Legal
Privacy Policy
This page explains which personal data Sustainary receives through the website, why we use it and when it is deleted.
Data controller
Sustainary, Danish company registration no. 40031960, Nørrebrogade 20, 1st floor, c/o Greencubator, 2200 Copenhagen N. Questions about personal data can be sent to [email protected].
Contact form
When you write to us, we receive your name, email address and message. We process the information to read, respond to and follow up on your enquiry. The legal basis is our legitimate interest in communicating with people who contact us, under GDPR Article 6(1)(f). The information is automatically deleted no later than 365 days after submission, and earlier if it is no longer necessary.
Job and volunteer applications
When you apply for a position, we receive your name, email address, optional phone number, CV and application. We use the material only to assess and manage that specific application. Depending on the nature of the position, processing is necessary to take steps before entering into a possible agreement under GDPR Article 6(1)(b), and/or is based on our legitimate interest in recruiting employees, interns and volunteers under Article 6(1)(f). The material is automatically deleted no later than 180 days after submission. We do not retain it for future positions without separate consent.
Which information must you provide?
Fields marked with an asterisk are necessary for us to respond to your enquiry or process your application. The form cannot be submitted without them. Phone is optional. Do not include national identification numbers, health data, religious or political beliefs or other sensitive information in messages, CVs or applications unless we have explicitly and lawfully requested it.
Storage and access
Contact messages and application records are stored in a private database hosted by Supabase. CVs and applications are stored as private files with Vercel. Only the authorised Sustainary administrator can access them through the protected admin area. The system sends a technical notification through Resend when a new submission arrives, but the notification does not contain the form message, CV or other applicant information.
Processors and international transfers
We use Vercel for hosting and private files, Supabase for the database and Resend for technical email notifications. They process data under our instructions and data processing agreements. If a provider processes data outside the EU/EEA, the transfer is based on a lawful safeguard, such as the European Commission’s Standard Contractual Clauses or a valid adequacy framework. Contact us for further information about the safeguards.
Analytics and cookies
We use Vercel Web Analytics for anonymous, aggregated website statistics. It does not use advertising or tracking cookies. The protected admin area uses an essential session cookie. Read more on the Cookies and Analytics page.
Your rights
You can contact us to access your information, correct inaccurate information, restrict processing or request deletion. You may object to processing based on legitimate interests and, where applicable, have a right to data portability. If processing is based on consent, you may withdraw that consent at any time. Rights may be limited by lawful considerations, such as the establishment or defence of legal claims.
Complaints and automated decisions
We do not make automated decisions or profile people through the forms. If you are unhappy with our processing, please contact [email protected] first. You may also complain to the Danish Data Protection Agency at datatilsynet.dk.
Last updated: 30 July 2026.