Encodify Privacy Policy
This Privacy Policy applies to Encodify A/S, and its subsidiaries, including Encodify Spain SL, and Encodify Ltd. where the relevant entity acts as data controller for the processing described below (each, as applicable, “Encodify”, “we”, “us” or “our”). The relevant controller is generally the Encodify entity with which you or your organisation contracts or otherwise interacts. Encodify is the controller for processing relating to the Encodify website and centrally managed marketing communications.
When we process personal data on a customer’s instructions through our SaaS platform, we act as a processor under the customer’s Data Processing Agreement (DPA). Those instructions determine the permitted use and retention of the data we process on its behalf. The customer’s privacy notice explains that processing. Unless otherwise stated, the processing activities described below concern processing for which Encodify acts as data controller.
This policy explains how we handle personal data in accordance with the EU GDPR and applicable national data protection laws. For UK-specific adaptations, see the UK Addendum at the end of this document.
Our services may contain links to external sites. We are not responsible for their privacy practices.
How we collect personal data
We collect personal data in the following ways:
- Directly: When you create an account, communicate with us, contact support, or subscribe to communications.
- From your organisation: Business contact details provided to manage our services.
- Automatically: Technical data (IP address, browser type, device information, and cookies) collected during your visits.
- From third-party business sources: Business contact and professional information obtained from approved B2B data providers for business development and sales outreach.
Core processing activities
Where we rely on legitimate interests, the interests pursued are the specific business purposes described for the relevant activity below.
Business operations & support
- Communication & service delivery: We process names, company emails, phone numbers, and job titles and other professional information to manage prospective and existing business relationships, support business development and deliver products.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR)
- Retention: Personal data is retained for the duration of the business relationship and thereafter only for as long as necessary for the relevant purposes or to meet applicable legal, contractual or legitimate business requirements.
- Customer support: We process contact details and support request history to resolve platform issues.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
- Retention: Support records are retained for the duration of the business relationship and thereafter only for as long as necessary for the relevant purposes or to meet applicable legal, contractual or legitimate business requirements. Customer content processed on a customer's behalf is retained in accordance with the applicable DPA and customer instructions.
- Bookkeeping: Invoice details and related financial data are processed for statutory compliance.
- Legal basis: Compliance with applicable accounting and tax law (Art. 6(1)(c) GDPR/UK GDPR, as applicable).
- Retention: For the period required by applicable accounting and tax law in the relevant jurisdiction.
- Service improvement: Account identifiers, company information and service-usage data to improve features, performance and user experience.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Where non-essential analytics or tracking require consent, we rely on consent (Art. 6(1)(a) GDPR).
- Retention: Identifiable service-usage data is retained only for as long as necessary for the relevant purpose, after which it is deleted or anonymised. Records relevant to a security incident or legal claim may be retained longer where necessary for that specific purpose.
Platform account management
Where platform account or collaboration processing is carried out solely on a customer's instructions, Encodify acts as processor and the applicable DPA and customer instructions govern that processing and retention. Where Encodify processes account or security information for its own purposes, Encodify acts as controller as described below.
- Account administration: Account numbers, names, usernames, authentication information, including password hashes where applicable, and company details are used to verify identity and secure access.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
- Retention: Authentication information is retained only while needed to provide and secure access. Other account administration records are retained for the duration of the account or business relationship and thereafter only for as long as necessary for the relevant purposes or to meet applicable legal, contractual or legitimate business requirements.
- In-platform collaboration: User profile information and other personal data entered ƒby customer users into platform fields or workflows is processed on the customer's instructions. Encodify acts as processor for this processing, and the applicable DPA and customer instructions govern its use and retention.
Marketing & Social Media
- Newsletters: Names, email addresses and subscription preferences are used for direct marketing updates.
- Legal basis: Consent (Art. 6(1)(a) GDPR) for sending newsletters. After withdrawal or objection, limited suppression records are processed as necessary to comply with applicable legal obligations (Art. 6(1)(c) GDPR/UK GDPR, as applicable) and to ensure your marketing preference is respected.
- Retention: While subscribed. After withdrawal, limited consent and suppression records are retained where necessary to comply with applicable legal obligations and to ensure your marketing preference is respected.
- Social Media: Interactions, comments, and reactions on our corporate social channels are processed for brand engagement.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
- Retention: While the post or interaction remains available to us; the platform’s own retention rules also apply.
Where joint controllership applies, the relevant platform’s privacy information and applicable arrangement explain the respective responsibilities. Further information is available from us on request.
Fraud prevention & security
- Activity monitoring: Account IDs, names, and access histories are monitored to detect fraudulent behavior and defend platform infrastructure.
- Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
- Retention: Access and security information is retained only for as long as necessary to prevent, detect, investigate and document security incidents and to meet applicable legal, contractual or security requirements.
When the applicable retention period ends, personal data is securely deleted or anonymised unless continued retention is required by law or necessary for the establishment, exercise or defence of legal claims.
Data sharing & third countries
We share personal data with the following categories of recipients where necessary and permitted by applicable law:
- Service providers: Hosting, CRM, support and other service providers acting under appropriate data-protection terms. A list of active sub-processors is available at our compliance portal. https://trust.encodify.com/
- Business partners: Partners involved in co-branded events or integrated services, where necessary for the relevant activity.
- Legal authorities: Where disclosure is necessary to comply with a legal obligation (Art. 6(1)(c) GDPR).
- Corporate transactions: Potential buyers and advisers where necessary for our legitimate interests in a merger, acquisition or sale, with appropriate confidentiality safeguards (Art. 6(1)(f) GDPR).
International transfers
Personal data covered by this Policy is not transferred outside the EEA and the United Kingdom. Transfers from the EEA to the United Kingdom rely on the European Commission's adequacy decision.
Cookies & analytics
We use cookies and similar technologies necessary to operate our website. Non-essential analytics or tracking are used only with your consent where required by applicable law. You can change or withdraw consent through the website's cookie settings. For more information, see our Cookie Policy.
https://www.encodify.com/legal/cookieChildren
Our services are intended for business use and are not directed at children. Please contact us with concerns about a child’s personal data.
Your data protection rights
Subject to the conditions and exceptions in applicable law, you may:
- Access & rectification: Request a copy of your personal data or update incorrect information.
- Erasure & restriction: Request deletion or restricted processing of your data under specific conditions.
- Data portability: Where processing is based on consent or contract and carried out by automated means, receive the personal data you provided in a structured, commonly used and machine-readable format.
- Objection: Object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time; we will stop processing your personal data for that purpose.
- Withdraw consent: Withdraw at any time, without affecting the lawfulness of earlier processing. Providing consent is voluntary.
- Automated decision-making: Where EU GDPR applies, you have the right, subject to applicable exceptions, not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. UK-specific rules are described below.
- Lodge a complaint: You may complain to us or to a competent supervisory authority, including in the EEA country where you live, work or where the alleged infringement occurred. In Denmark, the supervisory authority is Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark (dt@datatilsynet.dk). UK complaints are addressed below.
Contact us
Contact our Privacy Lead at privacy@encodify.com for questions, complaints or rights requests.. We respond to rights requests without undue delay and within the applicable statutory timeframe, subject to lawful extensions or exceptions. Rights requests are generally handled free of charge, subject to exceptions permitted by applicable law. For customer-controlled data, contact the customer; we assist as processor.
At collection, we explain any legal or contractual requirement to provide data and the consequences of withholding it, including inability to provide the requested service.
Security & policy updates
We use appropriate technical and organisational safeguards and handle incidents and required notifications under applicable law. We take reasonable steps to keep personal data accurate and up to date where necessary. We monitor compliance with our privacy policies and procedures and take appropriate corrective action where issues are identified. We review this policy at least annually and when material changes occur and publish updates, with additional notice or renewed consent where required.
United Kingdom Addendum (UK GDPR)
This section applies exclusively where UK data protection law applies.
- Governing framework: Data is processed in compliance with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
- Data transfers: Transfers from the UK to the EEA rely on UK adequacy regulations.
- Automated decisions: Where a significant decision is based solely on automated processing, Encodify implements specific safeguards required by UK law, including your right to obtain human intervention, express your point of view, contest the outcome and receive information about the decision.
- Complaints: You may complain to us at privacy@encodify.com. We acknowledge UK data protection complaints within 30 days and handle them without undue delay, including appropriate progress updates and an outcome. You may also complain to the Information Commissioner's Office (ICO).
.png)
