Privacy notice for validiscan.com

The controller for this website is Validiscan ApS, Rishøjvej 9, 3200 Helsinge, Denmark, CVR 46367405. For anything about your data, write to info@validiscan.com. Validiscan is run by one person, William Quaade Rasmussen, who reads that mailbox.

This website is made of static pages and one function on its host’s servers, which sends the contact form to Validiscan (described below, under writing to Validiscan). It sets no cookies, runs no analytics and loads nothing from any other website.

Cloudflare hosts validiscan.com on its Cloudflare Pages service and runs the domain’s DNS. Requests to validiscan.com first pass through a small Cloudflare Worker, which forwards them unchanged to Cloudflare Pages; both are Cloudflare services. Like any web host, Cloudflare receives what your browser sends with each request: your IP address, the address of the page you asked for, and technical details such as your browser’s user agent. It receives them because it delivers the pages.

Cloudflare describes what it does with the data of visitors to the websites it serves, such as IP addresses, in its privacy policy. According to that policy, Cloudflare acts as a processor for the logs it makes available to the owners of those websites. The website itself has no code that records visits.

How long request data are kept: Cloudflare’s privacy policy names no fixed period for the logs of the websites it serves; its section on data retention describes how long it keeps personal data. Validiscan has set up no export of these logs and does not keep them: it sees only what Cloudflare shows in its dashboard.

The legal basis is Validiscan’s legitimate interest in publishing its website (Article 6(1)(f) GDPR).

Transfer outside the EU: Cloudflare runs every one of its services in every data centre of its global network, so request data may be processed outside the EU, including in the United States. Cloudflare, Inc. is an active participant in the EU-US Data Privacy Framework (list checked on 12 October 2026), for which the European Commission adopted the adequacy decision (EU) 2023/1795 of 10 July 2023 (Article 45 GDPR). Should that participation end, Cloudflare’s customer data processing addendum provides the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

You can write to Validiscan by email or with the contact form on this website. The form sends four things: your email address, the subject you chose, your message, and the language of the page you sent it from. It also sends fields that keep automated spam out: one that people leave empty and, when JavaScript is on, how long the form was open. Your browser sends the form to a function that runs at Cloudflare, the website’s host, which handles it as it handles every request to the website (see the section on the host above, including the transfer outside the EU). The function checks the form and passes it straight on as an email, sent from Validiscan’s own Google Workspace account to Validiscan’s mailbox, with your email address as the address for replies; the spam fields are not passed on, and a form that looks automated is not sent at all. The function stores no copy of your message and writes no log of it. All it keeps is the number of messages sent that day, with nothing about who sent them, so that it can stop automated mass sending. The form sets no cookie.

Your email, or the email the form sends, arrives in Validiscan’s mailbox, which is hosted by Google Workspace. Google is a US company. Validiscan uses what you write, such as your name, your email address and the address of your shop, to answer you and, if you ask for it, to run the free check of your shop. Giving any data is voluntary: without an email address, Validiscan cannot answer you, and without the address of your shop, it cannot run the free check. The legal basis is Validiscan’s legitimate interest in answering the messages it receives (Article 6(1)(f) GDPR). Until the application is in operation, Validiscan runs a free check with its scanner on a computer of its own and sends you the result by email; the result files are kept no longer than the emails about your request.

Transfer outside the EU: Google may store and process the emails anywhere Google or its subprocessors have facilities, so also outside the EU, including in the United States. Google LLC is an active participant in the EU-US Data Privacy Framework (list checked on 12 October 2026), for which the European Commission adopted the adequacy decision (EU) 2023/1795 of 10 July 2023 (Article 45 GDPR). Where that framework does not apply, Google’s Cloud Data Processing Addendum provides the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR).

How long emails are kept: Validiscan keeps your emails for as long as it needs them to answer you and to handle what you asked for. Emails that are accounting records, such as an order or an invoice, are kept for five years from the end of the financial year they belong to, as section 12 of the Danish Bookkeeping Act requires. You can ask at any time for your emails to be deleted earlier (see your rights below).

This notice covers the website. Where Validiscan’s application stores the data of customers’ shops, who can see it, when AI is used, how long scan data is kept, and what the crawler does on a shop it checks are described on Security and data. The application is not yet in operation.

You can complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the infringement took place (Article 77 GDPR).

Validiscan is run from Denmark, where the supervisory authority is Datatilsynet, the Danish Data Protection Agency: Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk. Its website explains how to file a complaint with Datatilsynet.