Privacy.
No cookies, no tracking, no analytics. What the forms do with what you write, and what the host logs.
The legal basis column explains why I may process your personal data under the General Data Protection Regulation (GDPR).
| What | Why | Legal basis |
|---|---|---|
| Cookiesnone | ||
| Analytics and trackingnone | ||
| Your browserone setting: motion paused | so the site remembers your choice | No personal data is processed. |
| Contact formname, email, message | to reply to you | Legitimate interests in responding to your enquiry (GDPR Article 6(1)(f)). |
| Enquiry formdescription, email | to reply to you | Legitimate interests in responding to your enquiry (GDPR Article 6(1)(f)). |
| Quote formkind of work and areas, description, name, email, company if given | to give you a price | Performance of a contract or steps at your request before entering into one (GDPR Article 6(1)(b)). |
| Ad form (Meta)name, company, phone, work email and your answer to the question | to call or email you about your enquiry | Your consent to my calling or emailing you about your enquiry (GDPR Article 6(1)(a)). |
| Newsletternone | ||
| Mail service (Resend)the contents of form mails, kept 30 days in the USA | to deliver the mail to my inbox | Same legal basis as the form you use (GDPR Article 6(1)(b) or (f)). |
| Inbox and sheet (Google Workspace)the mails you send me, and the answers from the ad form in a Google Sheet | so I can answer them and keep track of enquiries | Legitimate interests in reading and responding to your emails (GDPR Article 6(1)(f)). If the enquiry came from the ad form, the basis is your consent (Article 6(1)(a)). |
| Automation (Make)the answers from the ad form on their way from Meta to Attio and my Google Sheet, logged for 7 days in Make's EU zone | so the answers reach me | Same legal basis as the ad form (GDPR Article 6(1)(a)). |
| CRM (Attio)name, email, company and phone if given, the text or answer from the form and public details Attio adds itself, kept in the EU or the USA | so I can keep track of enquiries | Legitimate interests in managing your enquiry (GDPR Article 6(1)(f)). If it comes from the ad form, the basis is your consent (Article 6(1)(a)). |
| Hosting (Vercel)request logs: IP address, time, page, browser type, for one day | operation and debugging | Legitimate interests in operating and troubleshooting the site (GDPR Article 6(1)(f)). |
| Outbound links (LinkedIn)a plain link without scripts | so you can find me on LinkedIn | No personal data is processed here. Once you click, LinkedIn is the data controller. |
The contact, quote and enquiry forms
The contact form sends name, email and message. The quote form also sends what kind of work it is, which areas it covers, a short description, and your company if you give one. The enquiry form sends only a short description and your email. I only get your name if you write it in the description.
The fields go to a route on the same server, which puts them together into one email and sends it to me through the mail service Resend, with your address as reply-to. The route runs on Vercel's servers in Stockholm. If the mail cannot be sent that way, the form opens your own mail app with the same text instead. Then the mail does not pass through my server at all. Either way it ends up in my inbox at Google Workspace.
The server itself keeps no copy, but puts the enquiry into Attio. It only remembers in memory when attempts came from your IP address, so that no more than five mails can be sent per 10 minutes. None of it is written down, and it is gone when the server restarts. A hidden field no person ever fills stops robots: if it is filled, nothing is sent.
The form in my ads
If you answer one of my ads on Facebook or Instagram, you fill in a form at Meta, not here on the site. It is in Danish and asks for name, company, phone number and work email. It also asks “Where should we start?” and lets you choose between “Design and marketing”, “Website, web shop or app”, “Workflows and automation” and “Something else”. There is no free-text field. Name and phone number are prefilled with details from your profile. If you say yes, I may call or email you about that enquiry and nothing else. When you send the form, the automation service Make moves the answers from Meta to Attio and my Google Sheet. Make handles them only on my instructions, runs in its EU zone and keeps a log of each transfer for 7 days, with your answers in it. Once your answers are in, I look your company up in the public Danish CVR register to see how many people it employs. I do this on the basis of my legitimate interest in preparing the call (GDPR Article 6(1)(f)).
Meta Platforms Ireland collects the answers under Meta's Lead Ads terms and is itself the data controller for your profile and for its own copy of your answers. Meta decides who sees the ad, based on the area and interests I choose. For the targeting and the form, Meta and I are joint controllers (GDPR Article 26): I choose the audience and the questions, and Meta shows the ad and collects the answers. The targeting rests on the consent to personalised ads you gave Meta (GDPR Article 6(1)(a)), and you can withdraw it in your ad settings at Meta. I do not see who is in the audience, and you can exercise your rights against both Meta and me. There is no Meta pixel here on the site.
Hosting, logs and what your browser keeps
The site is hosted on Vercel. As the host, Vercel keeps its own request logs, typically IP address, time, browser type and which page was fetched. I did not set them up and they are there whatever I do. Vercel keeps them for one day, and I use them only for operation and debugging.
The mail service Resend delivers form mails to my inbox, so it sees what you wrote in the form. Resend sends from servers in Ireland and keeps each mail for 30 days in the USA.
If you pause motion with the button in the menu, your browser remembers it in one setting. Only the site itself reads it, and it goes away again when you turn motion back on. Otherwise the site keeps nothing in your browser. Fonts, images and video are served from the site itself, not from third parties.
The footer links to my page on LinkedIn. If you click it you leave this site, and LinkedIn's own terms apply. There are no LinkedIn scripts, share buttons or other third-party embeds here.
How long and where
I delete enquiries that do not turn into a job no later than 12 months after the last contact, in Attio and my Google Sheet too. If you have said no to being contacted, I keep your no as described under “Your rights”. If one becomes a job, I keep all of it for as long as we work together. I keep the part that belongs to the accounts for five years, as Danish bookkeeping law requires.
Vercel, Resend and Google are American companies and can access data from the USA, where Resend also stores form mails. Attio may process data outside the EU, the USA included. The transfers are covered by the EU standard contractual clauses in all four companies' data processing agreements, Attio's included, and Resend is also covered by the EU-U.S. Data Privacy Framework. Make stores data in its EU zone, but my agreement is with the American company Celonis, Inc. Transfers to Celonis are made under the EU-U.S. Data Privacy Framework, and Make's data processing agreement has the EU standard contractual clauses as a fallback. Meta is not my processor and processes the answers from the ad form under its own terms, the USA included.
Your rights
I only hold the mails you sent me yourself and the answers you gave in the ad form. In Attio I hold the same details plus the public ones Attio adds itself, and in my Google Sheet I hold your answers from the ad form. There is no newsletter. You can always ask what I have, have it corrected or deleted, and have its processing restricted. If you used the quote form or the ad form, you can also get your details in a common machine-readable format. I do have to keep anything that belongs in my accounts for five years. Write to me at rasmus@tek-aerobic.dk.
You can object to anything I process on the basis of legitimate interests (GDPR Article 21). Write to rasmus@tek-aerobic.dk and tell me what it is about your particular situation that makes you object. I will then stop unless I can show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.
If you said yes in the ad form, you can withdraw your consent at any time, as easily as you gave it (GDPR Article 7(3)). Write one line to rasmus@tek-aerobic.dk, or tell me when I call. I will then delete your details in Attio and in my Google Sheet. I keep only your company's name and a note that you do not want to be contacted, so you do not hear from me again by mistake. I keep the company name and the note solely to respect your no, on the basis of my legitimate interest (GDPR Article 6(1)(f)). I delete both if I stop contacting companies myself. The log at Make deletes itself after 7 days at most. Processing before you withdrew your consent stays lawful.
The data controller is Tek Aerobic v/ Rasmus Brandt, a sole proprietorship, CVR 39948346, Valdemarsgade 40, 3. tv., 1665 København V, Denmark, rasmus@tek-aerobic.dk. If you think I handle your information wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet).