Privacy policy

Data controller

Kestro, Aarhus, Denmark. Email: kontakt@kestro.dk.

In short

This website shows no advertising and shares nothing for marketing. Fonts and images are served from our own domain. We count visits and measure speed without cookies — that always runs, and it does not follow you elsewhere. Google Analytics we use only if you actively say yes; if you say no, nothing is loaded from Google at all.

Cookies

We set no cookies of our own. Two small values are stored locally in your browser: your answer to the statistics question, and whether you have dismissed the note about the English version. They are never sent to us, and they are used for nothing but remembering those two choices.

Those two values are necessary to remember what you answered, so they need no consent. Statistics do: if you say yes in the banner, Google Analytics sets its own cookies (_ga and _ga_*) to tell visits apart. They expire after two years and hold a random id, not a name. If you say no — or do not answer — nothing is set and nothing is sent.

The contact forms

When you submit a form, the content goes to our own server on kestro.dk, which passes it on to us as an email. So we receive information only once you press send — but it is the site that sends it, not your own mail client.

We process: name, company, email address, phone number if given, the content of the message, and which page on kestro.dk it was sent from. On the quote form, also what you fill in about quantity, model, memory, storage, keyboard and preferred delivery date.

If the form cannot send, it shows you the message so you can copy it or open it in your own mail client. In that case the details do not leave your browser until you send them yourself.

Purpose and legal basis

We process the data to answer your enquiry and to enter into or perform an agreement with you — GDPR article 6(1)(b).

Ordinary customer contact, follow-up, and the operation and security of the website rest on our legitimate interest — article 6(1)(f).

Statistics (Google Analytics)

If you accept statistics in the banner, we load Google Analytics 4 and measure which pages get read, how you arrived, and whether a form was sent. We never send your name, email, phone number or the content of a message to Google.

The legal basis is your consent — GDPR article 6(1)(a) and the Danish cookie order § 3. You can withdraw it at any time through the "Cookies and statistics" link at the bottom of the page; after that, Google is not loaded again.

Google LLC processes the data as our processor and is a US company. The transfer rests on the European Commission's standard contractual clauses and the EU-US Data Privacy Framework. Sharing with Google's advertising products is switched off.

Our own visit statistics

We keep our own visit count on our own server. For each page view we store which page was read, which country the request came from, whether it was read on a phone, tablet or computer, and which website or app you arrived from — for example Google or Instagram. We also store how long a visit lasted.

To see that two page views belong to the same visit, we derive a number from your IP address, your browser identification and a random value that is replaced every 24 hours. The IP address itself is neither stored nor logged, and once the day's random value has been deleted the number can no longer be traced back to an address — not even by us. Still no cookies, and still nothing stored in your browser.

The legal basis is our legitimate interest in knowing whether the site is read and how it is found — GDPR article 6(1)(f). Because nothing is written to or read from your device, these are not cookies in the sense of the Danish cookie order. The numbers live in our own database with Neon, Inc. and are not shared with anyone.

Visit counts and speed (Vercel)

Alongside Google Analytics we count visits with Vercel Analytics and measure page speed with Vercel Speed Insights. Both run whatever you answer in the banner, and there is a reason for that: they set no cookies, store nothing in your browser and do not follow you to other websites. What is recorded is a page view, which country the request came from, and how quickly the page rendered.

The legal basis is our legitimate interest in knowing whether the site is read and whether it is fast enough — GDPR article 6(1)(f). Because nothing is written to or read from your device, these are not cookies in the sense of the Danish cookie order, and nothing is collected that can point to a particular person.

Vercel Inc. is a US company and processes the data as our processor, on the basis of the European Commission's standard contractual clauses. Vercel already hosts the site, so the request reaches them in any case.

Server logs

Our hosting provider records technical information about visits — IP address, time and browser type among others — in order to run and secure the website. The logs are not used to profile visitors.

Providers and transfers

The website is hosted with Vercel Inc., which also provides the visit counts and speed measurements described above. Messages from the forms are sent as email through Resend, Inc., and land in our own mailbox; they are stored at the same time in our database with Neon, Inc., so we can answer them without anything going missing. If you accept statistics, Google LLC also processes visit data for us. All four are processors acting on our behalf.

Vercel, Resend and Google are US providers. Transfers of personal data to the US take place under the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework.

How long we keep it

We keep correspondence for as long as the dialogue or the customer relationship requires. Records covered by the Danish Bookkeeping Act are kept for five years from the end of the financial year they relate to.

Your rights

You have the right to access the data we process about you and to have inaccurate data corrected. You may request erasure, request restriction of processing, object to the processing, and request data portability.

Write to kontakt@kestro.dk to exercise any of these rights. You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk.