Updated 15 June 2026

Privacy Policy

This policy explains how PositioningCraft ApS ("PositioningCraft," "we," "us"), a company registered in Denmark under CVR 41 92 06 58, handles personal data when you visit https://positioningcraft.com or hire us. We are the data controller, and we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).

1. What we collect

Brief & contact details: when you use the contact form or the package builder — first and last name, email, phone (optional), company (optional), the deliverable you select, and the brief you write.
Checkout details: when you buy from the rate card — first and last name, email, phone, and country. Card data is collected and processed entirely by Stripe and never reaches our servers.
Project material: during an engagement we process whatever you share with us to do the work — existing copy, brand material, customer interviews. This is governed by our engagement terms.
Technical data: a session cookie needed for the contact form and checkout, your cookie-consent choice stored in your browser, and standard server logs (IP address, user-agent, requested URL) kept briefly for security.

2. Why we process it, and our legal basis

To answer your enquiry and scope a project — legal basis: steps taken at your request prior to a contract (GDPR Art. 6(1)(b)).
To deliver and bill the services you buy — legal basis: performance of a contract (Art. 6(1)(b)).
To meet Danish bookkeeping and tax obligations — legal basis: legal obligation (Art. 6(1)(c)).
To keep the site secure and prevent abuse — legal basis: our legitimate interest (Art. 6(1)(f)).

We do not sell your personal data, and we run no advertising or analytics trackers on this site.

3. Processors we use

We share data only with the providers needed to run the studio, each under a data-processing agreement where required:

Stripe — payment processing (acts as an independent controller for payment data).
Our hosting provider — to serve the site and store contact submissions within the EU/EEA where possible.
Our email provider — to send and receive correspondence.
Google Fonts — to serve typefaces; the font CDN may receive your IP address as part of the request.

4. How long we keep it

Invoicing and accounting records are kept for five years from the end of the financial year, as required by the Danish Bookkeeping Act (bogføringsloven). Briefs that do not become projects are kept for up to 24 months from last contact unless you ask us to delete them sooner. Server logs are kept for 14 days.

5. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. To exercise any of these, email admin@positioningcraft.com. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk), Carl Jacobsens Vej 35, 2500 Valby.

6. Security

The site is served over TLS, secrets are kept out of source control, sessions are protected against cross-site request forgery, and access to stored briefs is limited to the people who need it. No system is perfectly secure, but we take reasonable, current measures to protect your data.

7. Changes

If we change this policy materially we will update the date above and, where appropriate, let you know by email.

8. Contact

PositioningCraft ApS · Jagtvej 55, 5000 Odense, Denmark · admin@positioningcraft.com · CVR 41 92 06 58.