Privatlivspolitik

How we collect, use, and protect your personal data, in line with GDPR (EU) and Danish data protection law.

Last updated: November 1, 2026

Denne side er ikke oversat til dansk. Teksten nedenfor er den engelske udgave; vilkårene findes også på bulgarsk, og ved uoverensstemmelse gælder den bulgarske udgave.

1. Introduction

nebesno ("we", "our", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our platform, in compliance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Danish Data Protection Act. The Platform is operated by a Danish sole proprietorship (CVR 45541843) and serves users in Bulgaria and across the EU.

2. Data Controller

nebesno is the data controller for the personal data we process. If you have any questions about this policy or wish to exercise your rights, please contact us through our contact page.

3. Personal Data We Collect

We may collect the following categories of personal data:

  • Identity Data: name, company name, title, username
  • Contact Data: email address, phone number, billing address
  • Profile Data: website link, biography, skills, service categories, ratings and reviews
  • Technical Data: IP address, browser type, device information, cookies
  • Usage Data: pages visited, search queries, interactions with partners and clients
  • Communication Data: messages sent through our platform, inquiries, support requests
  • Meeting data: times you book or make available, your video link, and any note you write for the meeting

4. How We Use Your Data

We use your personal data only for the following purposes:

  • To provide and maintain our marketplace platform
  • To match clients with suitable partners
  • To process transactions and facilitate project agreements
  • To communicate with you about your account, projects, and platform updates
  • To improve our platform and user experience
  • To comply with legal obligations and enforce our Terms of Service

5. Legal Basis for Processing (GDPR Article 6)

Under GDPR, we process your personal data on the following legal bases:

  • Contractual necessity (Art. 6(1)(b)): to provide our marketplace services and fulfill our obligations under the Terms of Service
  • Consent (Art. 6(1)(a)): for cookies, marketing communications, and optional profile data. You may withdraw consent at any time
  • Legitimate interest (Art. 6(1)(f)): to improve our platform, prevent fraud, and ensure platform security
  • Legal obligation (Art. 6(1)(c)): to comply with applicable Danish and EU laws

6. Data Sharing & Transfers

We do not sell your personal data. We may share your data with:

  • Service providers: payment processors, hosting services and analytics tools, all bound by data processing agreements compliant with GDPR Article 28
  • Other users: your profile data is visible to other platform users as necessary for marketplace functionality
  • Legal authorities: when required by Danish or EU law
  • Google and Microsoft: only if you, as a partner, connect your own calendar (see section 7), and only what is described there
  • Google Maps: a map on a partner profile with an office address loads from Google only once you have accepted cookies or clicked "Show map". Google then receives your IP address as with any Google service. See Google's privacy policy.
  • Cloudflare Turnstile: we use Cloudflare Turnstile to protect our forms against abuse and automated spam. It runs invisibly and shows no puzzles. See Cloudflare's Turnstile Privacy Addendum.

If we transfer data outside the European Economic Area (EEA), we ensure adequate safeguards under GDPR Articles 44–49, including Standard Contractual Clauses (SCCs).

7. Calendar Connection (Google Calendar and Outlook)

As a partner you can choose to connect your Google Calendar or your Microsoft Outlook calendar under Meetings. It is optional, and you can disconnect at any time.

  • What we read: the events in your main calendar over the next 62 days: start, end, title, whether each one shows you as busy or free, and (in Google) whether you declined it. We also read the events in the "nebesno" calendar we create for you (see below), and from Outlook your working hours. Every event in the "nebesno" calendar opens that time for booking, as does an event in your main calendar whose title contains the word "nebesno". Event titles are shown to you alone, as the reason a time is unavailable on Meetings; clients and other users never see them. We do not read descriptions, locations or who else is invited.
  • What we write: we create one calendar named "nebesno" in your account. When a meeting with you is booked on nebesno, we add an event for it to your calendar, and if the meeting is cancelled we delete it again. Time you mark as unavailable, extra hours and days off set on Meetings are written as events too, and if you move, rename or delete one of those in your calendar, Meetings follows. We never change or delete events we did not create.
  • What we store: which service you connected, the account's email address, an encrypted access token, your busy time ranges with their titles, the time ranges your calendar opens for booking, and the IDs of the events and the calendar we created. Other users never see any of it, only which times are free to book.
  • Why: solely to prevent double bookings and to keep your free time and your meetings the same on nebesno and in your calendar. Calendar data is not used for advertising, profiling or training AI models, and it is never sold or shared.
  • Deletion: if you disconnect, the token, your busy time ranges and their titles are deleted immediately, and we forget which events were ours. The events we wrote and the "nebesno" calendar stay in your account, where you can delete them yourself; we keep that calendar's ID so that connecting again reuses it instead of making a second one. Deleting your account deletes everything we store. You can also revoke access directly at Google or Microsoft.
  • Legal basis: your consent (GDPR Article 6(1)(a)), given when you connect the calendar, which you can withdraw at any time by disconnecting.

nebesno's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Data Retention

We retain your personal data only as long as necessary for the purposes described in this policy. Account data is retained for the duration of your account plus 12 months after deletion, unless a longer retention period is required by Danish or EU law. Communications and transaction records are retained for up to 5 years to comply with accounting and tax obligations (Danish Bookkeeping Act).

9. Your Rights Under GDPR (Articles 15–22)

As a data subject in the EU/EEA, you have the following rights:

  • Right of access (Art. 15): request a copy of the personal data we hold about you
  • Right to rectification (Art. 16): request correction of inaccurate or incomplete data
  • Right to erasure / "Right to be forgotten" (Art. 17): request deletion of your data
  • Right to restrict processing (Art. 18): request limitation of how we use your data
  • Right to data portability (Art. 20): request transfer of your data to another service provider
  • Right to object (Art. 21): object to processing based on legitimate interests or direct marketing
  • Rights related to automated decision-making (Art. 22): not be subject to decisions based solely on automated processing

To exercise any of these rights, contact us through our contact page. We will respond within 30 days as required by GDPR Article 12. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at www.datatilsynet.dk, or with the authority in the EU country where you live; in Bulgaria that is the Commission for Personal Data Protection (КЗЛД) at www.cpdp.bg.

10. Cookies & Tracking

We use essential storage to keep you signed in and to make the platform work. With your consent we also measure how the site is used (which buttons are pressed and where people get stuck) so we can fix what is confusing. That measurement stores no cookie and no identifier that outlives your browser tab, and it never records what you type, search for or write. You can withdraw your consent at any time through the cookie banner or your browser settings. For more detail, see our Cookie Policy.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.3), access controls, and regular security assessments, in accordance with GDPR Article 32. However, no method of transmission over the Internet is 100% secure.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Material changes will be notified to you via email or a prominent notice on the platform, as required by GDPR Articles 13–14.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us or reach out via LinkedIn. You may also contact the Danish Data Protection Agency (Datatilsynet) at Carl Jacobsens Vej 35, 2500 Valby, Denmark.

nebesno · CVR: 45541843