Privacy Policy

1. Who is responsible for your data

This website is operated by Copenhagen Bureau. Copenhagen Bureau's business registration is currently Business registration pending — final legal entity details are not yet finalised.

Registration number (CVR): [LEGAL TODO: ADD CVR NUMBER BEFORE LAUNCH]
Registered address: [LEGAL TODO: ADD COMPLIANT BUSINESS ADDRESS BEFORE LAUNCH]

For all privacy questions or requests, contact hello@copenhagenbureau.com. Copenhagen Bureau has not appointed a Data Protection Officer.

2. Website enquiries

When you contact us through this website — by submitting the homepage enquiry form, completing the longer guided enquiry on our contact page, choosing to message us on WhatsApp, or emailing us directly — you may provide information such as your name, email address, company name and website, industry or business type, phone number, and any business information, questions or questionnaire responses you choose to share with us.

The homepage form and the guided enquiry are each processed using Formspree, a third-party form-processing service, using two separate Formspree submission endpoints. Formspree does not send your submission into a Copenhagen Bureau-owned database — it forwards it by email to hello@copenhagenbureau.com. We then use Google Workspace / Gmail to receive, read and manage that correspondence, in the same way we manage any other email sent to us directly.

If you choose to message us on WhatsApp, this website only prepares a WhatsApp link with your message pre-filled and opens WhatsApp in a new tab or the WhatsApp app — we do not send anything on your behalf. The message is only sent once you press Send inside WhatsApp itself, and from that point WhatsApp and Meta process it under their own terms and privacy practices, which we do not control. We recommend reviewing WhatsApp's own privacy information if you have questions about how it handles your data.

We do not knowingly collect sensitive personal data (such as health or political information) through these channels, and ask that you avoid including it in free-text fields unless directly relevant to your enquiry. We do not currently use analytics, tracking pixels or advertising technology on this website, so we do not collect behavioural browsing data beyond what is described in Technical data and Cookies below.

3. Meetings

When you or someone at your organisation chooses to schedule a meeting with us — from this website, the guided enquiry, or from within Core — the booking calendar itself is provided by Cal.com. Cal.com's scheduling script and interface only load once you actively open the calendar; nothing is loaded in advance. Booking information may include your name, email, company and any notes you choose to add, and once a meeting is booked, Google Calendar and Google Meet may be used to create the calendar event and host the conversation.

A meeting's attendee list can include people who do not have a Core account — for example, colleagues you invite to join a call. Where practical, meeting invitations and confirmations will point to this Privacy Policy so that anyone attending can understand how their information is handled, even if they never interact with this website directly.

4. Core — the Copenhagen Bureau workspace

Core is the private workspace Copenhagen Bureau uses to manage an active client engagement — projects, files, approvals, agreements, invoices and day-to-day communication in one place. Access to Core is invitation-only.

Depending on how your organisation uses Core, the information processed there can include:

• Account and profile information, such as your name and email address
• Your organisation and team membership, and any invitations sent or received
• Project information
• Onboarding and task information
• Files, documents and their version history
• Deliverables and reports
• Review comments, annotations and approval decisions
• Agreements, such as proposals, contracts, NDAs and addenda
• Invoices and payment status
• Messages exchanged between your team and Copenhagen Bureau
• Meeting information associated with your organisation or projects
• Notifications sent about the items above
• Limited administrative and audit information used to operate and secure Core — for example, a record that a particular action took place

Not every Core user generates every category above — what applies to you depends on your role and how your organisation actually uses the workspace.

5. Payments

Where an invoice is payable online, payment can be completed through Stripe Checkout, a payment page hosted directly by Stripe. Copenhagen Bureau does not need to receive or store your full card details through Core — Stripe processes the payment itself under its own systems and its own privacy practices.

[LEGAL TODO: confirm final Stripe live-account activation and details before publication]

6. Why we use your information

We use the information described above to:

• Respond to enquiries and questions
• Evaluate potential work and prepare proposals
• Schedule and conduct meetings
• Administer client relationships and engagements, including through Core
• Manage projects and the work carried out within them
• Communicate with your team, including through messages and notifications
• Deliver, review and approve work, including agreements and deliverables
• Administer invoicing and payments
• Operate, secure and improve this website and Core
• Meet legal or accounting obligations where applicable

7. Legal bases for processing

Depending on the situation, we rely on one or more of the following legal bases:

• Taking steps at your request before entering into a contract, for example when you ask us about potential work
• Performance of a contract, where a client agreement is in place and you are personally party to it, or otherwise involved in performing it
• Copenhagen Bureau's legitimate interests in responding to enquiries, administering and delivering client engagements (including through Core), operating and securing this website and Core, and developing business relationships
• Compliance with a legal obligation, for example accounting and bookkeeping requirements
• Consent, only where processing genuinely depends on it — we do not use consent as the general legal basis for ordinary use of Core, or for responding to enquiries

Not all processing described in this policy relies on consent. We only ask for consent where another lawful basis does not apply.

[LEGAL TODO: review lawful-basis wording before launch]

8. Cookies and similar technologies

This website and Core use cookie-like browser storage only where strictly necessary — including to remember your cookie-preference choice, to keep you signed in to Core once you log in, and for the Cal.com booking calendar once you choose to open it. No analytics or marketing cookies are currently used, on either the public website or Core. Full details, including a technology-by-technology breakdown, are in our Cookie Policy, and you can review or change your choice at any time using "Cookie Preferences" in the footer.

9. Website technical data and security logs

Standard web-hosting infrastructure may generate basic technical logs (such as request timestamps and error information) purely to operate and secure the public website; these are not used for tracking or profiling and are not currently linked to individual visitor identities in any system Copenhagen Bureau actively reviews. Core, described above, does store information in a database in order to provide the workspace itself — see the Core section for what that includes.

10. Service providers / processors

Copenhagen Bureau currently uses the following third-party services to operate this website and Core:

• Formspree — enquiry-form processing and delivery
• Google Workspace / Gmail — business email correspondence
• Cal.com — meeting scheduling
• Google Calendar / Google Meet — calendar invitations and video meetings
• WhatsApp / Meta — only when you choose that contact route
• Supabase — the database, authentication and file-storage platform behind Core, intended to run in an EU production region (Central EU / Frankfurt)
• Stripe — payment processing for invoices payable through Core
• Resend — sends transactional emails from Core (for example, notifications), intending to use its EU sending region (Ireland) where possible — see International data transfers for what this does and does not mean

Hosting provider for the production website and Core: [LEGAL TODO: confirm production hosting provider before launch]

We only name a processor here once it is genuinely part of how this website or Core operates.

11. International data transfers

Some of the service providers listed above may process information outside Denmark or the European Economic Area. In particular, Resend intends to use its EU sending region (Ireland) for the emails it sends on our behalf, but Resend's own account-level data — such as delivery metadata, logs and API records — may still be processed in the United States or elsewhere, under Resend's own applicable safeguards; using an EU sending region does not by itself mean all Resend processing stays inside the EEA. Formspree, Google Workspace / Gmail, Cal.com and WhatsApp / Meta may also process information outside the EEA as part of providing their own services. Where a transfer outside the EEA occurs, we rely on the safeguards each provider makes available, such as standard contractual clauses or an equivalent mechanism recognised under applicable data protection law.

[LEGAL TODO: verify transfer mechanism before launch]

12. How long information is retained

We keep different categories of information for different lengths of time:

• Enquiry data (submitted through a contact form, WhatsApp or email) is retained only for as long as reasonably necessary to respond, evaluate potential work, maintain relevant business correspondence and establish or defend legal claims. No fixed statutory retention period has been assumed for this category.
• Core account, organisation and project data is retained for as long as your organisation's engagement with us is active.
• Files and document versions uploaded to Core are retained for the duration of the active engagement and for up to 12 months afterwards, unless you ask us to delete them sooner or we have a specific contractual or legal reason to keep them for longer.
• Messages exchanged through Core are retained for the duration of the active engagement and for up to 12 months afterwards.
• Meeting records associated with Core are retained for the duration of the active engagement and for up to 12 months afterwards.
• Administrative and audit/security logs are generally retained for up to 12 months, unless a longer period is needed for an active security or legal matter.
• Invoices, payment records and related accounting material are retained for the period required by Danish bookkeeping law — generally five years from the end of the financial year to which the material relates.

Each retention period above applies to its own category only — for example, the accounting retention period does not extend the retention of unrelated project or message content.

13. How information is protected

We take reasonable technical and organisational measures to protect the information we handle, including relying on the security practices of the established providers named in this policy (including Formspree, Google, Cal.com, Supabase, Stripe and Resend) for the parts of the process each one operates, and access controls designed to keep each Core client's information separate from other clients'. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Data-subject rights

Depending on applicable law, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request erasure of your information
• Request restriction of processing
• Object to processing based on legitimate interests
• Receive a copy of your information in a portable format, where applicable

This applies whether the information relates to an enquiry, a meeting, or your use of Core. To exercise any of these rights, contact hello@copenhagenbureau.com — we currently handle these requests manually rather than through a self-service tool. Some rights, such as erasure, may be limited where we have a legal or contractual reason to keep particular information, for example accounting records we are required to retain.

15. Withdrawal of consent

Where processing is based on consent — for example, an optional cookie category, if one is introduced in future — you may withdraw that consent at any time using "Cookie Preferences" in the footer, or by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

16. Right to object

Where we process your information on the basis of our legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. We will consider any such objection and stop the relevant processing unless we have compelling legitimate grounds to continue, or need to continue for the establishment, exercise or defence of legal claims.

17. Complaints to Datatilsynet

If you believe we have not handled your information properly, we would welcome the chance to address your concern directly at hello@copenhagenbureau.com. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), the supervisory authority for data protection in Denmark.

18. Children and minors

This website is directed at businesses, organisations and individuals acting in a professional or consumer capacity, and is not directed at children. Core is invitation- only and intended for authorised business users. We do not knowingly collect personal information from children through this website or Core.

19. Changes to this policy

We may update this Privacy Policy as the website, Core, our services or applicable law change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be reflected here directly, since this website does not currently operate a separate notification system for policy updates.

20. How to contact Copenhagen Bureau

For any question about this Privacy Policy or how your information is handled, contact hello@copenhagenbureau.com.