Privacy Policy

1. Introduction

This privacy policy explains how ValidStack ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or use our services. This policy takes effect from 23 August 2025 and applies to all users of our website and services.

We are committed to protecting your privacy and ensuring transparent handling of your personal data in compliance with the General Data Protection Regulation (GDPR) and Danish data protection laws.

2. Who We Are

ValidStack is a Danish web development and technical consulting company specializing in creating digital solutions for businesses and creative professionals.

3. Personal Data We Collect

3.1. Information You Provide to Us

We collect personal data that you voluntarily provide to us through:

Contact Forms

• Name: Required, 2-50 characters
• Email address: Required, validated format
• Company name: Optional, up to 100 characters
• Subject: Required, selected from predefined options (Web Development, Data Visualization, API Development, Mobile Development, General Consultation, Other)
• Message: Required, 10-1000 characters

Project Details Form (Website Packages)

• Project name: Required, 3-50 characters
• Project description: Required, minimum 50 characters, maximum 500
• Industry/Category: Optional selection from predefined list
• Timeline preferences: Optional (ASAP, Within 1 month, 2-3 months, Flexible)
• Contact email: Required for project communication
• Special requirements: Optional, up to 200 characters

3.2. Payment Information

Payment processing is handled entirely by Stripe, our secure payment processor. We do not store or process credit card information directly. When you make a payment, Stripe may collect:

• Billing address
• Payment method details
• Transaction information

Please refer to Stripe's Privacy Policy for details on how they handle your payment data.

3.3. Automatically Collected Information

Web Analytics

We use Google Analytics (Google Tag Manager ID: GTM-M6CLXHQC) to understand how visitors use our website. This service may collect:

• IP address (anonymized)
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Device information

Google Analytics is active in production and may be temporarily enabled in non-production environments for release validation. Please refer to Google's Privacy Policy for more information.

4. How We Use Your Personal Data

We process your personal data for the following purposes:

4.1. Service Provision (Legal Basis: Contract Performance)

• Responding to your inquiries and providing customer support
• Processing and fulfilling service orders
• Managing subscription-based website packages
• Communicating about your projects and services
• Sending transactional emails (order confirmations, project updates)

4.2. Marketing Communications (Legal Basis: Consent)

• Sending service announcements you explicitly request
• Sharing relevant information about new services or offers when consent is provided

You can withdraw your consent at any time by contacting us.

4.3. Business Operations (Legal Basis: Legitimate Interest)

• Internal record keeping and business administration
• Analyzing website usage to improve our services
• Ensuring website security and preventing fraud
• Complying with legal obligations

5. How We Share Your Data

We do not sell or rent your personal data to third parties. We may share your data with:

5.1. Service Providers

• Stripe: Payment processing for subscription services
• Google Analytics: Website analytics and usage statistics
• Email Service Provider: SMTP services for sending transactional emails

5.2. Legal Requirements

We may disclose your data if required by Danish law, court order, or to protect our legal rights and safety.

5.3. Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity, subject to the same privacy protections.

6. Data Storage and Security

6.1. Data Storage

ValidStack operates a privacy-focused approach to data handling:

• No Database Storage: We do not maintain databases of personal information
• Email-Only Processing: Form submissions are converted to email notifications and sent immediately
• Temporary Processing: Data is processed temporarily for the purpose of generating and sending notifications

6.2. Data Location

Your data may be processed in various locations:

• Our email provider's servers (subject to their data protection policies)
• Stripe's secure payment infrastructure (for payment processing)
• Google's servers (for analytics data)

6.3. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• HTTPS encryption for all data transmission
• Input validation and sanitization to prevent security vulnerabilities
• Secure API integration with third-party services
• Regular security reviews and updates

7. Data Retention

We retain your personal data for the following periods:

7.1. Contact Inquiries

Inquiry emails are retained according to our email provider's retention policy. We recommend contacting us if you wish to have your inquiry data removed from our email records.

7.2. Consent-Based Communications

If you opt in to optional communications, we retain your email address until you withdraw consent or request deletion.

7.3. Project Information

For active or completed projects, we retain necessary communication and project details for the duration of our business relationship and for up to 5 years after project completion for potential support purposes, unless you request earlier deletion.

7.4. Payment Data

Payment information is handled by Stripe according to their retention policies. We retain payment-related metadata (order details, amounts) for accounting and tax purposes as required by Danish law.

8. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

8.1. Right of Access

You have the right to obtain confirmation of whether we process your personal data and, if so, access to that data and information about the processing.

8.2. Right to Rectification

You have the right to have inaccurate personal data corrected and incomplete personal data completed.

8.3. Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the original purpose.

8.4. Right to Restrict Processing

You have the right to request restriction of processing your personal data in certain situations.

8.5. Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.

8.6. Right to Object

You have the right to object to processing of your personal data, particularly for direct marketing purposes or when processing is based on legitimate interests.

8.7. Rights Related to Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects concerning you.

8.8. How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: contact [at] validstack.pro

We will respond to your request within one month of receipt. If your request is complex or we receive multiple requests, we may extend this period by up to two months, in which case we will inform you within one month of receipt of your request.

9. Cookies and Tracking

9.1. Cookies We Use

Our website may use the following types of cookies:

Essential Cookies

These cookies are necessary for the website to function and cannot be switched off. They are usually set in response to actions you take, such as setting privacy preferences or filling in forms.

Analytics Cookies

We use Google Analytics cookies to understand how visitors interact with our website. These cookies collect information anonymously and help us improve our website performance.

Payment Processing Cookies

When you use our payment services, Stripe may set cookies necessary for secure payment processing.

9.2. Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually
• Block third-party cookies
• Block cookies from particular sites
• Block all cookies from being set

Note: Blocking cookies may affect the functionality of our website.

10. Children's Privacy

Our services are not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

11. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Adequacy decisions by the European Commission
• Standard contractual clauses approved by the European Commission
• Certification schemes or codes of conduct

For more information about the safeguards we use for international transfers, please contact us.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal requirements. When we make changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you of significant changes via email if you have provided your email address
• Post the updated policy on our website

We encourage you to review this privacy policy periodically to stay informed about how we protect your personal data.

13. Contact Us and Filing Complaints

13.1. Contact Information

If you have any questions about this privacy policy or our data processing practices, please contact us:

13.2. Data Protection Authority

You have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet) if you are dissatisfied with how we handle your personal data:

14. Definitions

For the purposes of this privacy policy:

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data, including collection, use, storage, and deletion
• "Controller" means ValidStack, who determines the purposes and means of processing personal data
• "Data Subject" means the individual to whom the personal data relates
• "GDPR" means the General Data Protection Regulation (EU) 2016/679

This privacy policy is effective as of 23 August 2025 and governs our collection, use, and disclosure of your personal data from that date forward.