auditchecklists.org processes the minimum personal data needed to deliver the audit checklist you buy and to meet Danish bookkeeping law. This document explains exactly what we collect, why, on what legal basis, how long we keep it, and how you exercise your rights under GDPR.
Last updated: 22 May 2026. We post material changes here; the page preserves the date of last update so you can verify currency.
auditchecklists.org is a brand operated by Contenza K/S, CVR 43349023, Denmark. Contenza K/S is the data controller for the personal data processed via this website and the auditchecklists.org catalogue.
Contact for data matters: use the privacy contact form. We respond within 30 days, sooner where reasonable.
| Data | Why | Lawful basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Email address (purchase) | Deliver the artefacts. Send regulatory amendment notifications during the 12-month update period. Send the T-30 renewal email. | Art. 6(1)(b) performance of contract; Art. 6(1)(f) legitimate interest (amendment notices to existing buyers). | 5 years from purchase (Danish bookkeeping law), then anonymised. |
| Cardholder name + billing address + country | Process payment, issue VAT-compliant invoice. | Art. 6(1)(b); Art. 6(1)(c) legal obligation (invoicing). | 5 years from purchase, then anonymised on our side. Stripe retains per its own policy. |
| Organisation name (licensee) | Stamp the licence on every artefact. Address the invoice. Identify licence transfers. | Art. 6(1)(b); Art. 6(1)(f) anti-redistribution evidence. | 5 years from purchase; the stamp on already-issued PDFs cannot be retracted (documented in the licence terms). |
| VAT ID (optional) | EU B2B reverse-charge handling. | Art. 6(1)(c) tax law. | 5 years from purchase. |
| Contact-form submissions | Reply to your enquiry. | Art. 6(1)(b) pre-contractual measures at your request. | 2 years from the last contact, or shorter on request. |
| Server logs (IP address, request path, timestamp) | Security, abuse detection, debugging. | Art. 6(1)(f) legitimate interest. | 90 days, then rotated out. |
We use a small set of well-known sub-processors. Each carries its own Data Processing Agreement with Contenza K/S.
No personal data is shared beyond these processors. We never sell or rent personal data.
The application and database run in the EU (Germany). Two processors (Stripe and Resend) involve transfers to the United States; both rely on the EU-US Data Privacy Framework adequacy decision (10 July 2023) as the lawful basis for the transfer. Each processor publishes its own Standard Contractual Clauses fallback in case the DPF lapses.
Use the privacy contact form to exercise any of the following. We respond within 30 days at the latest.
If you believe we have processed your personal data unlawfully and you are not satisfied with our response, you have the right to complain to the Danish data protection authority:
Datatilsynet · Carl Jacobsens Vej 35, 2500 Valby, Denmark · datatilsynet.dk · +45 33 19 32 00.
You may also complain to the supervisory authority in your country of habitual residence.
If we materially change how we process personal data, we update this page and rev the "Last updated" date at the top. We do not silently change the policy.