Licens.

Legal / Privacy Policy

Privacy Policy

G&L I/S · licens.tech · Draft pending professional review

Controller: G&L I/S (“G&L”, “we”) Brand/site: Licens — licens.tech Version: 1.0 Effective date: [TO BE INSERTED]

1. Who we are

G&L I/S operates Licens. Contact for privacy requests: [INSERT PRIVACY EMAIL]. Postal address: [INSERT]. CVR: [INSERT].

2. Scope

This Policy explains how we process personal data when you use licens.tech as visitor, Buyer, Seller, or affiliate.

Stripe processes payment and identity-verification data as an independent controller/processor according to Stripe’s terms and privacy notice when you use Stripe Connect or pay via Stripe. We aim not to store copies of identity document images; we store verification status and Stripe account identifiers.

3. Data we collect (data minimisation)

We collect only what we need to run the marketplace:

| Category | Examples | Typical source |
|---|---|---|
| Account | email, password hash, display name, country, age band / 18+ seller flag | you |
| Profile/Seller | seller type (individual/business), business name, VAT/CVR if provided, payout country | you / Stripe status |
| Transactions | orders, Item metadata, delivery logs, dispute messages, fees | Platform |
| Payments | payment status, last4/brand if provided by Stripe, charge IDs | Stripe |
| Support | tickets, emails | you |
| Technical | IP, device/browser, logs needed for security | automated |
| Cookies | see Cookie Policy | automated / consent |
| Marketing (if any) | newsletter email | you with consent where required |
| Affiliate | referral codes, attribution, credits | Platform |

We do not seek to collect special-category data. Please do not upload it.

For Buyers under 18: we process limited data to provide the service and apply suitable protections; parental/guardian involvement may be required. [PROF – children’s GDPR]

4. Purposes and legal bases (GDPR Art. 6)

| Purpose | Base |
|---|---|
| Provide account, marketplace, delivery, support | Contract (Art. 6(1)(b)) |
| Charge/collect Platform Fees, prevent double-spend of credits | Contract / legitimate interests |
| Fraud prevention, security, abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Sanctions / legal compliance | Legal obligation (Art. 6(1)(c)) where applicable; else legitimate interests |
| DAC7 / tax reporting if applicable | Legal obligation |
| Cookie analytics/marketing (non-essential) | Consent (Art. 6(1)(a)) |
| Improve Platform reliability (aggregated/limited diagnostics) | Legitimate interests |
| Buyer Protection administration | Contract / legitimate interests |

You may object to processing based on legitimate interests unless we demonstrate overriding grounds or need the data for legal claims.

5. Roles: Sellers and Buyers

  • G&L is controller for Platform operations.
  • Sellers receiving Buyer data to fulfil an order must use it only for that order/support/legal compliance.
  • Stripe is separately responsible for much payment KYC processing.

6. Sharing

We share data with:

  • Stripe (payments, Connect, verification);
  • hosting/cloud, email, error-monitoring providers acting as processors under DPA;
  • professional advisors under confidentiality;
  • authorities when legally required;
  • counterparties in disputes only as needed to resolve the order (message contents, limited identity).

We do not sell personal data.

7. International transfers

If tools transfer data outside the EU/EEA, we use appropriate safeguards (e.g., adequacy decisions or Standard Contractual Clauses). [PROF – map vendors]

8. Retention

| Data | Retention (starting approach) |
|---|---|
| Account | life of account + up to 24 months |
| Orders / ledger / dispute logs | typically 5–7 years for bookkeeping/legal claims **[PROF – align Danish bookkeeping]** |
| Support tickets | up to 36 months after closure |
| Security logs | commonly 90–365 days |
| Marketing consent records | while active + proof period |
| Cookie consent logs | per Cookie Policy |

We delete or anonymise when no longer needed, subject to legal holds.

9. Your rights

Subject to GDPR conditions: access, rectification, erasure, restriction, portability, objection, withdraw consent, and complaint to Datatilsynet (Denmark) or your local supervisory authority.

To exercise rights: [PRIVACY EMAIL]. We may need to verify identity.

10. Security

We apply technical and organisational measures appropriate to risk (access control, encryption in transit, least privilege, logging). No method is 100% secure.

11. Automated decisions

We may use automated risk scoring (fraud, sanctions geo-blocking, ranking). Significant legal effects solely by automated means with no human involvement are not intended for account bans without review pathways where required.

12. Changes

We will post updates to this Policy and change the version date. Material changes may be notified via site/email.