Privacy and cookie policy.

1. Data controller

Heartfelt.biz, Heidi Wassini
CVR no. (Danish company reg.) 40687432
Email: heidi@heartfelt.biz
Phone: +45 29 21 12 27

2. When you visit the website

Technical operation

The website is hosted by Vercel. When you visit, technical information such as IP address, browser type and time is recorded in server logs so the site can be delivered securely and reliably. This information is not used to identify you and is deleted automatically after a short period. The fonts are hosted on the website itself, so nothing is loaded from Google or other third parties when the page is shown.

Legal basis: legitimate interest in running a secure website (GDPR Art. 6(1)(f)).

Visitor statistics

I use Vercel Web Analytics to see how many people visit the site, which pages are read, where visitors come from, and which country and type of device they use. It sets no cookies, stores nothing on your device and does not track you across websites. Data is only shown in aggregate, and I cannot see who you are.

Legal basis: legitimate interest in improving the website (Art. 6(1)(f)).

Links to other websites

The website links to services such as LinkedIn, Spotify, Apple Podcasts and YouTube. None of this content is embedded, so no information is sent to these services until you click. Once you leave heartfelt.biz, that service’s own privacy policy applies.

3. When you contact me

When you email or call—for example to book an HR health check—I process the information you provide: typically your name, email, phone number, company, job title and the content of your message. I use it to reply, send a proposal and deliver the agreed service.

Legal basis: responding to your enquiry and preparing or performing a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).

Retention: Enquiries that do not lead to a collaboration are deleted no later than 2 years after the last contact.

4. When you are a client

As a client, I process your contact and billing details and the information needed to deliver the assignment.

Legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation under the Danish Bookkeeping Act (Art. 6(1)(c)).

Retention: Accounting records are kept for 5 years from the end of the financial year they relate to. Other information is deleted when it is no longer needed.

If I recruit on behalf of a client as part of an assignment, candidates receive separate information about how their data is processed.

5. Events and sign-ups

Registration for Heartfelt Collective takes place via Luma (luma.com), where Luma’s own privacy policy applies. I receive the information you provide—typically name, email, job title and company—and use it to plan the event and communicate with you about it.

Legal basis: your registration (Art. 6(1)(b)) and legitimate interest in running the community (Art. 6(1)(f)).

Retention: The information is deleted no later than 12 months after the event, unless you want to hear about future events.

6. Who I share information with

I only share information with suppliers who help me run Heartfelt, and only to the extent necessary:

• Vercel Inc. – hosting and anonymous visitor statistics
• Microsoft (Microsoft 365) – email and calendar, when you write to me
• Luma – event registration
• Accountant or bookkeeper – in connection with invoicing

Some of these suppliers are based in the US. Transfers take place on the basis of the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

7. Cookies

The website uses only one cookie. It is necessary for a function you choose yourself and therefore does not require consent. The visitor statistics (see section 2) do not use cookies.

You can delete cookies at any time in your browser settings.

8. Your rights

You have the right to access the information I hold about you and to have it corrected or deleted. You can also ask me to restrict processing, object to it, and receive your information in a commonly used format (data portability). Where processing is based on your consent, you can withdraw it at any time.

Write to heidi@heartfelt.biz and I will reply within one month.

9. Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, datatilsynet.dk. I would always like to hear from you first, though, so we can find a solution.

10. Changes

I update this policy when there are changes to how I process information. The date at the top shows when it was last updated.