Privacy Policy

Last updated: Oktober 2026

LIK A/S ("LIK", "we", "us") is the data controller for the personal data collected through lik.dk (the "Website"). This policy explains what we collect, why we collect it, the legal basis we rely on, how long we keep it, and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Danish Data Protection Act (Databeskyttelsesloven, Act no. 502 of 23 May 2018).

1. Data controller

LIK A/S
Maserativej 5, 7100 Vejle, Denmark
CVR no.: 25353536
Email: info@lik.dk
Telephone: +45 76 49 84 84

For questions about this policy or to exercise your rights, contact us at info@lik.dk.

2. Scope

This policy applies to visitors to the Website, to people who contact us through the Website, and to subscribers to our newsletter. It does not cover personal data processed as part of an established customer or supplier relationship, which is governed by our Sales & Delivery Terms, or personal data about our employees.

The Website is directed at businesses and professionals. It is not intended for children, and we do not knowingly collect personal data from anyone under the age of 13.

3. What we process, why, and on which legal basis

Contact and quote request forms

Personal data: Name, company, job title, email address, telephone number, country, the content of your message.
Purpose: To answer your enquiry, prepare quotes and follow up on your request.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a quote or an agreement you have asked for; otherwise Art. 6(1)(f) GDPR – our legitimate interest in responding to business enquiries.

Newsletter (Squarespace Email Campaigns)

Personal data: Email address, [first name, last name, company], date, time and source of sign-up and of your confirmation, record of your consent, and whether you open our emails or click links in them (including device and approximate location data).
Purpose: To send you news about products, projects, knowledge and events from LIK, and to measure how our newsletters are read.
Legal basis: Art. 6(1)(a) GDPR – your consent, which you confirm by clicking the link in our confirmation email (double opt-in), collected in accordance with section 10 of the Danish Marketing Practices Act (Markedsføringsloven).

Website operation and security

Personal data: IP address, browser and device information, date and time of access, pages requested, referring page.
Purpose: To deliver the Website, keep it secure, prevent spam and abuse, and fix technical errors.
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure and functioning website. The cookies used for this are strictly necessary and do not require consent (see our Cookie Policy).

Website statistics (Squarespace Analytics)

Personal data: A pseudonymous visitor ID stored in a cookie, pages viewed, session duration, traffic source, device and browser type, approximate location (country/city) derived from your IP address.
Purpose: To understand how the Website is used and improve its content and structure.
Legal basis: Art. 6(1)(a) GDPR – your consent through our cookie banner. Statistics cookies are only placed after you accept them.

Legal claims and obligations

Personal data: The data relevant to the matter in question.
Purpose: To establish, exercise or defend legal claims, and to comply with legal obligations, including bookkeeping if an enquiry leads to a sale.
Legal basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (our legitimate interest in protecting our legal position).

4. Squarespace as our data processor

The Website, its forms, its statistics and our newsletter run on the Squarespace platform. For customers outside the United States, our contracting party is Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland. Squarespace acts as our data processor under Art. 28 GDPR, on the terms of the Squarespace Data Processing Addendum, which forms part of our agreement with Squarespace. Under that agreement Squarespace:

  • processes personal data only to provide the services we have configured and on our documented instructions;

  • ensures that personnel with access to the data are bound by confidentiality;

  • maintains technical and organisational security measures, including encryption of data in transit (TLS/SSL on all pages), access controls and monitoring, as described on Squarespace's security page;

  • notifies us without undue delay if it becomes aware of a personal data breach affecting our data, and assists us in responding to requests from data subjects.

Sub-processors. Squarespace uses sub-processors to provide its services, including its US parent company, Squarespace, Inc., 225 Varick Street, 12th Floor, New York, NY 10014, USA, and providers of hosting, infrastructure, email delivery and security services. Squarespace is contractually required to impose data protection obligations on its sub-processors that are equivalent to those in its agreement with us. A current list of sub-processors is available from Squarespace on request (privacy@squarespace.com), or from us.

Squarespace as an independent controller. Squarespace may also process limited data about visitors to the Website, such as IP address and device data, as an independent controller for its own purposes, for example to secure its platform, prevent fraud and improve its services. LIK does not control this processing. It is described in Squarespace's Privacy Policy.

5. Transfers of personal data outside the EU/EEA

Because Squarespace, Inc. and some of its sub-processors are located in the United States, your personal data may be transferred to and processed in the US. These transfers are based on:

  • The EU-U.S. Data Privacy Framework (DPF). On 10 July 2023 the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Squarespace, Inc. is certified under the DPF, which you can verify on the Data Privacy Framework List.

  • Standard Contractual Clauses (SCCs). If a transfer is not covered by the DPF, or if the DPF ceases to apply, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into our agreement with Squarespace and apply to the transfer (Art. 46(2)(c) GDPR). Transfers from Squarespace to sub-processors in third countries without an adequacy decision are also covered by SCCs.

You can request a copy of the relevant safeguards by contacting us.

6. Who receives your personal data

We only share your personal data where necessary for the purposes described above:

  • Squarespace, as our data processor (see section 4).

  • Professional advisers such as lawyers and auditors, who are bound by confidentiality, where necessary.

  • Public authorities, where we are required to do so by law.

Fonts (Adobe Fonts). The Website displays fonts delivered by Adobe Fonts, a service of Adobe Inc., 345 Park Avenue, San Jose, CA 95110, USA. To display the fonts, your browser connects to Adobe's servers, which receive your IP address, the page address and technical information about the font request. According to Adobe, the IP address is used only to deliver the fonts and is not stored, and no cookies are set to serve fonts. Adobe uses the remaining request data for billing and licence compliance under its own Adobe Fonts privacy terms. Our legal basis is Art. 6(1)(f) GDPR – our legitimate interest in a consistent and legible presentation of the Website. Transfers to Adobe in the US are based on the EU-U.S. Data Privacy Framework, under which Adobe Inc. is certified.

We do not sell, rent or share your personal data for advertising purposes.

7. How long we keep your personal data

We keep personal data only for as long as necessary for the purpose for which it was collected:

  • Enquiries that do not lead to a customer relationship: [12] months after our last correspondence.

  • Enquiries that lead to a customer relationship: For the duration of the relationship. Accounting records are kept for 5 years from the end of the financial year they relate to, as required by the Danish Bookkeeping Act (Bogføringsloven).

  • Newsletter subscription data: Until you unsubscribe. You are then removed from our mailing list within 30 days.

  • Documentation of newsletter consent: 2 years after you unsubscribe, so that we can document that we had your consent.

  • Website statistics: Cookie lifetimes are listed in our Cookie Policy. Statistics are stored in Squarespace Analytics according to Squarespace's retention periods and are only used in aggregated form.

  • [OPTIONAL] Job applications: 6 months after the position has been filled, unless you consent to longer storage.

  • Data needed for legal claims: Until the claim is settled or the limitation period has expired (generally 3 years under the Danish Limitation Act).

8. Your rights

Under the GDPR you have the following rights:

  • Right of access (Art. 15) – to receive confirmation of whether we process your personal data and a copy of it.

  • Right to rectification (Art. 16) – to have inaccurate data corrected and incomplete data completed.

  • Right to erasure (Art. 17) – to have your data deleted, for example when it is no longer needed or you withdraw your consent.

  • Right to restriction of processing (Art. 18) – to have the processing of your data limited in certain situations.

  • Right to data portability (Art. 20) – to receive data you have provided to us, which we process on the basis of consent or contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller.

  • Right to object (Art. 21) – to object to processing based on our legitimate interest. You can always object to direct marketing, and we will then stop.

  • Right to withdraw consent (Art. 7(3)) – at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can unsubscribe from our newsletter via the link in every email, and change your cookie choices as described in our Cookie Policy.

To exercise your rights, email info@lik.dk. We respond without undue delay and within one month. Where a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you why. Exercising your rights is free of charge. We may ask you to confirm your identity before we act on a request. Your rights may be limited in some cases under the GDPR and the Danish Data Protection Act, including section 22 of that Act.

9. Security

We use technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. Only employees who need the data for their work have access to it, and they are bound by confidentiality. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

10. Complaints

If you are dissatisfied with how we process your personal data, please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Danish supervisory authority:

Datatilsynet (The Danish Data Protection Agency)
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Telephone: +45 33 19 32 00
Email: dt@datatilsynet.dk
www.datatilsynet.dk

If you live or work in another EU/EEA country, you may also complain to the supervisory authority in that country.

11. Changes to this policy

We may update this policy when our processing or the law changes. The date at the top shows when it was last updated. If we make material changes, we will make this clear on the Website and, where appropriate, inform newsletter subscribers by email.