Privacy policy for Hjælp til huskøb

Last updated: 30 October 2026

Data controller

I am the data controller for the personal data I process about my customers and potential customers. My contact details are:

I am not required to have an external Data Protection Officer (DPO). If you have questions about how I process your personal data, you can contact me at the email address above.

Processing activities

As a data controller under the General Data Protection Regulation (GDPR), I carry out the following processing activities.

Visiting the website

The website uses no cookies and no advertising or tracking tools. It does not store information on your device.

The website’s hosting provider processes technical information, such as your IP address, so that the website can be displayed and kept secure.

The website links to other sites, for example Trustpilot, Boligsiden and Boliga. The website does not load content from them, and no information is sent to them until you click a link yourself. When you click, you leave my website, and the other site has its own privacy policy.

I also use the web analytics tool Umami to understand how the website is used, so that I can improve its content and structure. Umami is cookie-free and gives me aggregated figures, not profiles of individual visitors. Umami records page views, the page you came from (referrer), browser, operating system, device type and approximate location. According to Umami, its standard analytics do not store visitor IP addresses as a field in the analytics records. Your IP address is processed briefly to calculate an anonymous visitor identifier and your approximate location, and it may appear in technical operational and security logs at Umami and its providers.

My legal basis is Article 6(1)(f) of the GDPR: I have a legitimate interest in seeing which pages are used and in improving the website. The statistics are not used to identify you or for marketing. You have the right to object, see the section on your rights.

Communication with potential customers

If you have questions or want to hear more about my services, you can contact me through the contact form, email or telephone. I process your data so that I can talk to you and answer your questions. I only process the information that you give me.

I typically process general personal data: your name, email address, telephone number and the content of your message.

When you use the contact form, your message is sent by email to my mailbox. The website itself does not store your message. To protect the form against spam, the website briefly keeps a coded (hashed) version of your IP address, for a few days at most, so that it can limit the number of messages. No cookies are used.

When you have sent an enquiry, you receive an automatic receipt by email, so that you can see it has been received. The receipt has a fixed text and uses only your name and email address. To limit the number of receipts sent to the same address, the website also briefly keeps a coded (hashed) version of the email address, for a few days at most.

My legal basis is Article 6(1)(b): the processing is necessary to respond to your request before any agreement is entered into. The protection against spam (the coded IP address and email address) is based on Article 6(1)(f), my interest in protecting the form from misuse. The tick box in the form confirms that you want to be contacted. It is not consent under the GDPR. It is voluntary to contact me, and you decide what information you give. Without your name and a way to contact you, however, I cannot reply. If you do not become a customer, I delete your enquiry and our correspondence 14 days after I have answered it.

Review of purchase agreements

You can send me your purchase agreement through the website so that I can check whether it is safe to sign. The document may contain personal data about you and others, for example names, addresses, the purchase price and information about the property. The file is sent as an attachment to my mailbox and is not stored on the website.

My legal basis is Article 6(1)(b): the processing is necessary to respond to your request to have the agreement checked before any agreement is entered into. It is voluntary to send the file, but I cannot check the agreement without it. If you do not become a customer, I delete the document and your enquiry 14 days after I have replied to you.

Customers

I need to communicate with my customers to deliver the advice correctly. I may process information such as your name, address, country of residence, the services provided, special agreements, payment information and the information in the documents you share with me in connection with the advice, for example the purchase agreement, condition report and other property documents. You are not obliged to give me the information, but I cannot advise you or enter into an agreement with you without the information necessary for the advice.

In rare cases I also process your CPR number. I use it in my know-your-customer (KYC) procedure, so that I know who I am advising, and when I draft and register a title deed or apply for permission to acquire real property in Denmark. The CPR number is deleted as soon as the processing is finished, except for the information I must keep under the Danish Anti-Money Laundering Act (see below). My legal basis for processing the CPR number is section 11(2)(1) of the Danish Data Protection Act (when legislation requires it, for example when registering a title deed) and otherwise no. 2 (your consent).

My legal basis is Article 6(1)(b) (performance of the agreement with you) and (c) (my legal obligations). After the takeover date I keep the case information for 5 years, so that I can document my advice and defend myself against any legal claims. This is based on Article 6(1)(f).

I keep the case information in my own case management system on my computer. An encrypted copy is stored in Proton Drive with Proton AG, so that I have a backup and can work from several computers.

Anti-Money Laundering Act. I am covered by the Danish Anti-Money Laundering Act and must therefore know my customers. I collect and verify information about your identity, typically name, address, CPR number and a copy of your identification, and about the purpose of the advice. I keep the information for 5 years after the customer relationship has ended, as the law requires. My legal basis is Article 6(1)(c) (my legal obligation), and for the CPR number section 11(2)(1) of the Danish Data Protection Act. Under the Anti-Money Laundering Act I may be required to report suspicious circumstances to the Danish Money Laundering Secretariat without telling you.

Customer testimonials and photos

Some customers have given me permission to use their testimonial on the website. I may show the customer’s first name, town, a picture of the home they bought and the testimonial itself. I only do this with your written consent.

My legal basis is Article 6(1)(a) of the GDPR (consent). I show the testimonial until you withdraw your consent or I stop using it. You can withdraw your consent at any time by writing to me, and I will then remove the testimonial and the picture. Withdrawal does not affect the lawfulness of processing that took place before.

Where the information comes from

I get most of the information from you. In a purchase I also receive documents from the seller’s real estate agent, for example the sales presentation, the purchase agreement and the condition report, which may contain information about the seller and the property. A testimonial may come from a review you wrote yourself on Trustpilot.

Bookkeeping

I am required to keep accounting records under the Danish Bookkeeping Act. This means I keep invoices and similar documents, which may contain general personal data such as your name, address and a description of the service.

My legal basis is Article 6(1)(c) of the GDPR. I keep this information for a minimum of 5 years after the end of the financial year to which the document relates.

Data processors

I cannot do everything myself, so I use external suppliers, some of which are data processors:

• Nordicway ApS, Godthåbsvej 27, 8660 Skanderborg, Denmark: hosting of the website and of the script that handles the contact form.
• Proton AG: email provider, provider of video meetings (Proton Meet), which I use for online meetings (I do not record the meetings), and Proton Drive, where I keep an encrypted copy of the case files. Messages from the contact form and attached purchase agreements are received and stored through Proton. You can read Proton’s data processing agreement here.
• Umami Software, Inc.: web analytics (Umami Cloud, data stored in the EU). You can read Umami’s data processing agreement and its list of sub-processors.

It is my responsibility that your data is handled properly. I therefore set high requirements for my suppliers and enter into data processing agreements with the companies that process personal data on my behalf.

Disclosure of personal data

I do not share your information with partners such as the real estate agent, the seller’s advisor or the bank. They already have the information they need. I only disclose your personal data to others if I am legally required to do so, or you have expressly asked me to, for example when registering a title deed. The Anti-Money Laundering Act may require me to give information to the Money Laundering Secretariat without telling you.

If a case or claim arises in connection with my advice, I may give the necessary information to my professional indemnity insurer (ADIS/HDI Specialty) and to a lawyer, so that the claim can be reported, defended or resolved. This only happens to the extent necessary and is based on Article 6(1)(f) (my interest in establishing, exercising or defending a legal claim).

Profiling and automated decisions

I do not carry out profiling or automated decision-making.

Transfers to third countries

As a starting point I use data processors in the EU/EEA.

My email provider, Proton AG, is located in Switzerland. The European Commission has decided that Switzerland ensures an adequate level of protection of personal data.

The statistics data from the website is stored in the EU (Frankfurt, Germany) in my Umami account. However, Umami Software, Inc. is established in the United States and uses sub-processors that may be located both inside and outside the EU/EEA. If data is transferred to, or can be accessed from, countries outside the EU/EEA, this takes place on the transfer mechanism set out in Umami’s data processing agreement.

Security

I keep the processing of personal data secure with appropriate technical and organisational measures. I have assessed the risks of my processing and put in place measures that fit those risks.

Your rights

Under the GDPR you have a number of rights in relation to my processing of your personal data. If you want to exercise them, please contact me at mail@hjaelptilhuskoeb.dk.

• Right of access: you can get access to the data I process about you, and certain additional information.
• Right to rectification: you can have inaccurate data about yourself corrected.
• Right to erasure: in certain cases you can have your data deleted before my usual deletion.
• Right to restriction of processing: in certain cases you can have the processing restricted.
• Right to data portability: in certain cases you can receive your data in a structured, commonly used and machine-readable format.
• Right to object: you can object to processing that is based on my legitimate interest, for example the web analytics.
• Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time.

You can read more in the Danish Data Protection Agency’s guidance at www.datatilsynet.dk.

Complaint to the Danish Data Protection Agency

If you are dissatisfied with how I process your personal data, you have the right to lodge a complaint with the Danish Data Protection Agency:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
Telephone: +45 33 19 32 00
www.datatilsynet.dk

You can also complain to the supervisory authority in the country where you live.