This policy describes what personal data Countermove processes, why, and what rights you have. It covers the website countermove.dk, enquiries and demo bookings, and the Countermove application, where the tabletop exercises are run.
Controller
Countermove ApS, CVR 46789369 (Danish company registration number)
E-mail: info@countermove.dk
Write to us if you have questions about how we process personal data.
The website
The website sets no cookies and stores nothing in your browser. We count visits without cookies and only see totals, such as how many people visited a page. We cannot see who an individual visitor is. When your browser fetches a page, our hosting provider receives technical information such as your IP address in order to deliver it.
When you write to us or book a demo
If you write to us or book a demo, we use your name, your e-mail address and what you write to reply to you and hold the meeting you booked.
The application
The Countermove application is open to invited users only.
Sign-in
You sign in with a Google or Microsoft account. Only e-mail addresses we have given access in advance can sign in. An attempt from any other address is refused, and we create no user and store no information about you. For invited users we store name, e-mail address and a link to the profile picture, as they come from Google or Microsoft. The application uses one necessary cookie to keep you signed in. It expires after 12 hours without activity.
Exercise data
An exercise contains information about the organisation taking part: a profile of the organisation, the scenario, the participants' names and roles, the decisions the team makes, and the assessment that comes out of it. We process this information on behalf of the client organisation, which is the controller. We process it as the client's data processor, and only to run the exercise and produce the report.
Recipients and processing outside the EU
We use providers of hosting, database, e-mail, booking and AI services, which process the information on our behalf and on our instructions. We do not sell personal data or disclose it for other purposes.
The application's data, including exercise data, is processed in the EU. The providers of website hosting and of e-mail and booking may process data outside the EU. Where they do, it is on the basis of the European Commission's decision on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.
Legal basis
- The website and visit counts: our legitimate interest in providing the website and seeing how it is used (GDPR Article 6(1)(f)).
- Enquiries and bookings: our legitimate interest in replying to you and holding the meeting you booked (Article 6(1)(f)), or steps you have asked for before entering into an agreement (Article 6(1)(b)).
- Signing in to the application: it is necessary to give you access under the agreement with the client you take part for (Article 6(1)(b) and (f)).
- Exercise data: here the client is the controller and determines the legal basis. We process the information on the client's instructions.
Retention and deletion
- Enquiries and bookings are kept for as long as we need them to reply to you and hold the meeting. Then we delete them.
- User details are kept for as long as you have access to the application. When access ends, we delete them.
- Exercise data: the client decides how long it is kept and can have it deleted at any time. When the agreement with the client ends, we delete it.
Automated decisions
We make no automated decisions about you. The assessments in an exercise concern how the team handled a scenario, not the individual participant.
Your rights
You have the right to access the personal data we process about you and to have inaccurate data corrected. You may also have the right to have data erased, to restrict processing, to object, and to receive your data in a portable format.
Write to info@countermove.dk and we will reply as soon as we can, and within one month at the latest. If your request concerns exercise data we process on behalf of a client, we pass it on to the client, as the controller, and help them respond.
Complaints
You can complain about our handling of personal data to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk. We would like to hear from you first, so we can try to resolve it.
Changes
We update this policy when the way we process data changes. The date at the top shows when it was last changed.