PRIVACY POLICY

How DocWeld handles personal data

Last updated: 14 September 2026

1. Who we are

DocWeld ApS (CVR 43425447), Holmstrupvej 20, 5250 Odense SV, Denmark, is the data controller for the processing described in this policy. Contact us about anything privacy-related at contact@docweld.com. We have not appointed a data protection officer, as one is not required for a company of our size and activities.

2. If you use the DocWeld application through your employer

This is the most important distinction in this policy, so it comes first.

If you use the DocWeld application as an employee (or contractor) of one of our customers, your employer – not DocWeld – is the data controller for the data in the application: your user account, the welds, inspections and work you log, uploaded certificates, photos and the reports generated from them. DocWeld processes that data on your employer's behalf and on their instructions, under a data processing agreement with your employer, as a data processor under the GDPR, and your employer's own privacy notice governs it.

This means requests about that data – access, correction, deletion and so on – should go to your employer. If you send such a request to us instead, we will pass it on to your employer and act only on their instruction.

The DocWeld application and its data are hosted on Google Cloud in the EU. One processing step, turning a finished report into a PDF, uses DocRaptor, a US rendering service, under a data processing agreement with the EU Standard Contractual Clauses; the report content is deleted immediately after each render. The full list of sub-processors is in the data processing agreement with your employer.

The rest of this policy covers the processing DocWeld controls itself: our website, and the running of our own business.

3. Website visitors

Our website sets no cookies and runs no analytics – no tracking cookies, no advertising cookies, no visitor statistics, nothing stored on your device. There is consequently no cookie banner, because there is nothing to consent to. If we ever introduce analytics or marketing cookies, we will update this policy first and ask for your consent where the law requires it.

The site is hosted on Google's Firebase Hosting (Google Cloud EMEA Limited, Ireland). To deliver and protect the site, Google transiently processes technical data such as your IP address and browser type (user agent), and its content delivery network may serve the site from servers around the world. We do not receive or keep any record that identifies individual visitors.

Legal basis: our legitimate interest (GDPR art 6(1)(f)) in operating and securing our website – processing we judge minimal and low-intrusion.

4. When you contact us

If you email or call us, or book a demo through our booking page, we process the data you provide – your name, contact details and the content of your message – to answer you and handle whatever the enquiry is about. Bookings are handled in our Microsoft 365 calendar.

Legal basis: steps taken at your request prior to entering a contract (art 6(1)(b)) where the enquiry concerns becoming a customer; otherwise our legitimate interest (art 6(1)(f)) in corresponding with the people who contact us.

Retention: see section 9.

5. Customers, business contacts and prospects

We process ordinary contact data about the people at our customers, prospective customers and business partners: name, employer, job title, work email and phone, and notes from our dealings (meetings, feedback, agreements). We use it to manage customer relationships, provide support, follow up with prospective customers and develop our business. Where we did not receive this data from you directly, it typically comes from your employer or colleagues, a referral, or public sources such as your company's website or company registers.

If you agree to give a testimonial, we publish your name, role and quote on our website. That is based on your consent, which you can withdraw at any time – we will then take it down.

Legal basis: our legitimate interest (art 6(1)(f)) in administering the relationship with your employer – the contract is with your employer, not with you personally, so contract performance itself is not the basis for processing your data; our legitimate interest in marketing our services to relevant businesses where you are a prospect; and your consent for a published testimonial. We do not send marketing to anyone who has objected, and we contact prospects only where the law of their country allows it.

Retention: see section 9.

6. Suppliers and partners

We process contact details of the people at our suppliers and partners (name, role, work contact details, correspondence) to manage those relationships, and supplier billing data to pay invoices and keep our books.

Legal basis: performance of a contract / legitimate interest (art 6(1)(b) and (f)); legal obligation (art 6(1)(c)) for accounting records under the Danish Bookkeeping Act.

7. Who we share data with (recipients)

We do not sell personal data. We share it only with the service providers that run our business infrastructure, in these categories:

• IT, hosting and email – Microsoft 365 (email, calendar, bookings, file storage); Google (website hosting; the DocWeld application itself runs on Google Cloud in the EU); DocRaptor (PDF rendering for the application, see section 2).
• Bookkeeping and invoicing – Visma Dinero.
• AI tools – an AI assistant from Anthropic supports our internal administration; our data is not used to train its models.
• Internal notifications – Telegram (short notifications to our own phone about incoming mail, which can contain a sender's name and subject line).
• Software development and backup – GitHub.

These are categories, not an exhaustive vendor list; we keep the full register internally and hold data processing agreements with the providers that process personal data on our instructions. We may also disclose personal data to public authorities where the law requires it.

8. Transfers outside the EU/EEA

Some of our providers (including Google, Microsoft, Anthropic, DocRaptor and GitHub) are US companies, so personal data can be transferred to the United States. Where the provider is certified under the EU–U.S. Data Privacy Framework, we rely on that certification; where we have a commercial agreement with the provider, it also includes the European Commission's Standard Contractual Clauses. Our AI assistant provider, Anthropic, is certified under the Data Privacy Framework and does not use our data to train its models. Telegram, which we use only for short internal notifications, is not covered by these arrangements, so those notifications carry as little personal data as possible. You can request a copy of the relevant safeguards via contact@docweld.com. The DocWeld application and its data are hosted in the EU; section 2 describes the one rendering step that is not.

9. How long we keep data

We keep personal data no longer than we need it for the purpose it was collected for. In brief:

• Enquiries and correspondence – for as long as the matter is live, plus a reasonable period in case it resumes.
• Customer and contract data – for the duration of the relationship, then as long as needed to document it; accounting material is kept for 5 years after the financial year, as Danish bookkeeping law requires.
• Prospect data – for as long as a future relationship is realistic, and never after you object.
• Website technical data – transiently, by our hosting provider, for delivery and security.

The detailed criteria per category are set out in our internal retention policy; ask us if you want more specific information about a category.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have data erased ("right to be forgotten"), where the conditions are met;
• have processing restricted;
• data portability – receive data you provided in a machine-readable format, where processing is based on contract or consent;
• object to processing based on our legitimate interests, including to direct marketing at any time;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

You are not obliged by law or contract to provide us with personal data – but without basic contact details we cannot answer an enquiry or manage a business relationship with your company.

To exercise any right, email contact@docweld.com. We respond within one month. If you are an employee of one of our customers asking about data in the DocWeld application, see section 2 – we will route your request to your employer.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk – though we would appreciate the chance to resolve your concern first.

11. Changes to this policy

We update this policy when our processing or providers change, and at least review it annually. The "last updated" date at the top shows the current version; material changes will be noted on the website.