NuviPlan Privacy Policy
Who we are
NuviPlan ApS, CVR 46613996, Valhøjs Allé 79, 7. th, 2610 Rødovre, Denmark, email privacy@nuviplan.com, is the data controller for the processing described in this policy.
The important part first: two roles
NuviPlan processes personal data in two different roles:
1. NuviPlan as controller. When you visit nuviplan.com, create an account, pay, or contact us, NuviPlan is responsible. That is what this policy covers.
2. NuviPlan as processor. Information about cleaning companies' staff and clients (for example your home profile, if your cleaning company uses NuviPlan) is processed only on behalf of the cleaning company. The company is the controller, and our processing is governed by a data processing agreement. To exercise your rights over that data, contact your cleaning company. We help the company respond.
What we process as controller
Visits to nuviplan.com: Technical log data (IP address, browser type, timestamp) for operations and security. Our bot protection (Cloudflare Turnstile) processes technical data on public forms. Legal basis: legitimate interest in secure operation (GDPR art. 6(1)(f)).
Visit statistics: We use Cloudflare Web Analytics to see which pages are read. The tool sets no cookies, stores no IP addresses and does no fingerprinting, so it cannot be used to recognise you across visits or websites. Legal basis: legitimate interest in understanding the use of our own website (art. 6(1)(f)).
Account creation and administration: Name, email, phone number, company name, CVR number (looked up in the CVR register), password (hashed) and two-factor data. Legal basis: contract (art. 6(1)(b)).
Payment: Card data is processed by Stripe; we never see the full card number. Invoice records are kept under the Danish Bookkeeping Act. Legal basis: contract and legal obligation (art. 6(1)(b) and (c)).
Support and enquiries: The content of your enquiry and contact details. Legal basis: contract or legitimate interest.
Marketing: We send newsletters only with your consent (art. 6(1)(a)). Consent can be withdrawn at any time via the link in the email.
Cookies
nuviplan.com uses only strictly necessary cookies and local storage keys (login session, language choice, bot protection). We use no tracking or marketing cookies. If that changes, we will update this policy and obtain consent first.
Who we share data with
We use processors to run the service, primarily EU hosting (Supabase/AWS, Stockholm), payments (Stripe), email (Mailjet) and SMS (GatewayAPI). The full list with locations and transfer bases: nuviplan.com/en/subprocessors. We never sell personal data.
Transfers outside the EU/EEA rely on the EU-U.S. Data Privacy Framework or the EU Commission's standard contractual clauses.
Retention
- Account data: while the account exists, plus up to 90 days after closure
- Bookkeeping records (invoices): 5 years from the end of the financial year, per the Danish Bookkeeping Act
- Support enquiries: up to 2 years after resolution
- Technical log data: up to 12 months
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Write to privacy@nuviplan.com; we respond within one month.
You may complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk.
Changes
We update this policy as needed. Material changes are notified by email or in the platform. The version and date at the top always show the current edition.