Privacy Policy — WIN-WIN MARKETING A/S

01 Who we are and how to reach us

The data controller is WIN-WIN MARKETING A/S, Østergade 21, 7400 Herning, Denmark. CVR 28886438, EU VAT DK28886438. For any privacy question, or to exercise a right described below, write to info@marketingwinwin.com or call +45 71 61 62 91. We are not required to appoint a Data Protection Officer and have not appointed one; enquiries go to the address above and are answered within one month.

02 What this website does not do

This website does not run Google Analytics, Meta Pixel, Microsoft UET, Microsoft Clarity, or any other advertising, analytics or session-recording tag. It loads no third-party fonts, scripts, maps or embedded media — the typefaces are served from our own server, so no request and therefore no IP address of yours is sent to Google or to any other third party while you read these pages. If we ever add such a tool, we will update this policy first, name the recipient and link its privacy statement, and — for visitors in Denmark and the rest of the EEA — the tag will not fire before valid consent is given. For reference, Microsoft describes its own processing in the Microsoft Privacy Statement at privacy.microsoft.com.

03 The contact form — exactly how it works

The form on our contact page is submitted with an HTTPS POST request to our own server. Your details are carried in the body of that request, never in the page address, so they cannot end up in the address bar, in your browser history, in a referrer header sent to another site, or in a URL written to a web-server log. On the server the submission is validated and forwarded by email to info@marketingwinwin.com. It is not written to any database on this website. The form works with JavaScript disabled and has no fallback that would place your data in a URL.

04 What we collect through the form

Only what you type: your name, your company (optional), your email address, your phone number (optional), the service and indicative budget you select (both optional), your message, and whether you ticked the optional marketing box. The submission is timestamped and records which language version of the site you used. We ask for nothing else, and no field is pre-filled from any other source.

05 Lawful basis — enquiries and marketing are separate

Answering your enquiry and preparing a proposal rests on GDPR Article 6(1)(b), steps taken at your request before entering a contract, or on Article 6(1)(f), our legitimate interest in responding to people who contact us about our services. It does not rest on consent, so you never have to give consent to get an answer. Only the optional marketing tick box rests on consent, GDPR Article 6(1)(a), and you can withdraw it at any time by replying to any message or writing to info@marketingwinwin.com — withdrawal does not affect anything sent before it. Keeping invoices and related correspondence rests on Article 6(1)(c), our legal obligation under the Danish Bookkeeping Act. The full purpose-by-purpose breakdown is in the table below.

06 Spam protection and rate limiting

To stop automated abuse, the server checks a hidden field, how long the form was open, and how many submissions have come from your connection in the past hour. For the last check we store a salted, one-way hash of your IP address together with a timestamp; the address itself is never written to disk and the hash cannot be reversed to recover it. These records are deleted automatically once they are older than one hour. The lawful basis is our legitimate interest in keeping the form usable, GDPR Article 6(1)(f).

07 Cookies and local storage

Ordinary pages on this site set no cookie at all. Your language is decided by the page address — /da/ pages are Danish, the rest are English — so nothing needs to be remembered about you. Two items are stored in your browser's local storage and never sent to us: ww-theme, which remembers light or dark mode, and ww-consent, which remembers that you have dismissed the notice at the bottom of the page. You can clear both in your browser at any time. The contact page sets one strictly necessary session cookie, WWSESS, which holds the security token that protects the form against cross-site request forgery; it contains no personal data, is deleted when you close the browser, and requires no consent under the Danish cookie rules because the form cannot work securely without it.

08 Server logs and our hosting provider

Like every web server, ours records ordinary technical request data: the IP address, the time, the page requested, the response status and the browser user-agent string. These logs exist for security and troubleshooting, are not used to profile you, and are not combined with form submissions. Our hosting provider processes them on our behalf as a data processor under a written data-processing agreement, and stores them within the EU/EEA.

09 Who receives your data

Your enquiry is read by the people at WIN-WIN MARKETING A/S who need to answer it. It is processed by two categories of processor acting only on our instructions and under written data-processing agreements: our hosting provider, which runs the web server, and our email provider, which delivers and stores the message. We do not sell personal data, we do not share it with advertising networks, and we do not pass it to our media group for its own purposes. We disclose data to an authority only where the law requires it.

10 Storage location and international transfers

Our web hosting and our email are provided from within the EU/EEA, and personal data collected through this website is stored there. We do not transfer it to a country outside the EU/EEA. If that ever changes, we will update this policy and rely on an appropriate safeguard under GDPR Chapter V — normally the European Commission's standard contractual clauses — and you can ask us for a copy.

11 Purpose, data, lawful basis and retention

Each purpose has its own lawful basis and its own retention period. When a period ends, the data is deleted or anonymised.

Purpose	Data	Lawful basis	Retention
Answering your enquiry and preparing a proposal	Name, company, email, phone, service, indicative budget, message	Art. 6(1)(b) pre-contractual steps, or Art. 6(1)(f) legitimate interest in responding	12 months after our last contact, if no engagement follows
Delivering an agreed engagement and managing the client relationship	Contact details and project correspondence	Art. 6(1)(b) performance of a contract	For the engagement, then 3 years after the last delivery
Invoicing and accounting records	Billing name, address, company details, invoices	Art. 6(1)(c) legal obligation — Danish Bookkeeping Act	5 years from the end of the financial year the record belongs to
Occasional marketing updates	Name and email address	Art. 6(1)(a) consent — the optional tick box only	Until you withdraw consent; the record of the consent itself is kept 2 years afterwards as proof
Protecting the form from automated abuse	Salted one-way hash of the IP address, timestamp	Art. 6(1)(f) legitimate interest in a usable form	1 hour, then deleted automatically

12 Your rights, and how to complain

Under the GDPR you may request access to your data, correction of it, erasure, restriction of processing, and portability where processing rests on consent or contract. Where we rely on legitimate interest you may object to the processing, and where we rely on consent you may withdraw it at any time. Write to info@marketingwinwin.com and we will answer within one month. If you are not satisfied with our answer, you can complain to the Danish Data Protection Agency (Datatilsynet) — you do not have to contact us first.

Datatilsynet — file a complaint ↗
Datatilsynet — klagevejledning ↗

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark · dt@datatilsynet.dk · +45 33 19 32 00