Privacy Policy
Privacy Policy
Last updated: October 27, 2026
1. Who we are
eCourier ApS
Rådhusstræde 15
1466 København K
Denmark
CVR / Company registration number: 41412003
Email: info@ecourier.io
eCourier ApS is the data controller for the personal data described in this policy.
2. Scope of this policy
This Privacy Policy describes how we process personal data when:
- you visit our website
- you create or use an account in our SaaS product
- you communicate with us (e.g. support, sales, billing)
- you represent a business registered, or proposed for registration, on Peppol or NemHandel through eCourier, including through an intermediary
We act as an independent controller when we use personal data in authorisation and verification records for our own legal and network-compliance purposes, including checking registration authority, preventing unauthorised registrations and handling related claims. This applies whether we obtain the records directly or through a customer or other intermediary.
Personal data processed on behalf of customers is governed by our Data Processing Agreement (DPA). Depending on the customer's role, eCourier acts as its processor or sub-processor for both the customer's own document flows and flows managed for its customers.
3. Personal data we process
We process the following categories of personal data:
Account and contact data
- Name
- Email address
- Company name
- User role and permissions
Registration authority and verification data
- Representatives' names, business contact details, roles and evidence of their authority to act
- The business and participant identifiers covered by an authorisation
- Accepted terms, signatures or electronic acceptance records, acceptance dates and verification results
We obtain these records from you, the business you represent, our customers or other intermediaries, and relevant business or identifier registers. We process only the information necessary for the purposes described below.
Usage and technical data
- IP address
- Login timestamps
- Session identifiers
- Application logs necessary for security, troubleshooting, and operation
- Website interactions, browser and device information, online identifiers and consent signals used for website analytics
- Website activity, online identifiers and inferred company information when you consent to advertising tracking
Communication data
- Emails and messages sent to support or sales
Billing and payment data
- Billing contact details and address
- Payment and transaction information, such as amounts, dates and payment status
4. Purposes and legal bases
We process personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Providing and operating the service | Contract (GDPR Art. 6(1)(b)) |
| Account administration and customer support | Legitimate interest (Art. 6(1)(f)) |
| Security, abuse prevention, and logging | Legitimate interest (Art. 6(1)(f)) |
| Billing and accounting | Legal obligation (Art. 6(1)(c)) |
| Documenting consent to NemHandel registration as required by section 19(3) of Danish Executive Order 1811/2023 | Legal obligation (Art. 6(1)(c)) |
| Verifying registration authority, meeting Peppol network requirements and preventing unauthorised registrations | Legitimate interests in authorised network participation, compliance with our network obligations and prevention of misuse (Art. 6(1)(f)) |
| Establishing, exercising or defending registration-related legal claims | Legitimate interest in protecting our legal rights (Art. 6(1)(f)) |
| Supporting authorised provider transfers and service continuity | Legitimate interests in avoiding disruption and maintaining authorised document routing (Art. 6(1)(f)) |
| Website analytics using cookies | Consent (Art. 6(1)(a)) |
| Website visitor identification and marketing tracking | Consent (Art. 6(1)(a)) |
The statutory duty to document consent to NemHandel registration is set out in section 19(3) of Executive Order 1811/2023.
We need sufficient registration and authorisation evidence to verify authority and meet applicable requirements. If it is not provided, we may be unable to register or continue services for the business.
5. Cookies
We use necessary cookies for authentication, sessions and security. Optional cookies for analytics, website performance and marketing require your consent. See our Cookie Policy for purposes, preference controls and Google's cookieless Consent Mode behaviour.
6. Service providers and data sharing
We share personal data with providers for the following purposes:
| Provider | Purpose |
|---|---|
| Amazon Web Services and Hetzner | Platform hosting and infrastructure |
| Sentry | Error monitoring and diagnostics |
| Stripe | Payments for eCourier's own services |
| Cloudflare | Public marketing website hosting and delivery |
| Google Tag Manager and Google Analytics | Tag management and usage measurement across our website, portal and documentation |
| Apollo (ZenLeads Inc.) | Website visitor identification and sales prospecting, with advertising consent |
| Google Workspace | Email support, sales correspondence and internal business communications |
| Greentel | Phone support (hosted PBX) |
We may also use email delivery providers for service communications.
Where necessary and lawful, we may disclose relevant registration and authorisation evidence to competent public authorities, Peppol or NemHandel authorities and network operators for verification, compliance or investigations, and to legal advisers or courts for related claims. For an authorised migration, necessary contact details, registration information and authorisation evidence may be shared with the replacement access point provider, respecting the business's instructions and applicable law. These recipients act as independent controllers to the extent they process the data for their own purposes.
Processors act on our instructions and are subject to contractual data protection obligations. Providers may also act as independent controllers for activities described in their terms, such as Stripe's fraud prevention and regulatory compliance.
Our provider overview gives identities, processing details, roles, locations, contact information and supporting documentation. Its Platform subprocessors section forms part of the DPA. Cookie choices and withdrawal are explained in our Cookie Policy.
7. International data transfers
Personal data may be processed outside the EU/EEA, including in the United States. We rely on applicable European Commission adequacy decisions, including the EU–US Data Privacy Framework for covered US transfers, or appropriate safeguards such as EU Standard Contractual Clauses (SCCs). The provider overview identifies processing locations, applicable transfer bases and supporting documentation for each provider.
8. Data retention
We retain personal data only for as long as necessary for the purposes described in this policy:
- account data: for the duration of the customer relationship
- technical and log data: retained for up to 90 days for security and operational purposes, unless longer retention is necessary for a specific security investigation or required by law
- billing data: retained as required by applicable law
- registration authority and verification records: retained while the relevant registration or services remain active. Afterwards, we retain only records needed for applicable statutory retention periods or registration-related claims within the applicable limitation periods. Records needed for an unresolved audit, investigation or claim are retained until it is resolved and any resulting retention requirement ends. Records are deleted or anonymised when no longer necessary for these purposes.
These criteria concern eCourier's own compliance records. Retention of personal data processed on behalf of customers is governed by the DPA and their lawful instructions.
9. Your rights
Under the GDPR, you have the right to:
- access your personal data
- rectification of inaccurate data
- erasure
- restriction of processing
- data portability
- object to processing based on legitimate interests
To exercise your rights, contact us at: info@ecourier.io
You also have the right to lodge a complaint with your local data protection authority.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be available on our website.