IMPRINT (E-HANDELSLOVEN § 7) & GDPR ARTICLES 13, 14 & 21 PRIVACY POLICY

Spurvik · EyeTea Solutions ApS (CVR: 37093378)

Last updated: 20 October 2026 · Applies to spurvik.com and spurvik.dev

1. Data Controller & Statutory Imprint (E-handelsloven § 7)

Legal Entity (Data Controller): EyeTea Solutions ApS (incorporated in Denmark, 15 September 2015)
Company Registration (CVR): CVR 37093378 • P-nr. 1020736689
Registered Office: c/o Nathaniel Refslund, Mosevråvej 106, Håstrup, 7000 Fredericia, Kingdom of Denmark
Managing Director & Contact Email: Anders Nathaniel Refslund (nathaniel@spurvik.com)

Right to Object (GDPR Article 21(1), Article 21(2) & Article 21(4)):

Article 21(2) GDPR (Direct Marketing — Unconditional Right): Where personal data are processed for direct marketing purposes, you have the unconditional right to object at any time, free of charge, and your personal data will no longer be processed for such purposes.

Article 21(1) GDPR (Legitimate Interests): You also have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR (legitimate interests). To exercise either right, reply "stop" or "frameld" or email nathaniel@spurvik.com. We will cease processing and retain only a minimal hashed suppression entry (Art. 6(1)(c) and Art. 6(1)(f) GDPR) to ensure you are not contacted again.

Electronic Marketing Policy (Markedsføringsloven § 10(1)):

In accordance with Section 10(1) of the Danish Marketing Practices Act (Markedsføringsloven § 10, stk. 1), which applies to both natural persons and businesses/legal persons (erhvervsdrivende), EyeTea Solutions ApS sends electronic marketing communications (such as email) only where prior consent has been obtained. Warm introductions do not replace consent for electronic marketing. Where you have given consent, you may withdraw it at any time, free of charge, by emailing nathaniel@spurvik.com or replying "stop", "frameld", "afmeld", "nej tak", or "unsubscribe".

2. Categories of Personal Data, Sources (Art. 14 GDPR) & Legal Bases

When you interact with spurvik.com or spurvik.dev, request early access, or correspond with us professionally, we process:

Professional Contact & Account Details: Name, role, company name, and work email address. Where not provided directly by you (Art. 13 GDPR), limited professional contact details are obtained via a mutual professional introduction or publicly accessible corporate registers and company websites (Art. 14(2)(f) GDPR).
Technical SDK & Audit Metadata: Project identifiers, keyed HMAC-SHA256 digests (pseudonymised; under the GDPR, keyed hashes of personal data remain personal data and are protected accordingly; we do not store raw end-user prompts), Ed25519 public keys, and human-oversight review records (reviewer identifier, decision reason, and console/API source).
Legal Bases (Art. 6(1) GDPR):
- Art. 6(1)(b) GDPR (Contract / Pre-Contractual Steps): Responding to early-access requests, provisioning sandbox credentials, and operating customer workspaces.
- Art. 6(1)(f) GDPR (Legitimate Interests): B2B relationship management following introductions or events, and service security.
- Art. 6(1)(a) GDPR (Consent): Where prior consent is provided for electronic marketing communications.
- Art. 6(1)(c) GDPR (Legal Obligation): Compliance with the Danish Bookkeeping Act (Bogføringsloven) and maintaining suppression lists.

3. Sub-Processors & Hosting

Vercel Inc.: Web hosting, edge routing, and serverless function execution (configured for Frankfurt fra1, with global edge and US iad1 fallback/routing infrastructure) and DNS management for spurvik.com and spurvik.dev.
Neon Inc.: Managed PostgreSQL database hosted in AWS eu-central-1 (Frankfurt, Germany).
Resend Inc.: Outbound and incoming (inbound) email routing and webhook delivery for @spurvik.com and @spurvik.dev (configured in AWS eu-west-1 Dublin, Ireland, with US parent entity storage/metadata processing; Resend retains raw inbound/outbound message logs according to its standard operational retention setting unless deleted earlier via API or upon objection).
Stripe Payments Europe, Limited (Dublin, Ireland) & Stripe, Inc.: B2B billing and payment processing.

4. International Data Transfers (GDPR Chapter V)

Where sub-processors or their parent companies are established in the United States (Vercel Inc., Neon Inc., Resend Inc., Stripe, Inc.), transfers of personal data outside the EEA are safeguarded under the EU–U.S. Data Privacy Framework (DPF) adequacy decision (Art. 45 GDPR) and the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Module Two/Three) (Art. 46(2)(c) GDPR). Copies of the applicable transfer safeguards may be requested at nathaniel@spurvik.com.

5. Cookies & Browser Storage

This website sets no cookies and stores no data in browser storage (localStorage or sessionStorage).

6. Retention Periods & Data Subject Rights (Arts. 15–22 GDPR)

Professional correspondence records are reviewed every 6 months and deleted if no active business relationship exists. Accounting records are retained for 5 years plus the current financial year under Bogføringsloven § 12. You have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21) by contacting nathaniel@spurvik.com. You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk).

← Return to Spurvik