Privacy Policy

The data controller for personal data collected through this website is:

TokenForce ApS is incorporated in Denmark. This notice is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Danish Data Protection Act (Databeskyttelsesloven).

We collect personal data where you voluntarily provide it through the contact form on this website. Providing personal data is voluntary; if you do not provide the required fields, we cannot respond to your enquiry. We also use a self-hosted, cookieless analytics tool to understand aggregate usage of the site (see section 8). We do not use tracking cookies, cross-site trackers, or behavioural advertising tools.

We retain contact-form messages and related correspondence for as long as necessary to handle your enquiry and any resulting relationship, after which they are deleted or anonymised.

Data submitted through the former waitlist registration form is retained for a maximum of 24 months from the date of submission, or until you withdraw your consent, whichever is earlier. After this period, the data is permanently deleted or anonymised. Consent records (confirmation that the declaration boxes were checked and the form was submitted) may be retained for a longer period to the extent required by applicable law or regulatory guidance, as evidence of valid consent.

We aim to process your personal data within the European Economic Area (“EEA”). Where a service provider processes data outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR — either an adequacy decision by the European Commission, or Standard Contractual Clauses approved by the European Commission. Details of the applicable safeguards are available on request at privacy@tokenforce.finance.

Under the GDPR and the Danish Data Protection Act, you have the following rights in relation to your personal data:

To exercise any of the above rights (other than complaint to Datatilsynet), please contact us at privacy@tokenforce.finance. We will respond within one calendar month of receiving your request. In complex or high-volume cases, we may extend this period by a further two months, in which case we will notify you within the initial month.

We do not use your personal data for automated individual decision-making or profiling that produces legal effects or similarly significant effects concerning you, as described in Article 22 of the GDPR. Contact enquiries are reviewed manually and no automated determinations are made on the basis of data submitted through this website.

This website does not use tracking cookies or cross-site advertising trackers. To understand how the site is used, we run a self-hosted, privacy-first analytics tool (Umami) on our own infrastructure within the EU. It does not set cookies, does not track you across other websites, and records only aggregate, non-identifying usage signals (such as page views and which calls-to-action are clicked). We do not sell this data or use it for behavioural advertising. We process this aggregate analytics data on the legal basis of our legitimate interest (Article 6(1)(f) GDPR) in understanding how the site is used and improving it; you may object to this processing at any time (see section 6). See also our Cookies Policy.

With your separate, opt-in consent, we also record a replay of your visit (mouse movement, clicks, scrolling, and navigation) using rrweb, an open-source recorder, to understand where the site is confusing. The recordings are sent only to our own servers within the EU and stored privately and encrypted — we do not use any third-party session-replay provider. Values you type — including anything you enter in the contact form — are masked in your browser before anything is transmitted, and are not captured. The replay itself contains no typed values, but it is pseudonymised rather than anonymous: it is tagged with a random identifier stored in your browser (the same identifier used by our analytics), so it remains personal data and you may ask us to delete it (see section 6). This is off by default and only runs if you choose to accept it in the consent banner; the legal basis is your consent (Article 6(1)(a) GDPR). Recordings are stored in the EU and automatically deleted after 90 days. You can withdraw at any time via “Cookie settings” in the footer, which stops the recording immediately; withdrawal does not affect the lawfulness of processing carried out before it. You may also request deletion of your recordings at any time (see section 6).

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures are reviewed and updated regularly. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet without undue delay and, where feasible, within 72 hours — and, where required, notify you directly.

We may update this Privacy Policy from time to time. The date at the top of this page reflects the date of the most recent revision. Where a change materially affects how we process your personal data, we will inform affected individuals by email before the change takes effect, where we hold a valid email address and where such notification is required by law.

All data protection queries, rights requests, and complaints should be directed to:

The Danish Data Protection Authority (Datatilsynet) can be contacted at www.datatilsynet.dk or by post at Carl Jacobsens Vej 35, 2500 Valby, Denmark.