tv.
2300 København S
Denmark
Website: https://satraptech.eu
General enquiries: info@satraptech.eu
Telephone: +45 93 901 421
For privacy enquiries or requests concerning personal data, please contact legal@satraptech.eu.
3. Scope and Separate Products
This Privacy Policy covers Satrap ApS' own corporate, administrative and commercial processing activities.
Our software products have separate privacy policies addressing their specific processing activities:
Product | Privacy Policy |
|---|---|
Satrap CMS | |
Satrap CRM | |
SatDent |
Where Satrap processes personal data on behalf of customers using these products, the applicable DPA governs that processing.
Where Satrap independently determines the purposes and essential means of processing, including for billing, account administration or customer relationships, this corporate Privacy Policy applies.
The applicable responsibilities depend on the processing activity. Nothing in these policies limits rights established under applicable data protection legislation.
4. Personal Data We Process
The information we process depends on your relationship with Satrap and the services involved.
4.1 Contact Information
We may process names, company names, professional titles, business addresses, email addresses, telephone numbers and other contact information provided to us.
4.2 Customer and Contract Information
We may process customer identifiers, account information, authorised user details, quotations, orders, contracts, subscription details, service information and related correspondence.
4.3 Billing and Payment Information
We may process billing addresses, company registration information, invoice details, transaction identifiers, payment status, subscription records and accounting documentation.
Where an independent payment provider handles card payments, payment credentials may be processed directly by that provider.
4.4 Communications and Support
We process relevant information contained in emails, contact forms, sales enquiries, support requests, project communications and complaints.
4.5 Technical and Security Information
Depending on the systems involved, we may process IP addresses, device and browser information, access timestamps, authentication events, technical logs and security records.
4.6 Project Materials
Customers may provide documents, files, content or other information necessary for the delivery of an agreed service.
Where such materials contain personal data processed on the customer's behalf, the applicable DPA and customer instructions govern that processing.
4.7 Sensitive Personal Data
Our general corporate activities do not normally require special categories of personal data, such as health information.
We ask individuals not to include sensitive personal data in ordinary enquiries unless necessary.
If such information is received, we handle it in accordance with applicable data protection requirements, including GDPR Article 9 where relevant.
Specialised processing involving health information through SatDent is addressed in its own privacy documentation.
5. Purposes and Legal Bases
We process personal data only where there is a lawful basis and a defined purpose.
Purpose | Data Categories | Legal Basis |
|---|---|---|
Responding to enquiries and preparing quotations | Contact details, correspondence | Art. 6(1)(f), or 6(1)(b) where applicable |
Entering into and performing contracts with individuals | Identity, contact and contract information | Art. 6(1)(b) |
Managing business customer relationships | Contact persons, account and contract information | Art. 6(1)(f) |
Delivering services and administering projects | Contact details, project information | Art. 6(1)(b) or 6(1)(f), as applicable |
Providing customer support | Contact details, communications and technical information | Art. 6(1)(b) or 6(1)(f), as applicable |
Invoicing and bookkeeping | Billing, payment and accounting records | Art. 6(1)(c), and 6(1)(f) where relevant |
Managing subscriptions | Account and subscription information | Art. 6(1)(b) or 6(1)(f), as applicable |
Protecting systems and preventing misuse | Technical, access and security information | Art. 6(1)(f), or 6(1)(c) where required |
Improving services | Relevant feedback and usage information | Art. 6(1)(f), where justified |
Electronic marketing based on consent | Contact details, consent and preferences | Art. 6(1)(a) |
Marketing to existing customers under Section 10(2) of the Danish Marketing Practices Act | Relevant customer contact information and preferences | Art. 6(1)(f), where the statutory exception applies and the legitimate interest assessment supports processing |
Complying with legal obligations | Information required by applicable law | Art. 6(1)(c) |
Establishing or defending legal claims | Contracts, correspondence and relevant records | Art. 6(1)(f), or another applicable basis |
Where we rely on legitimate interests under Article 6(1)(f), our interests include business administration, customer communication, service delivery, operational security, service improvement and the protection of our legal rights.
Such processing is subject to an assessment of necessity and the interests, rights and freedoms of affected individuals.
Article 6(1)(b) applies where the individual concerned is a party to the relevant contract or has requested steps before entering into a contract.
For contact persons representing corporate customers, we generally rely on legitimate interests rather than treating the individual as a party to the corporate contract.
6. Sources of Personal Data
We primarily receive personal data directly from individuals who contact or interact with Satrap.
We may also receive relevant information from employers, authorised customer representatives, business partners, payment providers, public business registers and other lawful sources.
Where personal data is collected indirectly, we provide the information required under GDPR Article 14 unless an applicable exception applies.
7. Marketing Communications
Satrap complies with the Danish Marketing Practices Act and applicable data protection legislation.
7.1 Electronic Marketing
We generally obtain prior consent before sending electronic direct marketing, including marketing directed at business recipients.
Where marketing is based on consent, consent may be withdrawn at any time.
7.2 Existing Customer Relationships
Under Section 10(2) of the Danish Marketing Practices Act, electronic marketing to existing customers concerning a company's own similar products or services may be permitted without separate prior marketing consent.
This exception applies only where the statutory requirements are satisfied, including:
- The electronic address was obtained in connection with a sale.
- Marketing concerns the company's own similar products or services.
- The customer was given a clear and free opportunity to opt out when providing the address.
- Every subsequent marketing communication includes an easy and free opportunity to opt out.
Where Satrap relies on this exception, the processing of relevant personal data is based on legitimate interests under GDPR Article 6(1)(f), where the conditions for that legal basis are satisfied.
An existing customer relationship does not automatically authorise marketing of unrelated products or services.
7.3 Service Communications
We may send necessary nonpromotional communications concerning existing services, including invoices, security notifications, operational updates and contractual information.
Such messages are distinguished from direct marketing.
7.4 Unsubscribing
Recipients may withdraw marketing consent or object to direct marketing at any time by using the available unsubscribe mechanism or contacting info@satraptech.eu.
We may retain limited suppression information to ensure that marketing objections continue to be respected.
8. Cookies and Tracking Technologies
Our corporate website may use cookies and similar technologies for functionality, authentication, security and other disclosed purposes.
Technically necessary cookies may be used without consent where permitted by law.
Cookies or similar technologies requiring consent will only be activated after valid consent has been obtained.
Users can manage or withdraw applicable cookie consent through the website's consent mechanism.
Details about the cookies actually used, their purposes, providers and storage periods are available in our separate Cookie Policy.
Cookie Policy: https://satraptech.eu/cookie-policy
9. Sharing Personal Data
Satrap does not sell personal data.
We may share personal data with third parties where necessary for operating our business, providing services, processing payments, maintaining security or complying with legal obligations.
Depending on the activity, recipients may include hosting and infrastructure providers, cloud services, email providers, payment processors, accounting systems, support providers, IT specialists, professional advisers and competent authorities.
We limit disclosures to information relevant to the legitimate purpose.
Where a provider acts as our data processor, an appropriate DPA is established where required.
Independent data controllers remain responsible for their own processing activities.
10. Service Providers and Data Processors
We use external technology and business service providers to support our operations.
These may include:
Service | Processing Activities |
|---|---|
Payment services | Transactions, billing references and payment administration |
Accounting systems | Invoicing, bookkeeping and financial records |
Hosting and infrastructure | Website operation, account information and technical logs |
Email services | Business communications and message delivery |
Support systems | Customer enquiries and support correspondence |
AI services | Information included in authorised AI assisted workflows |
Security services | Access monitoring, security events and incident investigation |
Satrap uses Dinero for accounting and may use Stripe for relevant payment processing.
The responsibilities of individual providers depend on the services used and the nature of the processing.
Where a provider acts as a processor on our behalf, processing is subject to appropriate contractual and data protection safeguards.
Information about relevant recipients and safeguards may be requested by contacting legal@satraptech.eu.
11. Artificial Intelligence
Artificial intelligence forms part of Satrap's technology development and may be used in selected business activities.
AI assisted workflows may support content preparation, business correspondence, software development, technical analysis and customer support.
11.1 Processing Through AI Services
Where personal data is included in an authorised AI workflow, the data may be processed by an external provider where such processing is lawful and necessary.
Depending on the workflow, this may involve business contact information, communication content or technical information.
We seek to limit personal data to what is necessary for the relevant purpose and avoid unnecessary disclosure of sensitive or confidential information.
11.2 External Providers
Where external AI providers process personal data on our behalf, their processing is subject to applicable contractual and data protection requirements.
These requirements concern the purpose of processing, provider access, retention, potential model training, security and international transfers.
11.3 Customer Controlled Data
Personal data processed by Satrap solely on behalf of a customer is not automatically available for unrelated internal AI purposes.
Any such processing is subject to the applicable DPA, documented instructions and relevant legislation.
11.4 Automated Decision Making
Our general corporate administration does not involve decisions based solely on automated processing that produce legal or similarly significant effects concerning individuals.
If this changes, we will provide the information and safeguards required by applicable law.
12. International Data Transfers
Some external technology and service providers may process personal data outside the European Economic Area, EEA.
Where personal data is transferred internationally, we rely on a valid transfer mechanism where required by GDPR.
Depending on the recipient and destination, this may include a European Commission adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.
Additional safeguards are applied where necessary.
Information concerning relevant international transfers and applicable safeguards may be requested through legal@satraptech.eu.
13. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected or where continued storage is required or permitted by law.
Retention depends on the type of information and the circumstances of processing.
13.1 Accounting Records
Accounting and bookkeeping material subject to the Danish Bookkeeping Act is generally retained for five years after the end of the relevant financial year, subject to applicable exceptions or additional legal requirements.
13.2 Customer and Contract Records
Customer and contract information is retained during the relevant business relationship.
Following termination, relevant information may be retained where necessary to document contractual performance, comply with legal obligations or establish, exercise or defend legal claims.
13.3 Enquiries and Quotations
Enquiries and quotations that do not result in a customer relationship are retained only for as long as necessary for legitimate follow up, administration or documentation purposes.
13.4 Support Records
Support information is retained where necessary for handling enquiries, maintaining service continuity, documenting support activities or resolving disputes.
The period depends on the nature of the case and any continuing legal or operational need.
13.5 Technical and Security Logs
Technical and security logs are retained for periods appropriate to system operation, troubleshooting and security.
Information relating to an incident may be retained longer where necessary for investigation, documentation or legal purposes.
13.6 Marketing Information
Marketing information is retained for as long as necessary for lawful marketing activities.
Consent records may be retained where necessary to document compliance, and limited information may be retained to respect withdrawals and objections.
13.7 Deletion and Backups
When personal data is no longer required, it is deleted or anonymised unless continued retention is legally justified.
Residual copies may remain in backups until the relevant backup cycle expires, subject to appropriate protection and access restrictions.
14. Data Security
Satrap implements technical and organisational measures appropriate to the nature and risks of its processing activities.
Depending on the system, measures may include access restrictions, authentication, encryption, technical logging, software updates, backup procedures, security monitoring and incident management.
Access to personal data is restricted to authorised persons who require it for legitimate purposes.
We review and adapt relevant security measures as necessary.
No digital system can guarantee absolute security, but we remain responsible for implementing appropriate safeguards under applicable law.
15. Personal Data Breaches
We investigate and respond to suspected personal data breaches in accordance with applicable legal requirements.
Where Satrap acts as data controller, we assess whether a breach must be reported to the competent supervisory authority and whether affected individuals must be notified.
Where Satrap acts as data processor, we notify the relevant customer without undue delay after becoming aware of a personal data breach, in accordance with GDPR and the applicable DPA.
16. Your Rights
Subject to applicable legal conditions and exceptions, you have the following rights under GDPR.
Right of access: You may request information about personal data we process concerning you.
Right to rectification: You may request correction of inaccurate or incomplete personal data.
Right to erasure: You may request deletion of personal data where the statutory conditions are satisfied.
Right to restriction: You may request restriction of processing in certain circumstances.
Right to data portability: Where applicable, you may receive qualifying personal data in a structured, commonly used and machine readable format.
Right to object: You may object to processing based on legitimate interests where the relevant conditions apply. You may object to direct marketing at any time.
Right to withdraw consent: Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Rights relating to automated decisions: Where applicable, you have rights concerning solely automated decisions producing legal or similarly significant effects.
17. Exercising Your Rights
To exercise your rights or ask questions about the processing of your personal data, contact:
We may request reasonable information necessary to verify your identity.
Requests are generally answered without undue delay and within one month, subject to legally permitted extensions.
Where a request concerns data processed solely on behalf of another data controller, we may refer the individual to that controller or assist in accordance with the applicable DPA.
18. Information Required for Services
Certain personal data is necessary to enter into contracts, deliver services, administer accounts, process payments or meet legal obligations.
If necessary information is not provided, we may be unable to establish a customer relationship, provide a requested service or fulfil an applicable legal requirement.
Where information is optional, it will not be treated as mandatory without an appropriate basis.
19. Children
Our general corporate website and business services are intended primarily for businesses, organisations and professionals.
They are not specifically directed at children.
Processing involving children through specialised products or customer solutions is addressed according to the applicable product documentation and legal requirements.
20. Third Party Websites
Our website may contain links to independent third party websites.
Those services may have their own privacy policies and processing practices.
We encourage users to review the relevant privacy information before submitting personal data to independent third parties.
21. Corporate Transactions
In connection with a merger, acquisition, restructuring or sale of business activities, relevant personal data may be disclosed or transferred where there is a lawful basis.
Such processing remains subject to applicable data protection requirements.
22. Complaints
If you have concerns about our processing of personal data, you may contact legal@satraptech.eu.
You also have the right to lodge a complaint with the competent supervisory authority.
In Denmark, this is:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
Website: https://www.datatilsynet.dk
You are not required to contact Satrap before lodging a complaint.
23. Relationship With Other Legal Documents
This Privacy Policy should be read alongside our applicable legal documentation, including:
- General Terms & Conditions of Satrap ApS.
- Individual service agreements.
- Data Processing Agreements.
- Product specific privacy policies.
- Cookie Policy.
- Product specific Terms & Conditions.
The privacy policies for Satrap CMS, Satrap CRM and SatDent provide additional information about processing associated with those products.
Where Satrap acts as data processor, the applicable DPA governs the processing carried out on the customer's behalf.
Mandatory data protection legislation prevails over inconsistent contractual provisions.
24. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in legislation, business activities, processing operations, technology or service providers.
The current version will be available through https://satraptech.eu.
Where required by law, material changes will be communicated through an appropriate additional notice.
25. Contact Information
For privacy enquiries and requests concerning personal data:
Satrap ApS
CVR: 46434307
Englandsvej 194, 1. tv.
2300 København S
Denmark
Website: https://satraptech.eu
General enquiries: info@satraptech.eu
Privacy enquiries: legal@satraptech.eu
Telephone: +45 93 901 421
END OF PRIVACY POLICY
Version 1.4