Privacy policy

1. Who is responsible for your data

SEJR Pay ApS, CVR 44090880, is the data controller for everything in this policy: sejr.com, enquiries and marketing, and agreements on card payments, payment terminals, POS systems and SEJR Konto, with the information we need to deliver them.

The address is Hovedvejen 107, 3., 2600 Glostrup, Denmark. Write to hej@sejr.com or call +45 70 60 30 86 about anything in this policy.

2. When you visit sejr.com

We collect technical information such as IP address, browser, device and the pages you visit. Cookies that are necessary for the site to work are set on the basis of our legitimate interest in a working and secure site (GDPR art. 6(1)(f)).

We measure visits to the site ourselves, without cookies: where you came from, which pages you view, what you click and for how long, and the city and country your connection belongs to. The IP address is used to find the city and is not stored. If you send us an inquiry, we link the visit to it, so we can see which page and which ad it came from (GDPR art. 6(1)(f)).

If you consent (GDPR art. 6(1)(a)), we also use:

• Statistics: Google Analytics 4 and PostHog, to see how the site is used and improve it.
• Marketing: Meta Pixel and Google Ads, to measure and target our ads. If you send us an enquiry, Meta’s cookie ids, the ad’s click id, your IP address and the full address of the page go along when we report the enquiry to Meta (see below). If you came from an ad on Google, we keep Google’s click id with your enquiry and tell Google when we have talked with you about a quote, and when we have sent one and what it is worth. Google gets its own click id back, not your name, e-mail or phone number.

If you send us an enquiry, we report to Meta that it has come in, so we can see which ads lead to enquiries. We do this also when you have not said yes to cookies, but then only with what you typed yourself: your e-mail and phone number in hashed form (made unreadable; Meta can only recognise them if you have a profile with the same details), the name of your browser and the page you sent from. Cookies, IP address and the ad’s click id are not sent without your consent. The basis is our legitimate interest in measuring our marketing (GDPR art. 6(1)(f)). You can object by writing to us.

You can withdraw your consent at any time, with the same effect going forward. Read more in our cookie policy.

If you open the chat, we load Zendesk, which provides the chat for us as our data processor. What you write, and any name or e-mail you give, is processed to answer you (GDPR art. 6(1)(b) and (f)). The chat only loads when you open it yourself.

3. When you contact us or ask for a quote

We process the information you give us: name, phone number, e-mail, company name and CVR number, industry, expected turnover, and any statement you send us so we can compare prices.

The purpose is to answer you and give you a quote. The legal basis is steps at your request before entering into an agreement (GDPR art. 6(1)(b)) and our legitimate interest in following up on an enquiry (GDPR art. 6(1)(f)). We only send you newsletters and offers by e-mail or SMS if you have consented.

4. When we write to a newly founded company

SEJR Pay ApS, CVR 44090880, is the sender of the letter and the data controller for what this section covers: the information from CVR, the code in the letter and the consent you can give on sejr.com/dk/ny.

We send a letter by post to newly founded companies in selected industries. We find the companies in CVR, the Danish Central Business Register, which is public. From there we take the company’s name, CVR number, address, industry, legal form and date of foundation. If the company is a sole proprietorship, this may be information about you as a person.

We only write to companies that do not have advertising protection in CVR. If the register does not say whether a company is protected, we treat it as protected. Some of the companies we find do not get a letter. We keep the same information about them, so we can measure what the letter does. The letters are printed and sent by a supplier that processes name and address for us as our data processor.

The basis is our legitimate interest in telling new companies about our products (GDPR art. 6(1)(f)). We do not send e-mail or SMS to a company we have found in CVR without consent (section 10 of the Danish Marketing Practices Act).

The letter has a code for the page sejr.com/dk/ny. If you use the code there, we note that it has been used, and when. If you give us your e-mail on the page and say yes to offers and news by e-mail, we store your e-mail, your phone number if you give it, the time and the wording of the consent you gave (GDPR art. 6(1)(a) and section 10 of the Danish Marketing Practices Act). We use the phone number to call you about the offer.

If the company does not respond to the letter, we delete the information from CVR no later than 12 months after we found it. If you give a consent, we keep it for as long as it applies, and the documentation of it for 2 years after we last used it.

You can say no at any time: write to hej@sejr.com or call +45 70 60 30 86, and we delete the information and do not write again. To be able to keep that, we keep the company’s CVR number on a list of companies we must not contact. You withdraw a consent to e-mail with the link at the bottom of every mail. If you do not want advertising from companies at all, you can get advertising protection in CVR at virk.dk.

5. When you become a customer

We process information about the company and the people we deal with:

• Company information: name, CVR number, address, industry, ownership and bank account for payouts.
• People: name, contact details and role of contact persons, signatories and beneficial owners, and identity information, including the Danish CPR number where the anti-money-laundering act requires it.
• Transactions: amount, time, means of payment and masked card number for the payments you receive.
• Operations: equipment, support requests, correspondence and invoices.

The legal basis is the performance of our agreement (GDPR art. 6(1)(b)), our legal obligations under, among others, the Anti-Money Laundering Act and the Bookkeeping Act (GDPR art. 6(1)(c) and section 11 of the Danish Data Protection Act for CPR numbers), and our legitimate interest in running and developing our business, preventing fraud and keeping our systems secure (GDPR art. 6(1)(f)).

If you do not give us the information the law requires, we cannot enter into an agreement with you.

6. SEJR Konto, card and credit

SEJR Konto, the company card and SEJR Kredit are provided in cooperation with a regulated partner, which is itself data controller for the regulated services. We pass on the information needed to open and run the account and to meet the identification and control requirements of the Anti-Money Laundering Act.

When you apply for SEJR Kredit, we assess the company’s finances, for example from its card turnover with us and accounting information from public registers. If a decision is ever made solely by automated processing, we tell you and you can have it reviewed by a person.

7. Information we handle on your behalf

When you use the POS system, the back office or time registration, we process information about your staff and your customers on your behalf. In that case you are the data controller and we are your data processor. That processing is governed by the data processing agreement that forms part of your agreement with us, not by this policy.

8. Who we share information with

We never sell your information. We share it only where it is needed, with:

• the acquiring bank that settles your card payments;
• the regulated partner behind SEJR Konto, the card and SEJR Kredit;
• IT suppliers who host and operate our systems, e-mail, telephony and customer management, as our data processors;
• Google, PostHog and Meta, for statistics and marketing with your consent, and Meta for measuring enquiries as described in section 2;
• couriers who deliver and collect equipment;
• accountants and lawyers, when needed;
• public authorities, such as the Danish Tax Agency, the Money Laundering Secretariat and the police, when the law requires it.

You can ask us for the names of the recipients.

9. Transfers outside the EU/EEA

We aim to keep information within the EU/EEA. Some suppliers, including Google and Meta, may process information in the USA. Transfers then take place on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. You can get a copy of the safeguards by writing to us.

10. How long we keep it

Enquiries that do not lead to an agreement

Up to 2 years after the latest contact.

Information we must keep under the Anti-Money Laundering Act

5 years after the customer relationship ends.

Accounting records, including invoices and settlements

5 years from the end of the financial year they relate to.

Other customer information

Up to 2 years after the customer relationship ends.

Cookies and website data

As stated in the cookie policy.

We delete or anonymise information when the period has run out, unless we need it to establish, exercise or defend a legal claim.

11. Security

We protect information with encryption in transit, personal access with rights based on need, logging and backup. Card data is handled by the payment terminal and the acquiring bank under the card industry’s security requirements (PCI DSS), and we do not store full card numbers.

12. Your rights

You have the right to:

• get access to the information we hold about you;
• have incorrect information corrected;
• have information deleted when we no longer have to keep it;
• have processing restricted;
• receive information you have given us in a machine-readable format (data portability);
• object to processing based on our legitimate interests, and always object to direct marketing;
• withdraw a consent at any time, without affecting processing before the withdrawal.

Write to hej@sejr.com and we answer within one month. You can also complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

13. Changes

We update this policy when our processing changes. The date at the top shows the latest update, and significant changes are also noted on the legal page.