General Privacy Policy

This is our General Privacy Policy. We have a Customer Privacy Policy too, specifically made for those using our services.

1. Introduction and Scope

Connie ApS (“we”, “us” or “our”) is committed to protecting the privacy of individuals whose personal data we process. This general Privacy Policy outlines how we collect, use, disclose, and protect personal data. It applies to the personal data processing activities for which we act as a data controller. When we process personal data on behalf of our customers as a data processor – that is, the documents, signer data and audit trails our customers manage in the Connie platform – that processing is governed by our Data Processing Agreement and described in our Privacy Policy for Customers.

This Privacy Policy explains what personal data we process in specific scenarios, the purposes and legal bases for processing, how long data is retained, who we share it with, transfers outside the EU/EEA, and your rights as a data subject. Our use of cookies is described in our cookie policy, and additional details about our security and compliance practices – including our certifications and sub-processors – are available in our Trust Center (accessible at trust.getconnie.com).

2. Elaboration of Our Specific Processing and Processing Bases

We only collect and process personal data that is relevant and necessary for specific purposes. The categories of personal data and purposes of processing differ based on your relationship with us, as described below:

  • Signer Document Archive: We offer you, as a signer of contracts or consent forms via our Connie platform, a free document archive service (“Signer Document Archive”) where you can store and revisit the contracts and/or consent forms that you have signed. We provide this service based on your consent, cf. GDPR Article 6(1)(a), and as an opt-in service, meaning that you have to agree to use the service before it is provided to you. We will process your name, email address, account information and any personal information related to the archived contracts and/or consent forms that you have signed. The Signer Document Archive is provided to you directly by us and independently of the Connie customer who issued your documents – your archive is not affected if that customer later closes its Connie account. You have the right to withdraw your consent at any time by contacting us at the contact information in sec. 7 below or by deleting your account. We store your information as long as you continue using the Signer Document Archive and up to 3 months after you have withdrawn your consent or deleted your account. If your account has been inactive for 3 years, we will delete it automatically to protect your personal information. If you are under 18, please only use the Signer Document Archive with the involvement of a parent or guardian.

  • Support: We also process your personal data if you contact our support with support inquiries. We process your personal data based on our legitimate interest in being able to contact you and respond to your inquiries, cf. GDPR Article 6(1)(f). The data we process will typically include your name, email address or phone no., information related to the inquiry, and possibly your company name, job title and Company Registration No. We delete the information on an ongoing basis, but no later than 3 years after the last inquiry.

  • Suppliers and partners: When we enter into agreements with suppliers and business partners, we process information about you as a contact person. This includes information about your name, job title, company name, Company Registration No., phone no., email address and, if necessary, bank and payment information. The data is processed either because it is necessary for the fulfilment of the contract with the supplier or business partner concerned, cf. GDPR Article 6(1)(b), or because we have a legitimate interest in processing the personal data as part of the contract, cf. GDPR Article 6(1)(f). We retain relevant contact information throughout our co-operation. Written correspondence is deleted on an ongoing basis, and information necessary to fulfil our obligations under the Danish Bookkeeping Act is stored for 5 years from the end of the financial year to which the material relates.

  • Website and Social Media Visitors: When you visit our website or social media pages, we may process limited data such as online identifiers (IP address, device information, cookies) and usage data (pages viewed, clicks, time spent) to operate and secure our website, to analyze traffic and improve user experience, and to measure the effectiveness of our content. If you choose to fill out a form (e.g. to contact us or download material) or interact with our social media posts, we may collect your contact details (name, email, phone) and any information you provide in your inquiry or comments. This data is used to respond to your requests or engage with you (for example, replying to a comment or message you send us) and to improve our outreach and marketing. We process your personal data for these purposes based on your consent, cf. GDPR Article 6(1)(a). If you contact us via social media, we process your personal data based on our legitimate interest in being able to contact you and respond to your inquiries, cf. GDPR Article 6(1)(f). The data will originate from you and the social media that you contact us through. You can read more about how long we process your personal data on online identifiers in our cookie policy. For contact forms, we store your personal data for up to 2 years after you have contacted us. Data processed in connection with social media that relates to direct communication via social media will be deleted immediately. Posts made on our social media pages or other public groups are not deleted, as a post or comment in public groups is considered public areas.

  • Sales Leads and Event Participants: If you are a potential customer or have shown interest in our services (for example, by requesting a demo, downloading content, exchanging contacts at an event, or registering for a webinar), we may collect your business contact information such as name, email address, phone no., job title, company name, and company details (e.g. company address, VAT number if relevant). We use this information to communicate with you about our products and services, provide you with requested information (like a demo or newsletter), register you for events and webinars, and follow up on your interest (sales and marketing correspondence). We do this based on our legitimate interest, cf. GDPR Article 6(1)(f). For webinar or event participants, we may also process details related to your registration and attendance (e.g. session logs, questions asked, feedback) based on your consent, cf. GDPR Article 6(1)(a). This data helps us manage the event and afterwards to gauge interest in our services. You may opt out of marketing communications at any time by contacting us at the contact information in sec. 7 below. We store your personal information for up to 2 years after you have shown interest in our services or received marketing materials from us.

  • Job Applicants: If you apply for a job with us, we will collect the personal data you provide in your application. This typically includes identification and contact information (name, email address, phone no., address), date of birth, CV/resume, cover letter, employment history, education, qualifications, references, and any other details you choose to share with us. We process this information based on our legitimate interest for recruitment purposes, cf. GDPR Article 6(1)(f), i.e., to evaluate your application, assess your suitability for the role, conduct interviews, communicate with you during the hiring process, and, if successful, to prepare an employment contract. We share your personal data with the employees involved in the recruitment process and disclose your personal data with recruitment companies. If you are not offered the position, we may store your personal data for up to 3 years after the end of the recruitment period. If we wish to store your data beyond the recruitment period, we will obtain your consent, cf. GDPR Article 6(1)(a).

  • Employees: For our employees, we process HR and employment-related data to retain the employee relationship. This includes identification information (name, contact details, date of birth, personal identification number, if required by law), job title/position, employment agreement details, payroll and bank account information, tax information, benefits information, performance and development records, and any other personal data necessary for administering the employment relationship. The purposes of processing employee data are to manage HR and payroll, fulfill our obligations as an employer (payroll, taxes, insurance, leave management, etc.), provide benefits, evaluate performance, and maintain internal directories and IT access. We do this based on fulfilling the employment agreement with you, cf. GDPR Article 6(1)(b). Special categories of data, including health data, are only processed if required (for instance, handling sick leave or work environment accommodations) and in accordance with applicable law, cf. GDPR Article 9(2)(b). At the end of your employment, we will retain your personal data for up to 5 years from your last day of employment. Certain information may be kept longer if required by Danish law or other applicable laws. For example financial records (which can include payroll records, reimbursement receipts, etc.) and records on workplace injuries or pension may need to be kept for statutory periods.

  • Next of kin: We collect information about our employees’ emergency contacts. We do this in order to be able to communicate with relevant relatives in case of an emergency situation with one of our employees. We process your personal data on the basis of our legitimate interest in being able to inform you about the employee’s emergency situation so that you have the opportunity to act accordingly, cf. GDPR Article 6(1)(f). We store the data about the next of kin for the duration of the employment. The data will be deleted when the employment ends. You can always request to have your data deleted by contacting us on the contact information stated in sec. 7 below.

3. Notification of Statutory or Required Processing

In cases where we process your personal data based on a legal obligation or contractual requirement or a requirement that must be fulfilled in order to enter into a contract, you are obliged to provide us with the information so that we can provide our services, fulfil the contract and invoice you for our services, etc. If you do not wish to provide us with the information we need to fulfil our obligations, the consequence may be that we will not be able to provide you with our services or fulfil a contract with you.

You are not obliged to provide us with your data in other cases, e.g. for our marketing. However, the consequence of not providing us with your data will be that you cannot receive marketing from us.

4. Recipients of personal data

We process your personal data with confidentiality and we generally do not disclose the data to third parties. However, we may disclose your personal data if you have given your consent, if we have a legitimate interest in the disclosure or if we have a legal obligation.

We may entrust personal data to our system suppliers who process personal data on our behalf and under our specific instructions in accordance with the data processing agreement entered into.

Personal data processed in the Connie platform itself is hosted in Danish data centres and is not transferred outside the EU/EEA; the platform’s sub-processors are listed in our Trust Center. For our own business operations – such as email, CRM, analytics and other cloud tools used for the purposes described in this policy – we may use suppliers whose processing involves a transfer of personal data to countries outside the EU/EEA. For this purpose, we use a valid transfer basis in the form of either the EU-U.S. Data Privacy Framework or Standard Contractual Clauses before we transfer the personal data. If we use Standard Contractual Clauses, an individual assessment is always made regarding the need for additional measures. You can request a copy of the relevant SCCs or information on transfer safeguards by contacting us (see sec. 7 below).

5. Your Rights as a Data Subject

Under the GDPR (and applicable Danish data protection law), you have a number of rights regarding your personal data. We are committed to upholding these rights. Below is a summary of your principal data subject rights and how you can exercise them:

  • Right of Access: You have the right to request confirmation as to whether we are processing personal data about you, and if so, to obtain a copy of that data along with information on how we use it.

  • Right to Rectification: If you believe that any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

  • Right to Erasure (“Right to be Forgotten”): You have the right to request the deletion of your personal data in certain circumstances. You can request erasure if the data is no longer needed for the purposes it was collected, if you have withdrawn consent (where consent was the basis) and we have no other legal basis, or if you object to processing based on legitimate interest and we have no overriding grounds, or if we processed your data unlawfully, or to comply with a legal obligation.

  • Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain situations.

  • Right to Data Portability: For data you have provided to us, and which we process by automated means based on your consent or on a contract with you, you have the right to receive that data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

  • Right to Object: You have the right to object, on grounds relating to your particular situation, to any processing based on our legitimate interests.

  • Right to Withdraw Consent: Where we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing done before the withdrawal.

  • Right to Lodge a Complaint: If you believe we have not complied with applicable data protection regulations, you have the right to file a complaint with a supervisory authority. We are under the jurisdiction of the Danish Data Protection Agency (Datatilsynet) as our lead supervisory authority. You can contact the Danish Data Protection Agency on email at dt@datatilsynet.dk (for general inquiries) and on phone on +45 33 19 32 00.

To exercise any of your rights, please contact us at our designated privacy email (see sec. 7 below). We may need to verify your identity to ensure we don’t disclose or modify data to the wrong person.

6. Data Security Measures

We understand the importance of securing personal data and have implemented appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. We are ISO/IEC 27001:2022 certified, and you can read about our information security program in more detail in our Trust Center at https://trust.getconnie.com/.

7. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please do not hesitate to contact us. Our contact details are:

Connie ApS
Company Registration No.: DK-42768294
Brandts Passage 15, 2.
5000 Odense C
Denmark

E-mail: You can write to us on the following email addresses:

  • privacy@getconnie.com – This is our dedicated contact for privacy and data protection inquiries.

  • support@getconnie.com – For general inquiries not related to privacy

Other channels: You can call our main office line or send a postal mail to the address above. For urgent matters such as a potential security incident, you can call our security hotline at +45 92 92 19 29 or write to security@getconnie.com.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. If we make material changes, we will notify you by appropriate means. For example, we might post a prominent notice on our website or send an email notification if we have your contact details and the changes are significant.

We will indicate the “last updated” date for this Privacy Policy. Below, we maintain a change log of significant updates for transparency.

Last Updated: November 5th, 2026

Change Log:

  • November 5th, 2026: Clarified that this policy covers our processing as a data controller, while processing on behalf of our customers is governed by our Data Processing Agreement and Privacy Policy for Customers. Clarified that the Signer Document Archive is provided independently of the issuing customer’s account. Clarified that data in the Connie platform is hosted in Denmark and that transfers outside the EU/EEA only occur in our own business tooling, with valid transfer safeguards. Updated the security section to reference our ISO/IEC 27001:2022 certification, and updated the security hotline number. Minor corrections of language and typos.

  • August 17th, 2025: Major simplification of our Privacy Policies to make it easier for you to read and understand how and in what scenarios we process your personal data, including your rights in this connection.

  • March 26, 2025: Initial version of the comprehensive Privacy Policy released. This version expands on data subject categories (visitors, leads, applicants, employees), includes detailed list of sub-processors and GDPR information, and aligns with current GDPR requirements.

Any future changes will be added to this log. If you disagree with the changes in an updated Privacy Policy, you have the right to cease using our services and to request us to delete your data (see sec. 5 above). Continued use of our services or interaction with us after the effective date of an updated Policy will be considered acceptance of those changes to the extent permitted by law.

If you have any questions or comments about this Privacy Policy, please contact us at privacy@getconnie.com

Thank you for entrusting us with your personal data. We value your privacy and work hard to protect it in accordance with the law and our own high standards.