Privacy Policy

1.Data Controller

SERV ApS, CVR-nr. 46 04 66 09 ("SERVOS", "we", "us", or "our") is the data controller responsible for the processing of your personal data in connection with the SERVOS platform available at servos.dk (the "Platform"). This Privacy Policy is issued in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Danish Data Protection Act (Databeskyttelsesloven).

Where an Organisation uses SERVOS to manage its own customers, that Organisation acts as the data controller for its customer data and SERVOS acts as a data processor on the Organisation’s behalf, governed by a separate Data Processing Agreement.

2.Information We Collect

Account and Organisation data

• Full name, email address, phone number, and login credentials
• Organisation details including business name, VAT number, registered address, and billing information
• Role and permission data within your Organisation

Customer and booking data

• Customer names, contact details, and booking history managed by Organisations through the Platform
• Booking details including dates, services, resource allocations, and check-in/check-out records
• Invoices, payment records, and transaction identifiers processed via Stripe

Payment data

• Payment card details are collected and processed exclusively by Stripe, Inc. and are never stored on SERVOS servers
• We receive and store only transaction identifiers, payment status, and truncated card information (last four digits, expiry, card brand) returned by Stripe

Technical and usage data

• IP address, browser type and version, operating system, device identifiers, and referring URLs
• Pages visited, features used, click paths, session duration, and timestamps
• Error logs and performance data necessary for maintaining and improving the Platform

SERVOS Staff mobile app

Staff of an Organisation can use the SERVOS Staff app for iOS. It shows the same Organisation data as the Platform (rooms, guests, bookings and tasks) and collects, in addition:

• The name of your device, stored with your session when you sign in
• A push notification token for your device, if you allow notifications, used only to send you notifications about your Organisation
• Content you enter in the app, such as tasks, which may name your Organisation's guests

Notifications show on your lock screen, so they name a room at most and never a guest or the text of a task. The app contains no advertising and no tracking, and shares no data with third parties for advertising.

3.Legal Basis for Processing

We process your personal data only where we have a lawful basis under Article 6(1) of the GDPR:

• Performance of a contract (Art. 6(1)(b)) — to create and maintain your account, process bookings, handle payments, and provide the services you or your Organisation have subscribed to
• Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the Platform; to detect and prevent fraud; to send service-related communications; and to conduct aggregated analytics. We have assessed that these interests are not overridden by your rights and freedoms
• Legal obligation (Art. 6(1)(c)) — to comply with applicable tax, accounting, and regulatory requirements under Danish and EU law
• Consent (Art. 6(1)(a)) — where you have given explicit consent, for example for optional marketing communications or non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal

4.How We Use Your Information

• Provide, operate, and maintain the Platform and its core features including bookings, availability management, invoicing, and customer management
• Process payments and issue invoices through our integration with Stripe Connect
• Authenticate users, enforce access controls, and maintain the security and integrity of your account
• Send transactional communications such as booking confirmations, payment receipts, and account notifications
• Monitor Platform performance, diagnose technical issues, and develop new features
• Detect, investigate, and prevent fraudulent, unauthorised, or illegal activity
• Comply with legal obligations including tax reporting, bookkeeping requirements, and responses to lawful requests from public authorities

5.Data Sharing and Sub-Processors

We do not sell, rent, or trade your personal data. We share personal data only in the following circumstances:

Sub-processors

We engage the following categories of sub-processors, each bound by data processing agreements that impose obligations equivalent to those in the GDPR:

• Stripe, Inc. — payment processing and Stripe Connect services (USA, EU Standard Contractual Clauses in place)
• Cloud infrastructure providers — hosting, storage, and compute services within the EU/EEA
• Email delivery services — transactional email delivery for booking confirmations and account notifications
• Application monitoring services — error tracking and performance monitoring to maintain Platform reliability
• Apple Inc. — the Apple Push Notification service, which delivers SERVOS Staff app notifications to your device (USA, safeguards as described in Section 6)

Other disclosures

• To law enforcement, regulatory authorities, or courts when required by applicable law or a binding legal order
• To protect the rights, property, or safety of SERVOS, our users, or the public
• In connection with a merger, acquisition, or sale of all or a portion of our assets, in which case you will be notified of any change in controller

6.International Data Transfers

Your personal data is primarily stored and processed within the European Union / European Economic Area. Where a transfer to a country outside the EU/EEA is necessary (for example, to Stripe in the United States), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

• European Commission adequacy decisions (Art. 45 GDPR)
• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by transfer impact assessments where required

You may request a copy of the relevant safeguards by contacting us at the address below.

7.Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Account data — retained for the duration of your active account and deleted within 90 days of account closure, unless longer retention is required by law
• Booking and transaction records — retained for five years following the end of the financial year in which the transaction occurred, in accordance with the Danish Bookkeeping Act (Bogføringsloven)
• Push notification tokens — deleted when you sign out of the SERVOS Staff app, or when Apple reports a token as no longer valid
• Technical logs — retained for up to 12 months for security and debugging purposes, then anonymised or deleted
• Marketing consent records — retained for as long as the consent is valid and for a further period of three years to document compliance

When personal data is no longer required, it is securely deleted or irreversibly anonymised.

8.Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest
• Strict access controls and role-based permissions within the Platform and our internal systems
• Multi-tenant data isolation ensuring that each Organisation can access only its own data
• Regular security reviews and dependency auditing
• Secure handling of authentication credentials including hashed and salted passwords

No method of transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Danish Data Protection Agency (Datatilsynet) within 72 hours and, where required, notify you without undue delay.

9.Your Rights Under the GDPR

Under the GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 14.

• Right of access (Art. 15) — obtain confirmation of whether we process your data and request a copy
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your data where there is no compelling reason for continued processing
• Right to restriction (Art. 18) — request that we restrict processing in certain circumstances, for example while we verify the accuracy of your data
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format and transmit it to another controller
• Right to object (Art. 21) — object to processing based on legitimate interests, including profiling, and to direct marketing at any time
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing
• Right not to be subject to automated decision-making (Art. 22) — we do not currently use automated decision-making or profiling that produces legal effects concerning you

We will respond to all legitimate requests within one month. In complex cases or where we receive a high volume of requests, this period may be extended by a further two months, in which case we will inform you of the delay and the reasons for it.

10.Cookies and Tracking Technologies

Strictly necessary cookies

These cookies are essential for the Platform to function. They maintain your authenticated session, remember your security preferences, and enable core features such as navigation and access to secure areas. They cannot be disabled without impairing the Platform. No consent is required for strictly necessary cookies under the ePrivacy Directive.

Analytics cookies

With your consent, we may use analytics cookies to understand how visitors interact with the Platform. These cookies collect information in an aggregated form to help us improve performance and user experience. You may withdraw your consent at any time through your browser settings or our cookie consent mechanism.

We do not use third-party advertising cookies or cross-site tracking technologies.

11.Children’s Privacy

The Platform is designed for use by businesses and their authorised personnel. It is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us immediately.

12.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on the Platform prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically. Continued use of the Platform after any changes constitutes your acknowledgement of the updated policy.

13.Complaints

If you are unsatisfied with our response to a privacy concern, you have the right to lodge a complaint with the Danish Data Protection Agency:

14.Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: