This website uses no advertising trackers. We use a necessary cookie to remember your cookie choice. Only with your permission, we use Google Analytics and Vercel Web Analytics to count visits and see which pages are useful, and Crisp live chat uses cookies to keep a conversation connected. If you never fill in a form or write in the chat, we never learn your name.
We sell security assessment, so it would be a poor look to write this page badly. Everything below is checkable: open your browser’s developer tools, look at the network requests and the cookie jar, and hold us to it.
Who is responsible
Advension ApS is the data controller for this website.
Advension ApS
CVR 41876980
Amager Strandvej 60
DK-2300 Copenhagen
Denmark
hello@advension.com
Anything about your personal data (a question, a correction, or a request to delete it) goes to dpo@advension.com. It is a separate address from our general enquiries on purpose: the GDPR gives us one month to answer, the clock starts when your message arrives rather than when someone notices it, and a request about your data should not have to queue behind sales email. It reaches our CISO directly. You can write to this address from a personal email account; the work-email requirement for our forms does not apply to privacy requests.
We are not required to designate a formal Data Protection Officer under Article 37 of the GDPR. We are a small consultancy, and our core activities do not involve large-scale monitoring of individuals or large-scale processing of special categories of data. We keep the dedicated address regardless.
What we collect, and when
Five things. One of them, what your browser sends when it loads a page, happens without you choosing it; the other four happen only if you do.
If you send us an enquiry
The contact form asks for your first name, last name, company, work email address, and whatever you write in the message field. We deliberately do not ask for a phone number at that stage. We use these details to review and, where appropriate, respond to your enquiry. You will not be added to a mailing list because you asked a question.
Our enquiry and newsletter forms require a work email address and reject known personal and disposable email domains. We may decline general enquiries, and submitting an enquiry does not guarantee a response. For requests about your personal data, use the dedicated privacy email address above.
The application form for the free Agentforce working session also asks for your role, where your organisation is based, roughly how many Salesforce users you have, which Salesforce products you use, where you are with Agentforce, whether the process owner can join, and your timeline. We use those answers to decide whether the session is a good fit and to prepare for it, and for nothing else. They are stored with your enquiry in Salesforce.
If you write in the chat
Whatever you type into the chat, plus any name or email address you choose to give there. The chat asks for nothing up front. To keep the conversation connected, the chat service also records your IP address, browser details and the page you wrote from. We use this to answer you, and for nothing else. Please do not send passwords, access details or other confidential material through the chat.
If you subscribe to the newsletter
Your email address, and optionally your first name. Subscribing is a separate, deliberate act, and we confirm it by email before sending anything. Denmark’s Markedsføringslov §10 requires prior consent for electronic marketing, and a confirmation click is how that consent is evidenced. Every message we send carries an unsubscribe link, and it works immediately.
If you allow analytics
If you accept optional cookies, we load Google Analytics. It records which pages you view and for how long, how you arrived (for example the site or campaign that linked to us), your device and browser type, your approximate location at city level, and interactions such as scrolling, clicking a link to another site or downloading a file. It also records when a form on this site is sent successfully, but never what you wrote in it. Google uses your IP address to work out the approximate location and, according to Google, does not log or store it.
We look at Google Analytics data in aggregate, to learn which pages help people and which do not. We do not use it to identify you, we have not linked it to any Google advertising product, and Google signals, which would connect visits to signed-in Google accounts, is switched off.
With the same permission, we also load Vercel Web Analytics for a simpler traffic overview. It records page views, referral sources, browser and device information, and approximate country-level location. It does not use cookies. Vercel derives a temporary visitor identifier from the incoming request and discards visitor sessions after 24 hours. We see aggregate statistics and do not send form contents or custom events to this service. Withdrawing permission stops it on this site.
When your browser requests a page
Our hosting provider records ordinary server logs: IP address, the page requested, the time, the referring page and your browser’s user-agent string. This is unavoidable. It is how the web works, and it is what allows the site to be kept online and defended against abuse. We do not use these logs to build a profile of you, and we do not combine them with anything else.
Crisp loads only if you allow live chat cookies. When it loads, Crisp receives technical information such as your IP address and browser details and sets chat session cookies, described under “Cookies and browser storage” below. These identifiers can be personal data even if you do not provide your name or email address.
What we do not collect
No advertising pixels, no session recording, no heatmaps, no advertising identifiers, no cross-site tracking, and no analytics unless you allow it. The site search runs entirely inside your browser against a file downloaded with the page. Your search terms are never transmitted to us.
Cookies and browser storage
We ask before using optional cookies or similar technologies. You can accept or reject them with equally visible choices, and change your mind at any time through “Cookie settings” in the footer. The optional services are analytics and live chat, and one choice covers both. We do not use advertising cookies. The site works fully without optional services.
- Your choice: we store “accepted” or “rejected” in a first-party cookie named advension-cookie-choice and in local storage under advension:cookie-choice:v3. These are used only to remember your choice. The cookie expires after 180 days. If you delete it, we ask again even if local storage remains. We do not send the local storage value to our server.
- Analytics: if you allow it, Google Analytics sets cookies named _ga and _ga_BC97CD6971 on our domain. They hold a random identifier so that repeat visits and sessions can be counted, and they expire after two years. Withdrawing permission stops both analytics services on this site and deletes the Google Analytics cookies from your browser. Vercel Web Analytics does not set cookies or store its visitor identifier in your browser.
- Live chat: if you allow it, Crisp sets cookies named crisp-client/* and may use local storage to keep your conversation across pages and visits. Crisp says its cookies last six months and are renewed when you return. Rejecting chat prevents Crisp from loading. Withdrawing permission stops it on this site and clears the chat storage accessible to us in your browser. It does not delete messages you previously sent; contact us if you want those deleted.
Third parties your browser contacts
A website is rarely a single server, so here is the complete list of other companies your browser talks to while you are on this site.
YouTube. Some pages embed a video. Nothing is requested from YouTube until you press play. Until then the player is a still image and a button. Playing the video loads youtube-nocookie.com. Google then receives your IP address and may use cookies or similar storage during playback, under its own privacy policy.
Google Analytics. We load Google’s analytics script from googletagmanager.com only after you accept optional cookies, and it then sends measurements to google-analytics.com. What it records is described above.
Vercel Web Analytics. Only after you accept optional services, your browser loads its script and sends page-view measurements through paths on this website. Vercel processes those requests to provide the traffic statistics described above.
Crisp. We load Crisp from crisp.chat only after you allow live chat. Its storage and purpose are described above. You can also contact us by email or the contact form without allowing it.
Nobody else. No advertising networks, no tag management containers, no A/B testing, no CDNs for scripts.
Why we are allowed to
The GDPR requires a legal basis for each purpose. Ours are:
- Answering your enquiry: Article 6(1)(b), steps taken at your request before entering into a contract; and where no contract is in prospect, Article 6(1)(f), our legitimate interest in replying to someone who wrote to us. This covers the contact form and the chat alike.
- Sending the newsletter: Article 6(1)(a), your consent, given by confirming your subscription. You can withdraw it at any time, and withdrawing is as easy as giving it.
- Server logs and site security: Article 6(1)(f), our legitimate interest in keeping the site available and resistant to abuse.
- Measuring how the site is used: your consent under the cookie rules and Article 6(1)(a) of the GDPR, which you can withdraw through Cookie settings.
- Loading live chat and storing its session: your permission under the cookie rules and Article 6(1)(a) of the GDPR, which you can withdraw through Cookie settings.
- Accounting records, where you become a client: Article 6(1)(c), a legal obligation under Danish bookkeeping law.
Where we rely on legitimate interest, we have weighed it against your rights and concluded it is proportionate. The data is minimal, the purpose is one you would expect, and you can object at any time. Ask us and we will explain the assessment rather than quote the article at you.
How long we keep it
- Enquiries and chat conversations that do not become work: up to 24 months, then deleted. We keep them that long because business conversations in this market are slow, and someone who asked a question in March often comes back the following year.
- Chat connection data: if you visit the site but never send a chat message, Crisp discards your IP address when the session expires after 30 minutes of inactivity. If you do start a conversation, Crisp keeps the IP address for security and abuse prevention for at least one year, as French law requires, and states that it may keep it longer.
- Google Analytics: Google Analytics keeps the detailed, visit-level data for 14 months and then deletes it. We chose that period so we can compare a full year, since decisions in our market often take that long. Aggregated reports, such as how many people viewed a page in a month, remain. The cookies in your browser last up to two years unless you withdraw permission or clear them.
- Newsletter subscriptions: until you unsubscribe, plus a minimal record that you unsubscribed, so that we can prove we stopped.
- Server logs: as retained by our hosting provider under their own policy, typically a short rolling window.
- Client and accounting records: five years from the end of the financial year to which the material relates, as required by the Danish Bookkeeping Act. We cannot delete these earlier even if you ask, and we will tell you so plainly if you do.
Who else sees it
Nobody buys it, because we do not sell it. A small number of suppliers process data on our behalf, under written data processing agreements that require them to act only on our instructions:
- Vercel: hosting, server logs and, only with your permission, Web Analytics traffic statistics. The site is deployed to Vercel’s Stockholm region, which runs on Amazon Web Services inside the EU, so the origin and the compute sit in Europe. Pages are delivered over Vercel’s global edge network, which means the server that physically answers your request is usually the one nearest you. Vercel holds ISO 27001:2022 certification and a SOC 2 Type 2 attestation, encrypts data at rest with AES-256, and serves over TLS 1.3.
- Salesforce: our own CRM. An enquiry sent through the form is created as a record there, which is where we track the conversation with you.
- Crisp (Crisp IM SAS, Nantes, France): live chat. Messages you send through the chat, and any name or email address you choose to give there, are stored in Crisp so we can reply. Crisp stores chat data in the EU (the Netherlands, with encrypted backups in Ireland). Crisp’s optional AI features, which would send messages to providers outside the EU, are switched off.
- Google (Google Ireland Limited, Dublin): analytics, only if you allow it, under Google’s data processing terms for Google Analytics.
- Brevo: newsletter subscriptions, confirmation emails and newsletter delivery. It processes your email address, any first name you provide, and subscription and unsubscribe records.
- Our email provider: because replying to you means sending an email.
We may also disclose data where we are legally required to. If that ever happens and we are permitted to tell you, we will.
Data leaving the EU
Three of our suppliers are United States companies or part of one, so this deserves a precise answer rather than a reassuring one.
Hosting and Vercel Web Analytics. We chose Vercel’s Stockholm region deliberately, and that is where the site runs. But choosing an EU region is not the same as a guarantee that nothing ever leaves the EEA: Vercel is a US company, content is delivered from a worldwide edge network, and Vercel’s own data processing terms permit transfer to the United States and to anywhere else it or its own suppliers operate. We would rather write that sentence than the comfortable one.
Our CRM. An enquiry you send through the form becomes a record in Salesforce, a US company, so the same applies.
Analytics. Our contract for Google Analytics is with Google Ireland Limited, but the data is processed by Google LLC in the United States, so if you allow analytics it leaves the EU.
The chat. Crisp is a French company and stores chat data inside the EU, and its data processing agreement with us rules out transferring it outside the EEA. For completeness: to keep the chat fast worldwide, Crisp routes connections through relay servers, some of them in the United States, the United Kingdom and Singapore. Those servers pass the connection through and keep a connection log (which includes your IP address), but do not store your messages.
The safeguards. Vercel, Salesforce and Google are all certified under the EU–U.S. Data Privacy Framework, and all three rely on the European Commission’s Standard Contractual Clauses for transfers outside the EEA. We name both mechanisms rather than the Framework alone, on purpose. Its adequacy decision was upheld by the EU General Court in September 2025, but an appeal is pending before the Court of Justice, the same court that struck down both predecessor arrangements. If it falls, the Standard Contractual Clauses are what remains, and we would rather you knew the second mechanism was already in place than discover later that there was only one.
Your rights
Under the GDPR you can ask us to: give you a copy of the personal data we hold about you (Article 15); correct it if it is wrong (16); delete it (17); restrict what we do with it (18); send it to you or another controller in a portable format (20); and object to processing we base on legitimate interest (21). Where we rely on your consent, you can withdraw it at any time (7(3)).
Write to dpo@advension.com. We will respond within one month, which is the period the GDPR allows, and usually much sooner. We are a small team and we read our own email. We will not charge you, and we will not make you explain why.
You do not need an account, a form, or a particular form of words. “Please delete everything you have about me” is a valid request and we will treat it as one.
If you think we have got it wrong
Tell us first if you are willing to. It is faster, and we would rather fix it. But you have an unconditional right to complain to the Danish supervisory authority, and using it does not require our agreement:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
datatilsynet.dk
How we protect it
The site is served over HTTPS only. Access to our CRM requires multi-factor authentication and is limited to the people who need it, which at our size is a short list we can name. We apply to ourselves the access and permission practices we assess for clients including the unglamorous one of periodically checking who still has administrator rights and removing those who no longer need them.
No system is perfect. If we ever suffer a breach that is likely to result in a risk to your rights, we will notify Datatilsynet within 72 hours as Article 33 requires, and we will tell you directly where Article 34 requires it.
Children
This site sells Salesforce architecture to enterprises. It is not directed at children and we do not knowingly collect data about them.
Changes
If we change how this site handles personal data, we change this page on the same day not afterwards. The version below is the one in force.
Effective 14.11.2026.
Questions about this policy, or about how we handle data on an engagement, go to dpo@advension.com.