English
DanskPrivacy policy
How Spudo processes your personal data
Here you can read which data we collect, why we do so, how long we keep it and which rights you have.
Last updated 6 October 2026
- Spudo ApS is the data controllerA Danish company based in Aalborg, company reg. no. (CVR) 40156518.
- Danish and European lawWe process data under the GDPR, the Danish Data Protection Act and the Danish Marketing Practices Act.
- Marketing requires consentEmail and SMS are only sent to recipients who have opted in, and can always be unsubscribed.
- You are in control of your dataYou can access, correct or delete your data and complain to the Danish Data Protection Agency.
Data controller
Spudo ApS is the data controller for the processing of the personal data described in this policy.
Spudo ApSCompany reg. no. (CVR) 40156518
Ladegårdsgade 4, 1. sal
9000 Aalborg
Denmark
If you have questions about this policy or about how we process your data, you are always welcome to contact us. You will find the contact details at the bottom of this page.
Whose data do we process?
Spudo connects advertisers with digital partners. We therefore mainly process data about contact persons at companies, but also about visitors to our website and recipients of marketing.
Purposes, data and legal basis
We only process the data needed for each purpose. The table shows what we use the data for, the legal basis we rely on and how long we keep it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing the website | IP address, browser and device details, time of the visit, language choice and the country the IP address points to. | Legitimate interest in a secure, working website (GDPR art. 6(1)(f)). | Server logs for up to 14 days. The language choice is stored in your browser for 1 year. |
| Answering enquiries | Name, email, telephone number, company and the content of your enquiry. | Legitimate interest in replying to you, or steps prior to entering into a contract (art. 6(1)(f) and (b)). | For as long as needed to handle the enquiry and document the dialogue. |
| Onboarding of and cooperation with advertisers and partners | Company details, contact persons, website, markets, marketing channels and documentation from our partner checks. | Performance of the contract and legitimate interest in knowing our business partners (art. 6(1)(b) and (f)). | During the cooperation and for up to 3 years after it has ended. |
| Invoicing and payment | Invoice details, bank details and payment history. | Legal obligation under the Danish Bookkeeping Act (art. 6(1)(c)). | 5 years from the end of the financial year the data relates to. |
| Tracking and settlement of results | Click ID, campaign, partner, time, market and technical details about the device. The data is pseudonymous as a rule. | Legitimate interest in documenting and settling results (art. 6(1)(f)), and consent where the rules require it. | For as long as needed for settlement and documentation towards advertisers and partners. |
| Direct marketing by email and SMS | Name, email address, telephone number and when and how consent was given. | Consent (art. 6(1)(a)) and section 10 of the Danish Marketing Practices Act. | Until you withdraw your consent. Documentation of the consent is kept for 2 years after we last relied on it. |
| Quality control and fraud prevention | Traffic sources, traffic patterns and documentation from partners. | Legitimate interest in protecting Spudo, advertisers and partners against abuse (art. 6(1)(f)). | For as long as needed to investigate and document the matter. |
We collect the data from you, from the company you represent, from our tracking platform and – for marketing – from the partner that obtained your consent.
Marketing and consent
We and our partners only send marketing by email, SMS or other electronic channels to people who have given prior consent, as required by section 10 of the Danish Marketing Practices Act.
- Consent must be freely given, specific and informed
- You can withdraw it at any time
- Every message includes an easy way to unsubscribe
- We can document when and how consent was given
If you no longer wish to receive marketing, use the unsubscribe link in the message or contact us. Unsubscribing applies going forward and does not affect the lawfulness of what was sent before you unsubscribed.
Cookies and similar technologies
We follow the Danish Executive Order on Cookies. On this website we only use what is necessary for the site to work, and we do not use analytics or marketing cookies. If that changes, we will ask for your consent first.
| Name | Purpose | Duration | Type |
|---|---|---|---|
lang |
Remembers the language you chose in the language menu. | 1 year | Necessary – only set when you choose a language yourself |
spudo_signup |
Local storage in your browser that remembers your answers in the advertiser sign-up form, so you can continue where you left off. Nothing is sent to us until you go on to the next step yourself. | Until the sign-up is sent, or you clear your browser data | Necessary – only used when you fill in the form |
The first time you visit the site, we use your IP address to see which country you are visiting from, so we can show the site in Danish or English. The lookup is done on our own server and the country is not stored about you.
When you click a link from one of our partners, a click ID or a cookie may be used to record which partner referred you. This is described under tracking in the table above.
Who do we share data with?
We only disclose personal data when it is necessary for the purposes described in this policy. This may be to:
The data about results needed to document and settle a campaign.
Providers of hosting, tracking platform, email and SMS delivery and accounting, who may only process the data on our instructions.
Auditor, lawyer and bank, when necessary.
When we are required to do so by law.
We enter into data processing agreements with the providers that process personal data on our behalf.
Transfers outside the EU/EEA
Some of our providers, such as our tracking platform, are established in or use sub-processors in countries outside the EU/EEA, including the USA.
When data is transferred to such countries, it is done on a valid transfer basis under Chapter V of the GDPR – typically a European Commission adequacy decision or the European Commission's standard contractual clauses. You can ask us which basis is used.
How we protect the data
We have technical and organisational measures in place to protect personal data from being lost, altered, misused or disclosed to unauthorised parties.
- Access only for employees with a work-related need
- Passwords and access control
- Encryption where relevant
- Agreements with our providers
- Deletion when the data is no longer needed
If a personal data breach occurs that involves a risk to you, we report it to the Danish Data Protection Agency within 72 hours and notify you when the rules require it.
Your rights
You have a number of rights under the General Data Protection Regulation. To use them, simply contact us – it is free, and we reply no later than one month after receiving your request.
You can read more about your rights in the Danish Data Protection Agency's guidance on data subjects' rights at datatilsynet.dk.
Children and young people
Our website and services are aimed at companies and adults. We do not knowingly collect data about people under 18, and if we become aware that this has happened, we delete the data.
Changes to this policy
We update this policy when our processing or the legislation changes. The date at the top of the page shows when it was last changed. In the event of material changes, we notify the advertisers and partners we work with.
Contact and complaints
Contact us if you have questions or want to exercise your rights. If you are dissatisfied with our reply, you can complain to the Danish Data Protection Agency.
Ladegårdsgade 4, 1. sal
9000 Aalborg
Carl Jacobsens Vej 35
2500 Valby
dt@datatilsynet.dk
Ready to grow?
Tell us about your brand or your traffic, and we will find the right setup together.