Privacy policy
Last updated 22 October 2026.
This policy explains how Jonatan Pedersen ApS handles your personal data when you visit virksomhed.app, sign in at id.virksomhed.io, or use the Virksomhed apps: Konsulent at konsulent.virksomhed.app and Strikkeopskrift at knitting.virksomhed.app. We process personal data under the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).
Who is responsible
Jonatan Pedersen ApS is the data controller for your visit, your account, and our correspondence with you.
Jonatan Pedersen ApS
CVR 46605101
Elmegade 20, 1. mf
2200 København N
Denmark
hello@jonatanpedersen.com
What your business enters in Konsulent is your business's data. For that data, your business is the controller and we are its processor. The data processing section of the terms is our data processing agreement.
Data protection officer
We have not appointed a data protection officer, because the GDPR does not require one for a company of our size and kind of work (Article 37). Write to hello@jonatanpedersen.com with any question about your personal data, and Jonatan Pedersen answers it personally.
What we process and why
When you visit the site or an app
Data: your IP address, the time of your request, the address you requested, and your browser and operating system.
Purpose: to run the services, find faults, and protect them against abuse.
Legal basis: our legitimate interest in secure and available services (Article 6(1)(f)).
Kept: no longer than 30 days.
The site and the apps also place strictly necessary cookies. The cookie policy describes them.
When you have an account
You get an account when someone invites you. You cannot create one yourself.
Data: your username, your name, your email addresses and phone numbers, your profile picture, your password, which we store only as a scrypt hash, your passkeys, your two-factor and recovery codes, the apps you have given access, and the organizations and groups you belong to.
Purpose: to let you sign in in one place and use the same account in every Virksomhed app.
Legal basis: our agreement with you to use the services (Article 6(1)(b)).
Kept: for as long as you have the account. When it closes, we delete the data within 30 days.
You can remove email addresses, phone numbers, passkeys, and your profile picture, sign out other sessions, and withdraw an app's access yourself at id.virksomhed.io. To have the whole account deleted or to get a copy of your data, write to us.
When you are signed in
Data: your session, with its IP address and browser.
Purpose: to keep you signed in and to show you where you are signed in, so you can sign a session out.
Legal basis: our agreement with you (Article 6(1)(b)) and our legitimate interest in protecting your account (Article 6(1)(f)).
Kept: a session expires after 30 days, and we delete it within an hour of that.
Security log
Data: your user ID, the session's ID, what happened, for example that you signed in or changed your password, and the name or address typed in a failed sign-in. The log does not store your IP address.
Purpose: to document and investigate security events.
Legal basis: our legitimate interest in protecting the services and your data (Article 6(1)(f)).
Kept: as long as security requires and no longer than five years. Nobody can change the log after the fact, so it stays when an account is deleted.
When you use Konsulent
Konsulent stores your business's clients and their contacts, the consultants with their name, email, and hourly rate, engagements, logged hours, and amounts. We do this on your business's behalf as its processor, under the terms.
When you use Strikkeopskrift
Strikkeopskrift needs no sign-in. The recipe you work on stays in your browser's local storage and never reaches our server.
When you write to us
Data: your name, your email address, and what you write.
Purpose: to answer you and help you with the services.
Legal basis: our agreement with you (Article 6(1)(b)) or our legitimate interest in answering the people who contact us (Article 6(1)(f)).
Kept: as long as the conversation needs it. Correspondence and records that document a purchase or an agreement we keep for five years, as the Danish Bookkeeping Act (bogføringsloven) requires (Article 6(1)(c)).
We do not use analytics, advertising, or tracking, and we neither build profiles of you nor make automated decisions about you.
Who receives your data
We do not sell your data. Our sub-processors handle it on our behalf, under data processing agreements. The sub-processors page lists them.
All processing takes place in the EU, and we transfer no personal data to countries outside the EU and EEA. We hand data to public authorities only when the law requires it.
Your rights
You have the right to:
access the personal data we hold about you,
have incorrect data corrected,
have your data erased,
have its processing restricted,
object to processing based on our legitimate interest, and
receive the data you gave us in a machine-readable format.
Write to hello@jonatanpedersen.com to use any of these rights. We answer within one month. If your request concerns data in Konsulent, we pass it on to the business that controls that data and help it answer.
Complaints
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. We would like to hear from you first, so we can try to put things right.
Changes
We update this policy when the way we process personal data changes, and we revise the date at the top whenever we do.