Data controller
The data controller for personal data processed through runi.services and the connected agent platform is:
- Runi Consulting ApS · CVR 39337487
- Clara Pontoppidans Vej 47 · 2500 Valby · Copenhagen, Denmark
- General contact: kontakt@runi.services
- Privacy requests: privacy@runi.services
Data protection officer
We have not appointed a Data Protection Officer. Under GDPR Article 37, a DPO is required only when core processing activities consist of large-scale systematic monitoring or large-scale processing of special categories. Neither applies to our current operations. Privacy questions still route to a named, accountable person at privacy@runi.services.
Purposes & legal basis
Every processing activity we perform is tied to one of the legal bases listed in GDPR Article 6. The table is the authoritative overview — if something we do isn’t on it, we shouldn’t be doing it.
| Purpose | Legal basis | Typical data |
|---|---|---|
| Deliver the services under an engagement contract | Contract — Art. 6(1)(b) | Account info, work content, operational logs |
| Respond to support & sales enquiries | Legitimate interest — Art. 6(1)(f) | Email, message content |
| Security monitoring, fraud prevention | Legitimate interest — Art. 6(1)(f) | Auth logs, IP addresses, audit events |
| Accounting, audit, statutory record-keeping | Legal obligation — Art. 6(1)(c) (Bogføringsloven) | Invoice data, contracting parties |
| Marketing & newsletters | Consent — Art. 6(1)(a) | Email, stated interests |
Balancing test (legitimate interest)
Where we rely on legitimate interest, we have documented a balancing test. Summary: the processing is necessary to operate the service safely, the volume of data is minimised, and a reasonable user of a professional B2B service would expect it. Full assessments are available on request.
Categories of data
- Account & identity — name, email, role, organisation
- Engagement content — the work you bring into the agents, including messages, files, and memory entries
- Operational telemetry — auth events, rate-limit counters, error traces (no content)
- Support correspondence — emails, attachments
- Billing & contract — invoice data, VAT status, signatories
We do not intentionally collect special categories of data (health, ethnicity, religion, sexual orientation, biometrics, trade-union membership). If your engagement requires processing special categories, we put an Article 9 basis in writing before starting.
Recipients & sub-processors
We use a small, named set of sub-processors. A current list with versioning is maintained at /subprocessors/.
| Vendor | Purpose | Region |
|---|---|---|
| Microsoft (Azure, Entra, Graph, M365, Application Insights) | Hosting, identity, collaboration infrastructure, cookieless website analytics | EU — Sweden Central (analytics), EU (primary) |
| Anthropic | Claude language models for agent reasoning | US — DPF + SCCs |
| Gemini models where engagement requires them | US / EU — DPF + SCCs | |
| OpenAI (via Azure) | GPT models as backup where contracted | EU |
International transfers
EU data that reaches US processors is transferred under a combination of the EU-US Data Privacy Framework (where the vendor is certified) and Standard Contractual Clauses (where not). We prefer EU-resident service tiers wherever they exist and are contractually viable. Transfer mechanisms per vendor are listed in /subprocessors/.
Retention
- Engagement content — duration of the engagement plus any agreed handover window. On termination we provide an export and delete within 30 days.
- Accounting records — 5 years after the end of the financial year (Bogføringsloven §12).
- Support correspondence — up to 24 months, then deleted unless it documents a contractual matter.
- Operational telemetry — 30 days hot storage, aggregated metrics may be kept longer.
- Marketing data — until consent is withdrawn.
Your rights
Under GDPR Articles 15–22 you have the rights listed below. Exercise any of them by writing to privacy@runi.services. We answer within one month, extendable by up to two further months if a request is complex — you’ll hear from us either way within 30 days.
Get a copy of your personal data and the purposes we process it for.
Correct inaccurate data. Have incomplete data completed.
“Right to be forgotten” — subject to retention obligations under Danish law.
Ask us to limit processing while a dispute about accuracy or lawfulness is resolved.
Export your data in a structured, machine-readable format.
Object to processing based on legitimate interest, including profiling.
For anything based on consent (e.g. marketing), withdraw at any time.
We don’t make decisions with legal effects solely on automated processing.
Complaints
If you believe we’re processing your data unlawfully, you can complain to the Danish data-protection authority:
- Datatilsynet
- Carl Jacobsens Vej 35, 2500 Valby
- datatilsynet.dk · dt@datatilsynet.dk
We appreciate the chance to resolve issues directly first — but the right to complain to Datatilsynet is yours, unconditional.
Children & CPR
Our services are not directed at children under 13. The Danish age of digital consent is 13. We do not knowingly collect personal data from children and will delete it on notice.
CPR numbers are not processed by runi.services. §11 of Databeskyttelsesloven restricts CPR processing, and nothing in our service requires it.
Cookies & website analytics
Cookies used on public pages and in the authenticated dashboard are documented at /cookies/. We currently set no consent-requiring cookies on public pages.
We measure public-page usage with Azure Application Insights hosted in Sweden Central, configured in cookieless mode. The site sets no analytics cookies and writes no persistent identifier to your browser. Telemetry is limited to page views, referrers, browser and country, performance timings, and JavaScript errors — no cross-session identity, no advertising signals, no third-country transfer. Default retention is 90 days. We honour Do Not Track and Global Privacy Control: if either is set by your browser, no telemetry is sent.
Changes
Material changes to this policy are announced in Writing and dated below. We will not retroactively apply new practices to data already collected under earlier terms unless legally required.