Privacy & Cookie Policy

At a Glance

Prowi ApS operates a commission management platform. We collect contact info, account data, and usage analytics. When processing employee salary data for our customers, your employer is the data controller and we act as their processor. We store data in the EU (Frankfurt/Stockholm), use cookies with your consent, and don't sell your data.

1. Who We Are

Data Controller: Prowi ApS (CVR: 43243977) | Klamsagervej 35, 8230 Åbyhøj, Denmark | legal@prowi.io | +45 70604554

Data Protection Officer: We have not appointed a Data Protection Officer as we do not meet the GDPR criteria requiring one (we do not conduct large-scale processing of special categories of data or systematic monitoring at the scale requiring a DPO).

Our roles: We're the data controller when you visit our website or create an account. When you're an employee whose data is processed via Prowi by your employer, your employer is the controller and we're the processor following their instructions under a Data Processing Agreement.

2. What We Collect

You provide: Name, email, phone, company name, job title, account credentials, and support communications.

We collect automatically: Device info, IP address (anonymized for analytics), usage data, and cookies.

Customer employee data: When processing for employers, we handle employee names, emails, salary info, and commission data as a processor.

3. Legal Basis & How We Use Your Data

Contractual necessity: To provide the platform, manage accounts, process commissions, communicate about services, and provide support.

Legitimate interests: For platform improvement, usage analytics, and security/fraud prevention. We've assessed that these interests don't override your rights. You can object at legal@prowi.io.

Consent: For marketing communications and non-essential cookies (analytics, marketing, functionality). You can withdraw anytime.

Legal obligation: To comply with bookkeeping, tax, and employment laws.

4. Cookies

How we obtain cookie consent: When you first visit our website, we display a cookie banner that requires your active consent before placing any non-essential cookies. You have granular control to accept or reject cookies by category (analytics, marketing, functionality). No cookies are pre-selected, and you can reject all non-essential cookies. Essential cookies necessary for platform functionality are placed automatically as they don't require consent under ePrivacy rules.

Analytics: Google Analytics tracks anonymized usage (2 years). Google acts as an independent controller of this data for their own purposes. Opt out via browser add-on or cookie preferences.

Marketing: HubSpot tracks engagement (13 months) and may use this data for profiling to understand visitor interests, though this does not produce legal effects or significantly affect you. HubSpot acts as an independent controller of this data.

Functionality: Language and timezone preferences (1 year). Control all cookies via browser settings or our cookie preferences tool.

Cookie Reference

Third-party cookie policies: Google (policies.google.com/technologies/cookies) | HubSpot (legal.hubspot.com/cookie-policy)

5. Sharing Your Information

We may share your personal data in the following circumstances:

Service Providers

We work with third-party service providers who help us operate our platform and deliver our services. These include cloud hosting providers (Heroku/AWS), analytics services (Google Analytics), marketing automation tools (HubSpot), and other business tools. These service providers process personal data on our behalf and are contractually obligated to protect your data and use it only for the purposes we specify.

Legal Requirements

We may disclose your personal data when required by law, regulation, legal process, or governmental request. This includes responding to court orders, complying with tax obligations, and cooperating with law enforcement when legally required.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Important Commitments

We do not sell your personal data to third parties.

For a complete and current list of our sub-processors, please visit www.prowi.io/sub-processors. We provide our customers with 30 days' advance notice of any new sub-processors, and customers have the right to object to such changes.

6. International Data Transfers

Data Storage Location

Your personal data is stored and processed exclusively within the European Union. We use the following infrastructure:

Primary hosting: AWS EU-Central-1 (Frankfurt, Germany) via Heroku

Database: AWS EU-North-1 (Stockholm, Sweden)

No Third-Country Transfers

Prowi does not transfer your personal data outside the European Economic Area (EEA). All data processing by Prowi takes place within the EU using EU-based infrastructure and data centers.

Third-Party Cookie Services

Please note that when you consent to analytics and marketing cookies, third-party services (Google Analytics and HubSpot) act as independent data controllers for data collected via their cookies. These services have their own data processing practices and may process data outside the EEA in accordance with their own privacy policies and legal safeguards (such as Standard Contractual Clauses and Data Privacy Framework certifications). You can object to this processing by disabling analytics and marketing cookies in your cookie preferences.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Upon termination of your account or at your request, we will delete your data unless retention is required for legal or legitimate business purposes.

Retention Periods

Active account data: Duration of your account plus 1 year. This additional year allows for the resolution of disputes, legal claims, and chargebacks in accordance with Danish statute of limitations (forældelsesloven).

Transaction and commission records: 5 years from the end of the relevant financial year, as required by Danish bookkeeping law (bogføringsloven § 10).

Marketing data: Until you withdraw your consent. Once consent is withdrawn, we will stop processing your data for marketing purposes and delete it from our marketing systems.

Support correspondence: 3 years after the last contact to allow us to reference historical support issues and maintain service quality.

8. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

Right of access: You can request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format.

Right to rectification: You can request that we correct any inaccurate or incomplete personal data we hold about you.

Right to erasure (right to be forgotten): You can request that we delete your personal data. This right is subject to certain legal exceptions, such as when we are required to retain data for legal compliance.

Right to restriction of processing: You can request that we limit how we process your data in certain circumstances, such as when you contest the accuracy of the data.

Right to data portability: You can request to receive your personal data in a structured, commonly used, and machine-readable format (typically JSON or CSV) and have the right to transmit that data to another controller.

Right to object: You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Right to withdraw consent: Where processing is based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.

Direct Marketing

You have an absolute right to object to direct marketing at any time. This means we will stop sending you marketing communications immediately upon your request, with no questions asked. You can exercise this right by:

Contacting us at legal@prowi.io

Clicking the 'unsubscribe' link in any marketing email

How to Exercise Your Rights

To exercise any of these rights, please contact us at legal@prowi.io. We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request to protect your personal data from unauthorized access.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Commission calculations are automated based on your employer's commission rules, but these calculations are transparent, explainable, and reviewed by your employer before payment is made. You can challenge any calculation by contacting your employer or our support team at legal@prowi.io.

9. Security Measures

We take the security of your personal data very seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

Technical Security Measures

Encryption: All data in transit is encrypted using TLS (Transport Layer Security). All data at rest is encrypted using AES-256 encryption.

Two-factor authentication (2FA): We offer and encourage the use of two-factor authentication to protect account access.

Access controls: We implement role-based access controls to ensure that only authorized personnel can access personal data, and only to the extent necessary for their job functions.

Organizational Security Measures

Regular security reviews: We conduct regular security audits and vulnerability assessments.

Security monitoring: We maintain ongoing monitoring of our systems to detect and respond to security incidents.

Certified infrastructure: Our cloud infrastructure is hosted on AWS and Heroku, which maintain SOC 2 Type II and ISO 27001 certifications.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Danish Data Protection Agency (Datatilsynet) within 72 hours of becoming aware of the breach. We will also notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms. Our notification will include information about the nature of the breach, its likely consequences, and the measures we have taken or propose to take to address the breach and mitigate its potential adverse effects.

10. Children's Privacy

Our Service is not intended for use by individuals under the age of 13, which is the age of digital consent in Denmark under GDPR Article 8. We do not knowingly collect personal data from children under 13 years of age.

If you are a parent or guardian and believe that we have collected personal data from your child, please contact us immediately at legal@prowi.io. We will take steps to verify the information and promptly delete any personal data we have collected from children under 13.

11. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. When we make significant changes, we will notify you by:

Posting the updated policy on our website at www.prowi.io/privacy

Updating the "Last Updated" date at the top of this policy

For material changes, sending you an email notification (if you have provided us with your email address)

We encourage you to review this Privacy & Cookie Policy periodically to stay informed about how we are protecting your personal data. Previous versions of this policy are available upon request by contacting us at legal@prowi.io.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy & Cookie Policy, or if you wish to exercise any of your data protection rights, please contact us:

Prowi ApS

Klamsagervej 35

8230 Åbyhøj, Denmark

Email: legal@prowi.io

Phone: +45 70604554

13. Contact the Supervisory Authority

If you have concerns about our processing of your personal data or believe that we have not addressed your concerns adequately, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), which is the supervisory authority responsible for data protection matters in Denmark:

Danish Data Protection Agency (Datatilsynet)

Carl Jacobsens Vej 35

2500 Valby, Denmark

Email: dt@datatilsynet.dk

Phone: +45 33 19 32 00

Website: www.datatilsynet.dk

We encourage you to contact us first at legal@prowi.io so we can try to resolve any issues or concerns together before you approach the supervisory authority.

Processing Register

The following table provides a summary of our data processing activities in accordance with GDPR Article 30: