Legal
Privacy policy
How Komma handles personal data about the people who visit this site, book a demo or write to us. Personal data inside the platform itself is covered by the data processing agreement, not by this page.
This document is a draft. It sets out the structure and the facts we could establish from the site itself. Every orange field is a blank Komma has to fill in, and the whole text needs a legal review before publication.
Until that has happened, treat the signed agreement and the data processing agreement as the documents that govern anything.
01Two different roles, and which one this page is about
Komma handles personal data in two quite different capacities, and mixing them up is the most common mistake in a policy like this one.
As a data processor. The employee data inside the platform — names, absence, pay, review notes, applicants — belongs to the customer. The customer decides what goes in and why; Komma only acts on their instructions. That relationship is governed by the data processing agreement, and this policy does not apply to it.
As a data controller. When you visit this website, book a demo, write to us or receive an email from us, Komma decides why and how that data is handled. That is what this policy covers.
If you are an employee of a Komma customer and want to know what your employer stores about you, ask your employer — they are the controller, and Komma cannot answer on their behalf.
02Who is responsible
The data controller for the processing described here is:
- Legal entity: [registered company name]
- Company registration number (CVR): [CVR]
- Registered address: [street, postcode, city, country]
- Contact for privacy questions: hej@kommahr.com [confirm, or use a dedicated address]
- Data protection officer: [name and contact, or state that none is appointed and why]
03What we collect
What you send us
The demo form on demo.html asks for first name, last name, work email, company, phone (optional), number of employees, what is most relevant to you, which payroll system you run and a free-text message. The contact form on contact.html asks for first name, last name, work email, company (optional), what the enquiry is about and a message. Both ask you to tick a consent box.
Write the free-text field for a person, not for a file: it is not the place for health information, union membership or anything else about a named employee.
What your browser sends
Loading any page sends your IP address, the page requested, the time and your browser's user agent to the server hosting the site. Retention of those logs: [how long the host keeps request logs].
What we store on your device
One entry, komma-lang, holding the language you picked so the site opens in it next time. No cookies are set. The details are on the cookie page.
04Why, and on what legal basis
- To answer you and prepare a possible agreement — steps taken at your request before entering a contract, GDPR Article 6(1)(b).
- To run and secure the website — our legitimate interest in a site that works and is not being attacked, Article 6(1)(f).
- To send you material you asked for — your consent, Article 6(1)(a), which you can withdraw at any time without affecting what was done before.
- To meet legal obligations, such as bookkeeping — Article 6(1)(c). [confirm which apply]
We do not profile you, and no decision about you is made automatically.
05How long we keep it
- Enquiries that do not lead anywhere: [period]
- Enquiries that lead to a customer relationship: [period after the relationship ends]
- Server logs: [period]
- Accounting records: [statutory period]
06Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing. It is handled on our behalf by:
- Hosting: [provider, and where it hosts]
- Email: [provider]
- CRM / where enquiries land: [provider]
- Fonts: Google Fonts — see below
Each of them works under a data processing agreement with us.
07Transfers outside the EU and EEA
The platform runs entirely in the EU. This website is a separate matter and has one known transfer: the typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com, which sends your IP address to Google. That happens on every page load, before you have done anything.
The two fixes are to host the fonts on our own server, which removes the transfer entirely, or to keep them and name the transfer basis here. [decide which — self-hosting is the shorter road]
08Your rights
You can ask for a copy of what we hold about you, have it corrected or deleted, have the processing restricted, object to it, and receive it in a portable format. Where we rely on consent you can withdraw it at any time.
Write to hej@kommahr.com and we will answer within one month. If you are not satisfied you can complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk. [if the entity is not Danish, name the right authority]
09Changes to this policy
When it changes we update the date at the top. If a change materially affects you, we tell you rather than relying on you noticing.