DitaExchange A Wirtek company Request a demo
Privacy notice

How we handle personal data

DitaExchange ApS is the data controller for personal data collected through this website and in the course of customer engagements. This notice explains what we collect, why, how long we keep it, and what rights you have under the EU General Data Protection Regulation and the Danish Data Protection Act.

Effective date: 2026-10-23

Who we are

The data controller

DitaExchange ApS
Åbogade 15
8200 Aarhus N
Denmark
CVR-nr: 39700522
Email: privacy@ditaexchange.com

For data-protection questions, the fastest route is the privacy inbox above. We will respond within one Danish business week, and within 30 days on formal requests under GDPR Articles 15 to 22.

We are not required to appoint a Data Protection Officer under GDPR Article 37 and have not done so. Data-protection questions are handled directly by the privacy inbox.

What we collect on this website

The minimum needed to run the site and respond to inquiries

  • Server logs: IP address, browser type, page requested, timestamp. Captured by our hosting provider (Cloudflare) for the operational purposes of running the site, protecting against abuse, and producing aggregated traffic statistics. Retained for 30 days.
  • Contact form and email submissions: name, email address, organization, and the content of the message you send us. Used to respond to your inquiry. Each submission also includes how you reached the site: the campaign tags in the link you followed (such as utm_source and utm_campaign), the referring website, the page you first landed on and the page you sent the form from. We use this to learn which channels and campaigns lead to conversations. If you accepted marketing cookies, it also includes the ad click ID from LinkedIn, Google or Microsoft, where the link carried one. Retained for the duration of any resulting commercial conversation, plus the statutory retention period under Danish bookkeeping law where invoicing follows.
  • Newsletter subscriptions: if you subscribe to a newsletter, your email address and any preferences you provide. Used to send the newsletter you signed up to. Retained until you unsubscribe; an unsubscribe link is in every email.
  • Cookies and browser storage: see the dedicated section below.
Cookies

Marketing cookies load only after you accept them

This website stores two kinds of information in your browser. One is strictly necessary. The other is used only if you accept it in the cookie banner.

  • Your cookie choice (strictly necessary). When you accept or decline, the site keeps that answer in your browser's local storage for 12 months, so the banner does not ask again on every page. It holds the answer and the date, nothing that identifies you. After 12 months the banner asks again.
  • The LinkedIn Insight Tag (marketing, consent only). If you press Accept, the site loads a script from LinkedIn (snap.licdn.com). LinkedIn then sets its own cookies and receives the address of the page you are viewing, your IP address, browser details and a timestamp. If you are signed in to LinkedIn, LinkedIn can link the visit to your LinkedIn account. We use the tag for three purposes: to measure whether our LinkedIn ads lead to visits and inquiries, to see aggregated reports about the professional profile of visitors (such as job function and industry), and to show DitaExchange ads on LinkedIn to people who have visited this site. LinkedIn reports to us only in aggregate. We cannot see who visited. LinkedIn's cookies last from one day to one year; their names and durations are listed in LinkedIn's cookie table. When you send the contact or demo form, the tag also tells LinkedIn that a form was sent, so we can see which ads lead to inquiries. Nothing you type into the form is sent to LinkedIn.
  • How you found the site (marketing, consent only). If you press Accept, the site also keeps, in your browser's local storage for 30 days, the campaign link or outside website that brought you here and the page you landed on. If you contact us later, the form includes it, so we can see which channels lead to conversations. It stays in your browser unless you send a form.

If you decline or close the banner, the tag does not load, nothing is sent to LinkedIn and nothing about how you arrived is stored. A form you send then includes only what is visible on the page you send it from: its own campaign tags and the referring website. We use no analytics cookies and no other advertising cookies on this site.

You can change your answer at any time through Cookie settings, in the footer of every page or with the button below. Withdrawing consent stops the tag on this site immediately and removes the LinkedIn cookies set on ditaexchange.com and the stored record of how you arrived. Cookies LinkedIn has set on its own domain are managed in your LinkedIn account and your browser settings.

Legal basis for processing

  • Legitimate interest (Article 6(1)(f)), for server logs and abuse protection, and for recording with a form submission how you reached the site. The legitimate interests are operating a secure website and knowing which of our channels lead to conversations.
  • Consent (Article 6(1)(a)), for newsletter subscriptions and for the LinkedIn Insight Tag. You opt into both and can withdraw at any time. For the Insight Tag, consent is also what the Danish cookie order (cookiebekendtgørelsen) requires before any non-essential cookie is set.
  • Performance of a contract or pre-contractual steps (Article 6(1)(b)), for contact-form submissions and the commercial conversations that follow.
  • Legal obligation (Article 6(1)(c)), for invoicing and bookkeeping records, which Danish law requires us to retain for five years from the end of the financial year.
Sub-processors and third parties

Where your data is processed

We use a small number of carefully selected sub-processors to operate this website and our customer-facing services. Each one is bound by a data-processing agreement consistent with GDPR Article 28.

  • Cloudflare, website hosting and content-delivery network. Server logs are processed at Cloudflare's edge nodes; Cloudflare's published data-processing addendum applies.
  • Microsoft, corporate email and productivity tools (Microsoft 365). Email correspondence with us is processed inside Microsoft 365 under the Microsoft Data Protection Addendum.
  • Hetzner Online GmbH, infrastructure hosting (EU, Germany). Contact and demo-request submissions made through this site are stored in our self-hosted customer-relationship-management system (Twenty), which runs on Hetzner servers in the EU under Hetzner's data-processing agreement.
  • LinkedIn Ireland Unlimited Company, advertising measurement through the LinkedIn Insight Tag, only for visitors who accept it. LinkedIn is not our processor for this. DitaExchange ApS and LinkedIn are joint controllers for collecting the data through the tag, under LinkedIn's joint controller addendum for its marketing solutions, and LinkedIn is the controller for its own further use of the data under the LinkedIn Privacy Policy. Questions about that use can go to LinkedIn directly or to us, and we will pass them on.

If additional sub-processors are engaged after publication (for example a newsletter platform or web-analytics provider), they will be added to the list above as soon as the engagement begins.

We do not sell or rent personal data to third parties.

International transfers

Where personal data leaves the EU

Some of the sub-processors above operate infrastructure outside the EU and EEA. Where personal data is transferred to such locations, we rely on the legal mechanisms recognized under GDPR Chapter V: the European Commission's 2021 Standard Contractual Clauses (Implementing Decision 2021/914), modules 2 or 3 as appropriate, and, for transfers to the United States, on each sub-processor's certification under the EU-US Data Privacy Framework where applicable. Cloudflare and Microsoft both maintain DPF certification. Data collected through the LinkedIn Insight Tag, for visitors who accept it, may be transferred by LinkedIn Ireland to LinkedIn Corporation in the United States; LinkedIn relies on the EU-US Data Privacy Framework and Standard Contractual Clauses for that transfer. Hetzner Online GmbH operates within the EU, so contact and demo-request submissions stored in our self-hosted customer-relationship-management system do not leave the EEA and no third-country transfer arises for them.

Your rights

Under GDPR Articles 15 to 22

  • Access, request a copy of the personal data we hold about you.
  • Rectification, ask us to correct inaccurate or incomplete data.
  • Erasure, ask us to delete data, subject to our legal retention obligations.
  • Restriction, ask us to limit how we process your data while a question is being resolved.
  • Portability, receive your data in a structured, commonly used, machine-readable format.
  • Objection, object to processing based on our legitimate interest.
  • Withdraw consent, for processing based on consent (such as newsletter subscriptions or the LinkedIn Insight Tag), at any time. For the Insight Tag, use Cookie settings in the footer of any page.

To exercise any of these rights, email privacy@ditaexchange.com. We will respond within 30 days of receiving a valid request.

If you are not satisfied with our response, you have the right to complain to the Danish Data Protection Agency (Datatilsynet). Their contact details are at datatilsynet.dk.

Customer-facing services

Personal data inside the DitaExchange platform

This notice covers personal data we collect as a data controller: typically through this website, through marketing activity, and through commercial conversations with prospective customers.

Personal data that customers store inside the DitaExchange platform (typically usernames, author identifiers, approval records, and metadata captured by the editorial workflow) is processed by DitaExchange as a data processor on behalf of the customer (the data controller). The terms of that processing are set out in the data-processing agreement that forms part of every DitaExchange customer contract. The customer remains the data controller for that data, and end-user rights requests should be directed to the customer in the first instance.

Changes to this notice

We update this notice when our processing changes. Material changes are flagged on the website and, where appropriate, communicated to active contacts by email. The effective date at the top of the page reflects the most recent update.

Previous versions are available on request from privacy@ditaexchange.com.

Questions about how your data is handled

Email privacy@ditaexchange.com. A real person reads it and will respond within one Danish business week.

Send us an email