Privacy policy

Controller

The data controller for personal data processed on this website is Verheim ApS, a Danish private limited company.

[Registered address pending CVR registration — see Imprint at /imprint when available, Story 3.2.]

For questions about this policy or the controller's data-processing practices, write to privacy@verheim.com.

Lawful basis for form-submission processing

Verheim processes personal data submitted through the contact form, the demo-request form, the training-enquiry form, and the event-registration form on the lawful basis of legitimate interest under GDPR Art. 6(1)(f) — responding to a commercial enquiry that the visitor has chosen to send. The legitimate interest is balanced against the visitor's rights under GDPR Art. 6(1)(f) second sentence; visitors can object to processing at any time by writing to privacy@verheim.com.

Any follow-up marketing communication beyond responding to the original enquiry requires separate opt-in consent under GDPR Art. 6(1)(a). Consent is not relied on at form-submission time — submitting a form does not enrol the visitor in a marketing list.

Categories of personal data

Verheim processes the following categories of personal data through the forms named above:

• name;
• work email address;
• company name;
• role or job title;
• free-text message or context describing the enquiry;
• IP address — retained transiently for rate-limiting and abuse prevention; not associated with form submissions in long-term storage.

Verheim does not collect special-category data under GDPR Art. 9, does not collect data relating to criminal convictions under Art. 10, and does not collect data from children under 16 (the website is addressed to professional buyers in life-sciences validation, not to consumers).

Recipients

Personal data submitted through the forms is routed to the following Verheim-internal recipients based on the enquiry subject:

• sales@verheim.com — for pharma, biotech, medtech, and integrator enquiries about Verheim's authoring platform for life-sciences validation;
• training@verheim.com — for training-programme enquiries;
• privacy@verheim.com — for data-subject rights requests (access, rectification, erasure, restriction, portability, objection) and questions about this policy.

Transactional email (the technical delivery of replies and acknowledgments) is delivered through EU-resident subprocessors. The complete subprocessor list, with hosting jurisdiction and Data Processing Agreement references, is published at /subprocessors.

Retention

Form submissions are retained for the following provisional periods, pending external legal counsel review per the DRAFT marker above:

• 12 months for unconverted form submissions — i.e. enquiries that did not lead to a sales relationship;
• 36 months for converted form submissions — i.e. enquiries where a sales relationship was established.

Final retention values are drafted by legal counsel and may differ from these provisional values. Transient rate-limiting data (including IP address) is retained for the minimum period required for abuse prevention and is not associated with form submissions in long-term storage.

Transfer posture

Verheim operates EU-only data residency. The website origin is hosted at Hetzner Online GmbH (Germany); content is delivered through Bunny.net with EU-only routing; DNS, TLS issuance, transactional email delivery, and DMARC aggregator processing are all performed by EU-resident subprocessors named in the subprocessor list.

No Schrems II transfers to third countries are made. Personal data submitted through the website is not transferred to recipients in the United States, the United Kingdom, or any other jurisdiction outside the European Economic Area at the date of this policy.

Your rights

Under GDPR Art. 15-22, visitors have the following rights as data subjects with respect to personal data Verheim processes:

• right of access (Art. 15) — confirmation that data is processed and a copy of the data;
• right to rectification (Art. 16) — correction of inaccurate or incomplete data;
• right to erasure (Art. 17) — deletion of data when no legitimate-interest basis remains;
• right to restriction (Art. 18) — temporary limitation of processing while a dispute is resolved;
• right to data portability (Art. 20) — a structured, machine-readable export of submitted data;
• right to object (Art. 21) — objection to processing under Art. 6(1)(f) legitimate interest.

Rights requests should be submitted to privacy@verheim.com. Verheim acknowledges rights requests within 72 hours and responds within 30 days per GDPR Art. 12(3); where the request is complex or where several requests are pending from the same data subject, the response period may be extended by a further two months with notice to the data subject.

Right to lodge a complaint

Data subjects who consider that Verheim's processing of their personal data infringes the GDPR have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Verheim, as a Danish-established controller, is Datatilsynet — the Danish Data Protection Agency.

The Datatilsynet complaint-submission landing page is published at Datatilsynet (the Danish Data Protection Agency) (opens in a new tab) .

Under GDPR Art. 77, the right may also be exercised with the supervisory authority of the data subject's habitual residence, place of work, or place of the alleged infringement.