Privacy Policy

1 INTRODUCTION

Risika A/S, CVR no. 37677892, with offices at Danneskiold-Samsøes Allé 41, 1434 Copenhagen K, Denmark ("Risika", "we", "our", "us") is a credit information agency authorised by the Danish Data Protection Agency (Datatilsynet) to carry out credit information activities in Denmark and by the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) to carry out credit information activities in Sweden.

As a company, we process personal data as a natural part of our activities. This means that we are the data controller for our processing of information about visitors to our website, employees, business partners, visitors to our company page on social media and in connection with our activities as a credit information agency.

We are held accountable by various legal and industry standards, but also by your expectations as a data subject. This means that we listen to your wishes regarding privacy, and we are obliged to inform you about what information we process. In this privacy policy, you can read more in the following sections:

Special provisions:

Visits to our website
Customer relationships
Newsletter
Feedback
Credit information
Company events for sales and market purposes
Social media
Job applications

General provisions:

Contact details for Risika and our DPO
Recipients of personal data
Your rights
How to complain
Changes to the privacy policy

2 SPECIAL PROVISIONS

VISITS TO OUR WEBSITE

All information about our use of cookies can be found in our Cookie Policy.

You can also contact us through our contact form.

When you send us an enquiry through our contact form, we process the following information in order to reply to you:

Name
Email
Phone number
Message

If you wish to become a customer or are already a customer, our legal basis is Article 6(1)(b) of the GDPR on processing that is necessary for the performance of a contract, including correspondence prior to entering into a contract that takes place at your request.

We keep the correspondence for up to 6 months after the last contact.

We use your email to send you marketing if you have signed up for our newsletter.

Our legal basis for processing your personal data is Article 6(1)(a) of the GDPR on processing based on consent, cf. section 10 of the Danish Marketing Practices Act.

CUSTOMER RELATIONSHIPS

You can create a profile ("Profile") with us by providing your name, address, email and company affiliation.

To create a Profile, you must accept our Terms and the Privacy Policy, after which our processing of your personal data takes place as part of an agreement between you and us.

Our legal basis for processing your personal data is Article 6(1)(b) of the GDPR on processing that is necessary for the performance of a contract, including correspondence prior to entering into a contract that takes place at your request.

The same applies to our "Book a demo" function, where we ask for your email.

Your Profile information is kept until 3 months after you have chosen to close your Profile, or after you have been inactive for 3 years and have not replied to our enquiries about deleting your profile because of the inactivity.

FEEDBACK

With your consent, we would occasionally like to collect relevant feedback to make sure that the services we offer meet your requirements. We will do this through surveys, customer satisfaction analyses or market research. Any feedback you give us will be used solely to improve our services and will not be published.

Our legal basis for processing your personal data in connection with feedback is Article 6(1)(a) of the GDPR on consent.

Feedback information is kept for up to 5 years after receipt. As far as possible, we store your feedback in anonymous form, and we have a long retention period so that we can measure our own performance over time.

CREDIT INFORMATION

About credit information activities

Anyone who wishes to carry on business processing information for the assessment of financial solvency and creditworthiness for the purpose of disclosure (credit information activities) must comply with Chapter 5 of the Danish Data Protection Act and the General Data Protection Regulation, whether the credit information concerns companies or persons.

We process credit information in accordance with our authorisation from the Danish Data Protection Agency of 17 May 2018 for the commercial disclosure of information for the assessment of financial solvency and creditworthiness. In Sweden, we process credit information about legal persons in accordance with our authorisation from the Swedish Authority for Privacy Protection (IMY).

The purpose of credit information activities is to improve the overall conditions for companies entering into agreements with other companies, including fraudulent companies or companies that have built up excessive debt. Access to such important information counteracts the negative consequences that may arise for the parties involved and for society.

Fulfilment of the duty to inform

We fulfil our duty to inform by notification via email, e-Boks or ordinary post with a clear reference to the Privacy Policy, which is always available on our website.

Information processed

We process information collected from public registers and databases, including cvr.dk, tinglysning.dk and statstidende.dk in Denmark, Bolagsverket in Sweden, Brønnøysundregistrene in Norway and the Finnish Patent and Registration Office (PRH) in Finland, as well as from published annual accounts. We also obtain information from the companies to the extent that the information is publicly available, for example on the company's website.

This means that we process the following categories of information:

a. Identification information, including name, address and company registration number.
b. Financial information, including information about tax, debt and other matters to the extent that the information is publicly available, including any bankruptcy history.

Our processing of the information for disclosure to our customers is a statistical modelling of data, in which active and inactive companies can be compared to obtain:

a. anonymised payment data
b. geographical data
c. statistical databases and
d. historical accounting information

Purpose and legal basis

The purpose of the processing is to assess the financial solvency and creditworthiness of companies, including to support our customers in trading with new and existing customers.

The processing is based on section 20(1) of the Danish Data Protection Act, which provides that credit information agencies may process information that by its nature is relevant for assessing financial solvency and creditworthiness.

Personal data processed in our credit information activities is used only for credit purposes. Our use of information from public business registers for sales and market purposes is a separate processing activity, described in the section "Company events for sales and market purposes".

Recipients of credit information

Our customers who subscribe to our database receive the company information registered about the companies that are considered data subjects under the Danish Data Protection Act. The information is disclosed only in writing, cf. section 21 of the Danish Data Protection Act, and is disclosed orally and in summary form only if the name and address of the enquirer/customer are recorded and kept for at least 6 months, cf. section 21, second sentence, of the Danish Data Protection Act.

Personal data is not included in our publications, and our publications otherwise contain company information only in summary form, cf. section 21 of the Danish Data Protection Act.

To the extent required by law, we disclose credit information to public authorities or other third parties. Any disclosure will therefore be justified by special circumstances, and only relevant and necessary information will be disclosed. When information is disclosed, the recipient will be bound by full confidentiality.

We use our own data processors, who act on our behalf. The database is hosted by Amazon Web Services in Frankfurt, Germany. We do not transfer your credit information to third parties outside the EU.

When our customers retrieve information through Risika for AI, the Risika for AI privacy policy, available at risika.com/mcp/privacy, also applies.

Retention period

We process credit information data for as long as necessary to fulfil the purpose of the processing. As a general rule, we therefore process all information for as long as the company is registered in our database. Information about matters that weigh against creditworthiness and that are more than 5 years old is deleted, unless the matter is of decisive importance for the assessment of the financial solvency and creditworthiness of the person or company concerned, cf. section 20(3) of the Danish Data Protection Act.

COMPANY EVENTS FOR SALES AND MARKET PURPOSES

In addition to our credit information activities, we use information from public business registers to identify events at company level and provide them to our business customers for business-to-business sales and market purposes.

What we use. Information about persons' roles in companies, such as chief executive, management, board member, founder and registered legal owner, including the dates on which a role started and ended and the share held. We use this together with company-level information, such as production units, company type and filed annual accounts. The information comes from Erhvervsstyrelsen (CVR), Bolagsverket, Brønnøysundregistrene and the Finnish Patent and Registration Office (PRH). We do not use information about beneficial owners or personal identity numbers for this purpose.

What we disclose. Only the event itself, for example "new chief executive", "acquired by a company" or "new private owners (2)", together with its date and company-level information. We never disclose the name, identity number, address or contact details of a person as part of a company event.

What we exclude and mark. Events concerning sole traders and other personally owned businesses are excluded. Danish companies registered with advertisement protection (reklamebeskyttelse) in CVR are included but marked as advertisement-protected, and their CVR phone number and email address are not provided for marketing.

Purpose and legal basis. The purpose is to enable businesses to find relevant business opportunities with other businesses. The legal basis is our and our customers' legitimate interest under Article 6(1)(f) of the GDPR. The information is publicly registered, relates only to persons in their professional role and is disclosed only as company-level events without names. On that basis, we have assessed that the interests of the persons concerned do not override these interests. This processing is separate from our credit information activities. It is not carried out under section 20 of the Danish Data Protection Act or our authorisations as a credit information agency, and company events are not used for credit assessment.

Recipients. Our business customers, through our platform, our API and Risika for AI. Each customer is an independent controller for its own use of the events and must comply with applicable marketing law, including the advertisement protection a company is marked with.

Retention. Company events are kept for up to 18 months. After that, we keep only a record, without any personal data, of when an event was first registered.

Your right to object. You may object at any time to our use of information about you for this purpose. We will then stop using information about you to generate company events. Contact dpo@risika.com.

SOCIAL MEDIA

We use social media to market our company.

You should be aware that social media platforms also process information about you. You can read about how they process your information in their privacy policies. This is also where you can read about where your information is stored and whether it is transferred to countries outside the EU.

Facebook, Instagram, LinkedIn

We also process information from social media to interact with you when you ask questions or otherwise give us reason to respond to your posts. We do not use information about you from social media for direct marketing or statistics. Remember that comments on our social media posts can be seen by other users. You should therefore never share information that you do not want to be made public.

Our legal basis for processing your personal data is Article 6(1)(f) of the GDPR on processing based on a legitimate interest, where your interests are not overridden, because we only process what is strictly necessary to answer your enquiry, and because your participation on social media is voluntary on the terms that apply on the social media platform.

We reserve the right to delete and keep comments and enquiries with offensive or illegal content if the information is needed in connection with a legal dispute. The information will be deleted no later than at the end of the case.

We keep your information until it is no longer necessary for us to process it. As a general rule, we delete posts and enquiries after 1 year.

You can always edit or delete posts you have made on our company page. If you want access, deletion or to exercise another right regarding your information on our company page, please first use the deletion and editing options that the social media platform provides. If that cannot meet your request, you can contact us at contact@risika.com.

JOB APPLICATIONS

If you would like to apply for a position with us, please look out for the relevant job advertisement, after which you can send us your CV and application and any references that we may contact.

We then process your name, email and the other information in your application. All processing is confidential and takes place solely for recruitment purposes. Your information will not be disclosed without your consent.

The retention period is 6 months after receipt, in accordance with the Danish Data Protection Agency's guidelines on the retention of job applications. If we wish to keep your application for more than 6 months, we will send you an email asking you to confirm by reply if you accept an extension of the retention period.

3 GENERAL PROVISIONS

If you wish to contact us about our processing of your personal data, you can contact us at contact@risika.com.

We are also covered by the legislation on appointing a data protection officer (DPO), who in our case is an external lawyer specialising in data protection law. The DPO can be contacted at dpo@risika.com.

RECIPIENTS OF PERSONAL DATA

We do not disclose your personal data, except to a lawyer or auditor, or as a result of specific legislation or a request from the authorities. However, we disclose information about financial solvency and creditworthiness in summary form to our customers where it concerns information processed in connection with our credit information activities. You can read more about this in the section on credit information. We also provide company-level events without names to our customers for sales and market purposes. You can read more about this in the section on company events for sales and market purposes.

We use security-approved data processors who help us with IT or other services.

YOUR RIGHTS AS A DATA SUBJECT

You are welcome to access the personal data we process about you, and to have your personal data updated, corrected, deleted or handed over to you. You can also request restriction of processing and object to processing based on our legitimate interest.

All such requests must be made in writing to contact@risika.com.

HOW TO COMPLAIN

If you wish to complain about our processing of your data, please first contact us at dpo@risika.com. If we cannot help you, you can complain to the Danish Data Protection Agency:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
Phone: +45 33 19 32 00
Email: dt@datatilsynet.dk
Website: www.datatilsynet.dk

If you are in Sweden, you can also complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se.

CHANGES TO THE PRIVACY POLICY

This privacy policy will be updated on an ongoing basis and as needed as a result of changes in applicable law. The privacy policy will always state the date of the latest version. In special cases, you may receive a request from Risika to accept the changes before they take effect.

Last updated: 10 November 2026