Privacy Policy

This Privacy Policy explains what personal data we collect, why we process it, how long we retain it, who we may share it with, and the rights you have under the EU General Data Protection Regulation ("GDPR") and applicable Danish data protection legislation.

1. Data Controller

The data controller responsible for the processing described in this Privacy Policy is:

For certain services, WoodStocks may instead act as a data processor on behalf of a customer. This is particularly relevant where a business customer uploads or processes personal data relating to its own employees, customers, suppliers, contractors or other persons through the WoodStocks platform.

In such cases, the relevant customer remains the data controller and WoodStocks processes the personal data in accordance with the customer's instructions and the applicable data processing agreement.

2. Personal Data We Collect

The personal data we process depends on how you interact with WoodStocks.

Account and identification information

When you create or use an account, we may process information such as name, email address, telephone number, company name, job title or professional role, account ID, login and authentication information, and account permissions and user roles. We do not store passwords in readable form.

Business and project information

When you use the WoodStocks platform, we may process information associated with projects and business activities, including project names and information, customer, partner, supplier and contractor information, project participants, notes and comments, documents, drawings, PDF files, IFC/BIM files, construction and production information, uploaded images and other project files, communication associated with projects, and user activity relating to projects.

Some uploaded documents may contain personal data. The customer uploading such information is responsible for ensuring that it has a lawful basis for making the information available through the platform.

Communications

If you contact WoodStocks, we may process name, email address, telephone number, company, the content of your message, attachments, support requests and correspondence history.

Technical and usage information

When you access WoodStocks, we may automatically process technical information such as IP address, browser type, device type, operating system, login timestamps, session information, security logs, error logs, pages and platform functions accessed, and technical identifiers. This information may be used to operate the platform, maintain security, diagnose errors and improve our services.

Billing and transaction information

Where applicable, we may process company billing information, billing address, invoice information, subscription information, transaction references and payment status. Where payments are processed by an external payment provider, payment card details may be processed directly by that provider rather than by WoodStocks.

3. Why We Process Personal Data

Providing the WoodStocks platform

We process data to create and administer user accounts, authenticate users, provide access to projects, store and display project information, process uploaded files and documents, enable collaboration between authorised users, provide platform functionality, and manage subscriptions and customer relationships.

The legal basis will normally be GDPR Article 6(1)(b), where processing is necessary to perform a contract or take steps requested before entering into a contract. Where the user is an employee or representative of our customer rather than personally being party to the contract, processing may instead be based on our legitimate interests under Article 6(1)(f).

Security and prevention of misuse

We process technical and account information to protect accounts, prevent unauthorised access, detect abuse, investigate security incidents, maintain logs, and protect WoodStocks, our customers and users. The legal basis is normally our legitimate interests under GDPR Article 6(1)(f) in operating a secure and reliable service.

Customer service

We process contact and account information to answer questions, resolve technical problems and provide customer support. The legal basis may be GDPR Article 6(1)(b) or Article 6(1)(f), depending on the circumstances.

Accounting and legal obligations

Certain information may be retained where required for accounting, tax, documentation, compliance, or the establishment, exercise or defence of legal claims. The legal basis may be GDPR Article 6(1)(c) or Article 6(1)(f).

Improving WoodStocks

We may analyse technical information, error information and platform usage to improve functionality, performance, usability and reliability. Where this involves personal data, the legal basis will normally be our legitimate interests under GDPR Article 6(1)(f).

Marketing

Where permitted by law, we may use contact information to communicate about WoodStocks products and services. Where consent is required, marketing will only be carried out after obtaining the appropriate consent. Consent may be withdrawn at any time.

4. Uploaded Project Data

WoodStocks allows customers and authorised users to upload and process project information, drawings, PDFs, IFC/BIM files and other documents. Such material may contain personal data.

Where WoodStocks processes personal data contained in customer-controlled project material solely on behalf of a customer, WoodStocks generally acts as a data processor, while the customer acts as the data controller.

Customers are responsible for ensuring that:

• they have the right to upload the information;
• they have an appropriate legal basis for processing personal data contained in the information;
• access is granted only to authorised persons; and
• unnecessary personal data is not uploaded to the platform.

Where required, the relationship between WoodStocks and the customer will be governed by a Data Processing Agreement.

5. Automated Processing and AI

Certain WoodStocks functionality may use automated systems to analyse technical project information, documents, drawings, PDFs, BIM/IFC data or other uploaded material. Such processing may include extracting, classifying, structuring, comparing or generating technical project information.

Unless expressly stated otherwise for a particular service, WoodStocks does not use automated processing to make decisions about individuals that produce legal effects or similarly significantly affect them within the meaning of GDPR Article 22.

Where third-party AI or automated processing providers are used, their processing is subject to appropriate contractual and data-protection safeguards.

6. Cookies and Similar Technologies

WoodStocks may use cookies and similar technologies for purposes such as essential website functionality, authentication, security, remembering user sessions and preferences, performance monitoring, analytics, improving the website and platform, and marketing where applicable and consented to.

Strictly necessary cookies may be used without consent where permitted by law. Non-essential cookies and similar tracking technologies will only be activated after the user has provided the required consent. Users can reject non-essential cookies as well as accept them, and can withdraw or change their consent later. Further information is available through the WoodStocks cookie settings or Cookie Policy.

7. Sharing of Personal Data

We only share personal data where necessary and where there is an appropriate legal basis.

Personal data may be disclosed to categories of recipients such as hosting and cloud infrastructure providers, database providers, authentication providers, email and communication providers, payment providers, analytics providers, IT and security providers, professional advisers, accountants and auditors, and authorities where disclosure is required by law.

Service providers processing personal data on our behalf are required to process such information in accordance with our instructions and applicable data protection requirements. We do not sell personal data.

8. International Data Transfers

Some service providers used by WoodStocks may process personal data outside Denmark or the European Economic Area ("EEA"). Where personal data is transferred outside the EEA, WoodStocks will ensure that an appropriate transfer mechanism is used where required by GDPR.

This may include:

• an adequacy decision issued by the European Commission;
• EU Standard Contractual Clauses;
• the EU-U.S. Data Privacy Framework where applicable; or
• another lawful transfer mechanism under GDPR.

Additional safeguards may be implemented where necessary. You may contact us for further information about safeguards applicable to relevant international transfers.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law. Retention periods depend on the type of information:

• Account information: generally retained while the account or relevant customer relationship remains active and for a reasonable period afterwards.
• Project information and uploaded files: generally retained for the duration of the relevant customer relationship or project and thereafter in accordance with contractual retention and deletion procedures.
• Support correspondence: retained for as long as reasonably necessary to resolve the request and document the customer relationship.
• Security and technical logs: retained for a limited period appropriate to security, troubleshooting and fraud-prevention purposes.
• Accounting information: retained for the period required under applicable accounting and tax legislation.

Information may be retained for longer where necessary to establish, exercise or defend legal claims or where required by law. Backups may contain deleted information for a limited additional period.

10. Data Security

WoodStocks uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, unauthorised disclosure and misuse.

Measures may include access controls, authentication, encryption, logging, backups, monitoring and restrictions on administrative access. Access to customer information is limited to persons and service providers who require access for legitimate operational purposes. No internet-based service can guarantee absolute security, but we continuously work to maintain appropriate security.

11. Your GDPR Rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• Right of access: request confirmation of whether we process personal data about you and request a copy of that information.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: in certain circumstances, request that your personal data be deleted.
• Right to restriction: in certain circumstances, request that processing of your personal data be restricted.
• Right to data portability: where applicable, request to receive personal data you have provided in a structured, commonly used and machine-readable format.
• Right to object: where processing is based on legitimate interests, you may object based on your particular circumstances. You may object to direct marketing at any time.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
• Rights relating to automated decisions: where applicable, you have rights concerning decisions based solely on automated processing.

12. Exercising Your Rights

To exercise your data protection rights or ask questions about our processing of personal data, contact support@woodstocks.shop. We may need to verify your identity before responding. We will respond within the time limits required by applicable data protection legislation.

13. Complaints

If you are dissatisfied with how WoodStocks processes your personal data, we encourage you to contact us first so that we can investigate the matter.

You also have the right to lodge a complaint with the competent data protection supervisory authority. For WoodStocks' activities in Denmark, the supervisory authority is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark.

14. Third-Party Websites and Services

WoodStocks may contain links to third-party websites or services. WoodStocks is not responsible for the privacy practices of independent third parties acting as their own data controllers. We recommend reviewing their privacy information before providing personal data to them.

15. Children's Data

WoodStocks is a business and professional platform and is not intended for children. We do not knowingly offer the platform directly to children or intentionally collect personal data from children.

16. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect changes to the WoodStocks platform, our processing activities, service providers, technology, or legal requirements. The current version will be published on woodstocks.shop with the date of the latest update.

17. Contact

Questions regarding this Privacy Policy or WoodStocks' processing of personal data can be sent to:

Last updated: 13 August 2026