Privacy policy

At Raptor Services A/S (“Raptor”, “we”, “us”, “our”), we are committed to protecting the personal data of our clients, suppliers, website visitors, applicants, and other individuals. This Privacy Policy outlines how we collect, use, store, and disclose personal data in accordance with the General Data Protection Regulation (GDPR) and the ePrivacy Directive. 

We process personal data lawfully, fairly, and transparently, with respect for individual privacy and in line with applicable data protection regulations. 

2. Data Controller

Raptor Services A/S is the data controller responsible for processing your personal data. We ensure that all processing is compliant with applicable data protection laws. 

Contact Information: 
Raptor Services A/S 
VAT-ID: 35 05 59 75 
Åboulevarden 37, 4th floor 
DK – 8000 Aarhus C. 

Compliance Officer: 
Kirsten Düsterdich  
E-mail: [email protected] 
Phone: +45 2040 8020 

3. Purpose and Legal Bases of processing 

We process personal data for the following purposes: 

4. Data Retention Periods and Types of Personal Data

Personal data is retained: 

• As long as necessary to fulfill contractual obligations;
• For up to 5 years after a customer/supplier relationship ends, in compliance with bookkeeping and anti-money laundering legislation;
• Until you withdraw consent, for marketing or potential leads. 

Overview of which personal data is used for which purposes and how long: 

5. Cookie Data in relation to visits on the website www.raptorservices.com

When visiting www.raptorservices.com, cookies are used. Cookies are small text files that are stored through your browser on your device, used by websites to make a user’s experience more efficient. The data is used to optimize the website in relation to the visitors’ needs. 

The login to the customer area on the website requires cookies to remember your choices. 

Selected employees at Raptor Services A/S have access to the collected data. The data is used for and disclosed in the form of statistics, etc., without specifying individual IP addresses. The purpose of processing statistics obtained from cookies is to provide a better website. 

This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages. 

You can at any time change or withdraw your consent from the Cookie Declaration right here.  

Please state your consent ID and date when you contact us regarding your consent. 

If you want to learn more about what cookies we use, you can check out our cookie information. 

6. Data Access and Disclosure

Access to personal data is restricted to employees and subcontractors who require it to perform specific tasks, based on the principle of least privilege. All third-party processors operate under legally binding Data Processing Agreements. 

Our primary hosting and data storage provider is Microsoft, with additional services from: 

• Adobe Creative Suite
• Arcade*
• Arrows.to*
• Asana
• Codetwo
• Contractbook*
• Cookiebot
• Copilot (Microsoft)*
• Crossbeam
• Demio
• E-conomic
• Meta (Facebook/Instagram) (note: shared data controllership)*
• Figma*
• Google Ads*
• Google Analytics*
• HubSpot*
• Klaviyo*
• LinkedIn*
• Loom*
• Medium*
• Microsoft Business Premium
• Notion*
• Plecto*
• SQL Server*
• Shopify*
• Slack*
• Sleeknote*
• Zapier*  

Certain data transfers may occur to processors based in the United States, under mechanisms such as the Data Privacy Framework (DPF) and/or Standard Contractual Clauses or other lawful transfer tools compliant with Chapter V of the GDPR. 

For a full list of data processors, contact our Compliance Officer. 

* Note that these third-party processors offer AI services in their main services. We therefore refer to the Annex I to this Privacy Policy, “AI-Enabled Service Providers and Compliance Measures”.  

7. Data Security

We maintain appropriate technical and organizational measures (TOMs) to protect personal data, including: 

• Encryption (in transit and at rest)
• Role-based access controls
• Regular data backups
• Employee confidentiality protocols 

In the event of a data breach likely to result in high risk to individuals, we will notify affected parties and supervisory authorities without undue delay, as required by GDPR Art. 33 and 34. 

8. Your rights under the GDPR

You have the right to: 

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase data (aka “right to be forgotten”, Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3)) 

To exercise your rights, contact our Compliance Officer (see Section 2). We will respond within one month, or within two months for complex requests. Unfounded or excessive requests may be refused or subject to a fee. 

Note that due to the nature of our services, some of the above-mentioned rights are either irrelevant or impossible. For those cases, we have relevant measures to ensure that your rights are respected to the greatest possible extent. 

9. Complaints

You may send a complaint to the Danish Data Protection Authority (Datatilsynet): 

Email: [email protected] 

Website: www.datatilsynet.dk 

Address: Carl Jacobsens Vej 35, 2500 Valby, Denmark 

Phone: +45 33 19 32 00 

10. Change of privacy policy

This Privacy Policy may be updated to reflect legal or operational changes. Significant changes will be communicated through our website or by email. The current version is always available at www.raptorservices.com/privacy-policy

Annex I

Annex I to Raptor Services’ Privacy Policy: AI-Enabled Service Providers and Compliance Measures 

This annex provides detailed information regarding the AI-powered services used by Raptor Services A/S, including their functions, data handling practices, and the safeguards in place to ensure compliance with the General Data Protection Regulation (GDPR), ePrivacy Directive, and the EU Artificial Intelligence Act (AI Act). 

1. Overview of AI-Enabled Vendors

Note that those third-party vendors take the role of processors.  

1. Risk Classification Under the EU AI Act

In line with the AI Act risk categorization: 

1. Data Protection and AI Governance Measures

The following controls have been implemented to ensure compliant use of AI services: 

Transparency and Accountability 

• AI involvement is clearly disclosed in relevant interactions (e.g., newsletters or auto-generated content).
• Human oversight is maintained over all automated outputs.
• Users can request explanations about automated processing and decisions. 

Data Minimization and Purpose Limitation 

• Only personal data necessary for the AI system’s defined purpose is processed.
• AI tools are restricted contractually from training on client data for generalized model improvement.

Data Processing Agreements and Safeguards 

• Signed Data Processing Agreements (DPAs) with all relevant data processors.
• Data Privacy Framework or entered in EU Standard Contractual Clauses supported by Transfer Impact Assessments and supplemental security measures, if relevant, is the transfer tool for transfers to third countries.
• Internal DPIAs are conducted when AI use introduces higher risks to data subjects.

Security and Integrity

• AI models used by processors are secured against unauthorized access and model drift.
• Logging and audit trails are maintained to monitor AI decisions and system performance.