How Business Development Services ApS processes personal data about visitors, contacts, subscribers and partners — what we collect, why, for how long, and what rights you have.
The controller for the processing described in this policy is:
Business Development Services ApS
Algade 64C, st. 3 · 4000 Roskilde · Denmark
Company reg. (CVR) 27047408
michael.steffens@bdswins.com · [PHONE]
We are not required to appoint a Data Protection Officer and have not done so. Enquiries about personal data go to the address above.
BDS acts in two different roles, and which one applies decides which rules and which document govern. It is worth establishing up front, because the two are often confused.
where we determine the purpose of the processing — our website, our marketing, our contact with clients and prospects, our newsletter, our suppliers and freelancers, and our accounting. Here BDS is the controller.
to personal data in material a client entrusts to us for an assignment — typically CVs and references in a bid. There the client is the controller and BDS is the processor. That processing is governed by the data processing agreement with the client and by the client’s own privacy policy, not by this one.
If you are a contact person at a client, both can apply at once: your own contact details are processed by us as controller under this policy, while the material you send us for the assignment is processed as processor on behalf of your employer.
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| Visitors to bdswins.com | Technical log data: IP address, time, browser and device type, pages viewed, language choice | Keeping the site working, secure and debuggable | Article 6(1)(f) — our legitimate interest in operating and securing the site. Cookies and similar technologies are covered in section 9. |
| You, when you book a meeting | Name, email, chosen time, anything you write in the booking | Holding and confirming the meeting | Article 6(1)(b) — steps taken at your request prior to a possible agreement |
| Newsletter and article subscribers | Name, email, sign-up time, and whether and when you opened or clicked | Sending the material you asked for, and measuring whether it is relevant | Article 6(1)(a) — your consent, and section 10 of the Danish Marketing Practices Act. You can unsubscribe in every email and withdraw consent at any time. |
| Contacts at clients and prospective clients | Name, title, work email and phone, company, correspondence and meeting notes | Sales, client relationship, running assignments, and documenting our advice | Article 6(1)(f) — our legitimate interest in operating and marketing the business and in being able to document our own professional responsibility. Where you are personally a party: (b). |
| Freelance consultants, subcontractors and other suppliers | Contact details, CV and qualifications, agreements, invoicing data | Entering into and administering the relationship and staffing assignments | Article 6(1)(b) and (c) (statutory bookkeeping) |
| You, if you approach us about working together | What you send us, typically a CV and background | Assessing a possible current or future assignment | Article 6(1)(f) — our and your legitimate interest in assessing a collaboration. If we want to keep the material for later, we ask for your consent. |
| Bookkeeping and accounts | Data in invoices, vouchers and payments | Compliance with the Danish Bookkeeping Act | Article 6(1)(c) — legal obligation |
We never ask for sensitive data. We do not process civil registration numbers, health data, criminal record or child protection certificates, or other data covered by Articles 9 and 10 GDPR — neither about you nor in material clients send us. If we receive such data anyway, we delete it.
We collect data from you. About prospective clients we may also use ordinary publicly available business information — the company’s website, the Danish CVR register, public tender material, and professional profiles on LinkedIn. We do not buy mailing lists, and we make no decisions about you based solely on automated processing or profiling.
We use a small number of suppliers who process data on our behalf as processors. They may only process it on our instructions and are bound by a data processing agreement.
| Supplier | Used for | Place of processing |
|---|---|---|
| Microsoft 365 (Microsoft Ireland Operations Ltd.) | Email, files, calendar and collaboration — including client material in assignments | EU/EEA |
| Pentimenti | AI-supported analysis and production of bid material in assignments | [EU/EEA — CONFIRM] |
| Calendly | Meeting bookings via bdswins.com | [SPECIFY — SEE SECTION 5] |
| [NEWSLETTER PLATFORM] | Sending the newsletter and articles | [SPECIFY] |
| [HOSTING PROVIDER] | Operating bdswins.com and backups | [SPECIFY] |
| Freelance consultants and subcontractors | Performing parts of an assignment where agreed with the client | Denmark / EU |
Our accountant and any lawyers process data as independent controllers within their own duties. Otherwise we do not disclose personal data to others unless legally required to.
We aim to keep processing within the EU/EEA. Where a supplier processes data outside the EU/EEA, it happens only on a valid transfer basis — the European Commission’s standard contractual clauses or an adequacy decision — together with any supplementary measures required.
The booking service Calendly is a US provider. The transfer basis for this processing is [SPECIFY BASIS]. You can always avoid the processing by emailing us at michael.steffens@bdswins.com instead of using the booking page.
You can obtain a copy of, or further information about, the transfer basis by writing to us.
| Data | Deleted |
|---|---|
| Technical log data from the website | After [NUMBER] months |
| Bookings that lead to no further dialogue | 12 months after the meeting |
| Newsletter | On unsubscribe, or after 24 months of inactivity |
| Contacts at prospects who do not become clients | No later than 24 months after last contact |
| Client relationships and assignment correspondence | 5 years after the assignment ends, so we can document our advice within the ordinary limitation period |
| Agreements with freelancers and suppliers | 5 years after the relationship ends |
| Accounting records | 5 years from the end of the financial year concerned |
| Unsolicited CVs | 6 months, unless you have consented to longer |
A client’s own material in an assignment is deleted or returned under the data processing agreement and the Standard Terms — not under the table above.
Under the GDPR you have the right to:
Write to michael.steffens@bdswins.com and we will respond within one month. Rights may be limited, for instance where we are legally required to keep the data or where it forms part of the documentation of our advice. We will tell you why if so.
If your request concerns data we process for a client as processor, we cannot handle it ourselves. We refer you to the client as controller and assist the client in responding.
If you are unhappy with how we process your data, we would like to hear from you first. You may also complain to the Danish supervisory authority:
Datatilsynet
Carl Jacobsens Vej 35 · 2500 Valby · Denmark
www.datatilsynet.dk
We review this policy at least annually, and whenever we change systems, suppliers or processing activities. The current version is always here, with version number and date at the top. We notify subscribers and active clients of material changes.
Questions about the policy or about a specific processing activity go to michael.steffens@bdswins.com.
Business Development Services ApS · Algade 64C, st. 3 · 4000 Roskilde · Danmark
CVR 27047408 · +45 7023 9467 · www.bdswins.com
Last updated 15 September 2026. This policy covers BDS’ processing of personal data as controller. Personal data in a client’s own material is processed as processor under the data processing agreement.