— Legal

Privacy Policy

Last updated: 8 October 2026

Who is responsible

Base Layer is responsible for the personal data processed through baselayer.dk.

Contact enquiries

When you contact us, we process your name, email address, message and any optional organization details you provide. Email correspondence may also include attachments and technical delivery information. Please avoid sending sensitive personal information or information about other people unless necessary.

We use this information to answer your enquiry, handle corrections and scope requests, and keep track of the correspondence. Our legal basis is our legitimate interest in responding to people who contact Base Layer (GDPR Article 6(1)(f)). If your enquiry concerns entering a contract with us, the relevant processing may instead be necessary for pre-contractual steps you request (Article 6(1)(b)).

Name, email and message are required to submit the contact form. Without them, we cannot process the form or reply. Organization details are optional. You can also contact us directly by email.

Website operation and security

Our hosting and delivery providers process technical information such as IP addresses, request details, browser information and security or delivery logs to operate the website, deliver messages and prevent abuse.

Our legal basis is our legitimate interest in running a reliable and secure website and communication service (Article 6(1)(f)).

Our website uses Google Tag Manager to manage tags for Google Analytics and advertising services, including Google Ads and Microsoft Advertising. Depending on your choices and the tag configuration, these services may process page visits, interactions, referral information, device information and online identifiers to measure website usage and advertising performance.

Our legal basis for consent-based analytics and advertising is your consent (Article 6(1)(a)). You can accept, reject or choose these categories separately in the cookie banner. Use Cookie settings in the footer to change your choice or withdraw consent. Withdrawal does not affect processing that was lawful before you withdrew it.

Your preference is stored in your browser’s local storage under bl-cookie-consent so we can remember it. Optional analytics and advertising storage is denied until you enable the relevant category.

When you disable a category, our banner removes its known, accessible tracking cookies on the Base Layer domain. This does not remove cookies on external domains, all other browser storage, or information previously collected by a provider.

Our Google and Microsoft consent-mode integrations can still send consent signals and measurements without optional cookies when storage is denied. These requests may include page and referral information, browser or device information, and technical network information. Rejecting optional cookies does not mean that every request to these providers is blocked or that no information is transmitted.

See our Cookie Policy for more information about cookies and similar technologies.

Service providers and recipients

We use providers to operate the website and handle communication:

  • Cloudflare: website hosting, content delivery and security.
  • Resend: delivery of contact-form messages.
  • Hostinger: our email mailbox and email service.
  • Google and Microsoft: the analytics and advertising services described above.

Relevant information is shared with these providers as needed for their services. Some providers also process certain information for their own purposes under their privacy notices. We may disclose relevant information when required by law or where necessary to establish, exercise or defend a legal claim.

International processing

Our providers may process information outside the EU/EEA. The transfer arrangements depend on the provider and destination. Where required, safeguards include an applicable adequacy decision or EU Standard Contractual Clauses with supplementary protections as appropriate. Contact us for information about the safeguards applicable to your data.

Retention

We retain ordinary contact enquiries for no longer than six months after the last correspondence, deleting them sooner if they are no longer needed. We may retain relevant records longer for an ongoing matter, a specific legal obligation or an actual legal claim; this does not justify keeping all correspondence indefinitely.

Provider delivery and security records have separate retention periods. Resend currently publishes a 30-day retention period for email and log data on its standard Free, Pro and Scale plans. Mailbox copies follow our contact-enquiry period above. Provider backups may expire later under their backup schedules.

Our Google Analytics property is configured with two months for event data retention and 14 months for user data retention. Reset on new user activity is enabled: new activity resets the retention period for the relevant user identifier, so it may be retained for longer than 14 months from the first visit. These controls apply to the user-level and event-level data covered by Google’s retention settings; standard aggregated reports are not governed by the same deletion period. Data reaching the applicable retention limit is deleted through Google’s monthly deletion process.

Microsoft currently states that UET data is retained for 390 days. Advertising services can have separate retention rules for different records and purposes. See Google Analytics data retention and Microsoft UET information for provider details.

Your browser’s consent preference has no automatic expiry and remains until you change it or clear the site’s browser storage. Cookie lifetimes are separate from provider data retention and are explained in our Cookie Policy.

Some links may earn Base Layer a commission. If you follow an affiliate or other external link, the destination provider may process referral information and use its own tracking technologies. Its privacy notice and consent controls apply on its website. We do not receive your payment details merely because you follow an affiliate link.

Your rights

Depending on the processing and applicable conditions, you may request access, correction, deletion, restriction or portability of your personal data. You may object to processing based on legitimate interests and withdraw consent where consent is the legal basis.

Send requests to [email protected]. We may need limited information to verify your identity. We do not use contact enquiries to make solely automated decisions producing legal or similarly significant effects.

You can complain to the Danish supervisory authority, Datatilsynet, or another competent data-protection authority.

Changes

We update this notice when our services or data practices change. The date above shows the latest revision.