USE ApS (CVR 41456655), Filmbyen 27, 4th floor, DK-8000 Aarhus C, is the data controller for the personal data described in this policy. Questions and requests go to privacy [at] use.agency. This policy covers visitors to use.agency, people at the companies we work with or talk to about working together, suppliers and partners, and people who apply for a job with us. Where we process personal data on behalf of a client as part of a project, the client is the controller and the client's privacy notice applies. Our obligations to the client are set out in a data processing agreement.
What we hold depends on your relationship with us, and we do not hold all of the following about every person. For people at client, prospective client and supplier companies we hold contact and identity data: name, employer, job title, work email, phone number and postal address, received from you directly, from your colleagues, or from public professional sources such as LinkedIn and company websites. For the people we work with on a project we also hold correspondence and project data: emails, meeting notes, call recordings and transcripts where you have been told a call is recorded, briefs, feedback and the working files of the project. For clients and suppliers we hold commercial data: quotes, contracts, purchase orders, invoices and payment records. For people who apply for a job with us we hold the application, CV, portfolio and interview notes. For visitors to use.agency we hold website data: IP address, browser and device type, pages visited and referring site, covered under Cookies below. We do not ask for, and do not want to receive, special categories of personal data such as health information or political opinions. If such data reaches us in correspondence, we do not use it and delete it where we can.
We process personal data to deliver work under a contract with your company and to invoice for it, under Article 6(1)(b) GDPR where you are the contracting party and Article 6(1)(f), our legitimate interest in performing the contract, where you act on behalf of a company. We process it to reply to enquiries, to keep in contact with clients and prospective clients, and to send occasional information about our work to people we have worked with, under Article 6(1)(f). You can object to this at any time by emailing privacy [at] use.agency. We send our newsletter only to people who have signed up for it, under Article 6(1)(a), consent, and every mail carries an unsubscribe link. We keep bookkeeping records under Article 6(1)(c) and the Danish Bookkeeping Act, and we assess job applications under Article 6(1)(b) and (f). We run and secure the website and measure how it is used in aggregate under Article 6(1)(f), with consent for any cookie that is not strictly necessary.
We run our business on standard software, and the suppliers behind it process personal data on our instructions under data processing agreements. The main categories and suppliers are: email, calendar and file storage, Google Workspace (Google Ireland Ltd, with processing in the EU and the US); internal messaging, Slack (Salesforce, US); time tracking and invoicing, Harvest (US); bookkeeping, e-conomic (Visma, EU); design tools, Figma (US); meeting transcription, HappyScribe (EU); AI assistants, Claude (Anthropic PBC, US), covered in the next section; customer relationship management, Attio (Attio Ltd, UK, hosted on Google Cloud), where we keep records of client and prospective client companies, contacts and our correspondence with them; website hosting, Webflow (Webflow Inc., US); website analytics, Google Analytics 4 (Google Ireland Ltd), which loads only after you accept analytics cookies; and company-level website visitor identification, Snitcher (data stored in the EU), covered under Cookies below. A current list of processors is available on request.
We use AI assistants in our day-to-day work, for example to draft and summarise text, search our own files and correspondence, and prepare project material. This means that emails, documents and meeting transcripts containing your name, your contact details and what you have written to us may be processed by Anthropic's Claude. Anthropic acts as our processor under a data processing agreement that includes the EU Standard Contractual Clauses. Under our commercial terms with Anthropic, our data is not used to train its models. Anthropic retains prompts and outputs for a short period, currently around 30 days, for safety review, and then deletes them. We do not use AI tools to make decisions that have legal or similarly significant effects on individuals. Client material covered by a confidentiality agreement is processed with AI tools only where that agreement allows it.
Some of the suppliers listed above process data in the United States. Where there is no adequacy decision, the transfer rests on the EU Standard Contractual Clauses (Commission Decision 2021/914), supplemented by the supplier's own technical and organisational measures. Copies of the relevant clauses are available on request.
We keep contracts, invoices and the correspondence needed to document them for five years from the end of the financial year they relate to, as required by the Danish Bookkeeping Act. We keep correspondence and contact details for prospective clients and business contacts until two years after our last contact, unless you ask us to delete them earlier. We keep project files for the duration of the project and for up to five years after it, so that we can support and document the work; a client can agree a shorter period in the contract. Newsletter sign-ups are kept until you unsubscribe. Job applications are deleted six months after the recruitment ends, unless you agree that we keep them for longer. Google Analytics retains website event data for the period set in our property, at most 14 months.
use.agency sets strictly necessary cookies to make the site work, including the cookie that stores your consent choice. Google Analytics 4 loads only after you accept analytics cookies in the cookie banner, and we use it to see how the site is used in aggregate. We use Snitcher to see which companies visit the site, based on the network address of the visit. We receive company names and the pages visited, not the identity of individual visitors, and the data is stored in the EU. We do this under Article 6(1)(f), our legitimate interest in knowing which organisations take an interest in our work, and Snitcher only recognises a returning browser after you accept cookies. With your consent to advertising cookies, we also use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure our LinkedIn advertising and to show our ads to people who have visited the site. It does not load until you accept. You can change your choice at any time through the banner or your browser settings. The banner lists each cookie, its purpose, its provider and its lifetime.
Access to systems holding personal data is limited to the people who need it, and protected by individual accounts and two-factor authentication. Data is encrypted in transit and at rest by the suppliers listed above. Our staff and the freelancers who work with us are bound by confidentiality.
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing, to receive the data you have given us in a machine-readable format, and to withdraw any consent you have given. To exercise a right, email privacy [at] use.agency. We answer within one month and may ask you to confirm your identity. If you are not satisfied with how we handle your data, you can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby, www.datatilsynet.dk.
We update this policy when our tools or our practices change. The current version and its date are always published on this page. This version: 30 September 2026.