Privacy Policy

1. Data controller

Ryesgade6 ApS
Schleppegrellsgade 10, kl., 2200 København N
CVR no. 40938516
info@ryesgade6.dk, phone +45 53 56 08 99

We are the controller for the data described here. We are not required to appoint a data protection officer and have not appointed one. Write to the address above with any question.

2. What we process

• Your account: name, email address, whether the email is verified, your language preference and your password. The password is stored only as a cryptographic hash, so neither we nor anyone else can read it.
• Your profile: full name and phone number if you gave one, plus a customer reference at Stripe.
• Your bookings: which room, date and time, whether it is an hour or a day pass, status, what the booking cost in tokens, and any note you write on the booking yourself.
• Your tokens: which packages you bought, price, any bonus tokens, expiry date, and one line for every time tokens were added to or taken from your balance.
• Payments: amount, payment method, status and Stripe's reference numbers. We never receive or store your card details. We also keep the messages Stripe sends us about your payments.
• Invoices: invoice number, date, description, amount, and your name and email address as they were when the invoice was issued. An invoice is an accounting record and must not change afterwards.
• Email: a log of which emails we sent you, when, and whether they were delivered. We use it to avoid sending the same thing twice and to work out what went wrong if something never arrived.
• Sign-in: when you sign in we store a session with your IP address and information about your browser, until the session expires or you sign out.
• Change log: when one of us changes something on your account, for example adjusts your balance or cancels a booking, the system records what was done, by whom and when.
• Server log: if something goes wrong technically, our web server writes an error line that can contain your IP address, your browser and the page you asked for.

We do not ask for sensitive information and you should not send us any. Booking notes are meant for practical messages, not for health information.

3. Why, and on what legal basis

• To perform our agreement with you (GDPR article 6(1)(b)): creating your account, completing your purchase, managing bookings and tokens, and sending you confirmations, reminders and expiry notices.
• Because the law requires it (article 6(1)(c)): bookkeeping and invoices under the Danish Bookkeeping Act.
• Because we have a legitimate interest (article 6(1)(f)): keeping the service secure and running. That covers sign-in sessions, limiting repeated sign-in attempts, the change log, the server log and troubleshooting. We consider our interest in a system that is not abused to outweigh the limited intrusion of holding an IP address for a short time.

We do not send newsletters or marketing, and we do not use your data to profile you or to make automated decisions.

4. Who else sees your data

We never sell your data. We use these suppliers:

• Stripe processes payments. You enter your card details directly with Stripe, which is an independent controller for them. We only get the amount, the status and a reference back.
• one.com sends and receives our email. The content of the emails we send you passes through it.
• Our hosting provider supplies the server the application and database run on. The server is in the Netherlands, so within the EU.

Beyond that we disclose data only where we are obliged to, for example to an authority entitled to it.

5. Transfers outside the EU

Our server and our email are inside the EU. Stripe is a global company and may process data outside the EU. That happens under the European Commission's standard contractual clauses, which form part of Stripe's data processing agreement.

6. Cookies and third parties on the site

We set one kind of cookie: the one that keeps you signed in. It is necessary for you to use your account and does not require consent. Your choice of Danish or English lives in the page address, not in a cookie.

We do not use Google Analytics or any other analytics or marketing tool, and we do not track you across websites.

The front page embeds a map from Google Maps so you can see where the building is. When the map loads, Google receives your IP address and can set its own cookies. This happens on the front page only, and the map loads only once you scroll down to it. If you would rather avoid it, block third-party content in your browser. The rest of the site works fine without the map.

7. How long we keep it

• Account, profile and booking history: for as long as you have an account with us. Ask us to delete it and we delete it.
• Accounting records, including invoices, payments and purchases: five years from the end of the financial year they belong to. The Danish Bookkeeping Act requires this and we cannot delete them earlier, even if you ask.
• Sign-in sessions: until the session expires or you sign out.
• Email log and change log: for as long as needed for operations and documentation.
• Server log: until the server is next updated, at which point the log starts over.

8. If you use a room for your own clients

If you rent a room to see your own clients, you are the controller for their data, not us. We do not know who you are meeting, we do not ask, and we do not need to know. So please do not put names or anything else about your clients in booking notes or in emails to us.

Because we do not process data on your behalf, no data processing agreement between us is needed. We let you a room.

9. Surveillance on the premises

There is no CCTV in the building, not in the rooms, not in the hallways and not at the entrance. There is no electronic access control recording who comes and goes either. Entry uses a shared code for a keypad lock, and that code logs nothing.

If that ever changes we will say so here, and tell you before anything is installed.

10. Security

The site runs over an encrypted connection. Passwords are stored as cryptographic hashes. Repeated sign-in attempts are rate limited. Only people with an operational need have access to the database.

11. Your rights

You have the right to access the data we hold about you, have inaccurate data corrected, have data erased, have processing restricted, receive your data in a machine-readable format, and object to processing based on our legitimate interest.

Write to info@ryesgade6.dk. We answer within a month. It is free.

Erasure cannot extend to accounting records we are required to keep. If you ask us to delete your account while we still have to keep your invoices, we delete the account and keep the records until the period runs out.

If you are unhappy with how we handle your data we would like to hear it first. You can also complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby.

12. Changes

If we change anything material about how we handle your data, we write to you about it. Smaller corrections show up in the date below.