Privatlivspolitik

Ikrafttrædelsesdato: July 29, 2026

Sidst opdateret: 15 September 2026

1. Hvem vi er

1.1

Campfire Security ApS, CVR 44318563, et selskab stiftet efter dansk ret med adresse på Åbogade 15, 8200 Aarhus N, Danmark (“vi”, “os” eller “vores”), er dataansvarlig efter gældende databeskyttelsesregler, herunder databeskyttelsesforordningen (EU) (“GDPR”).

1.2Vores kontaktoplysninger:

Email: security@campfiresecurity.dk
Postal Address: Åbogade 15, 8200 Aarhus, Denmark

1.3This Privacy Policy (the “Privacy Policy”) describes how we will process your personal data when you:

Visit and use the websites campfiresecurity.dk, campfiresecurity.com, campsec.dk, campsec.com, heledanmarkhacker.dk and all subdomains thereof (collectively, the “Websites”),
Are signed up for and use our services, including our cybersecurity training platform, courses, laboratories, capture-the-flag exercises, and related educational services,
Are signed up for our newsletter, or
Interacting with us.

2. Definitioner

Where this Privacy Policy uses the terms defined in the GDPR, those terms shall have the same meaning as in the GDPR.

3. Formålet med denne privatlivspolitik

3.1

The purpose of this Privacy Policy is to inform you how we handle your personal data in a lawful, fair and transparent manner in accordance with the General Data Protection Regulation (GDPR). The Privacy Policy outlines the types of personal data we collect, how it is used, the lawful basis for processing it and your rights as a data subject.

3.2

This Privacy Policy aims to fulfill our obligation under Articles 12-14 GDPR to provide clear, concise and transparent information about our data processing activities.

4. De data vi indsamler

4.1

We collect and process the following categories of personal data in accordance with the principle of data minimization:

4.2Datakategorier:

Datakategori	Konkrete dataelementer
A. Identity & Account Data	Full name, username, email address, account credentials, user identification numbers
B. Contact Information	Email address, postal address, telephone number, communication preferences
C. Profile & Social Data	Profile information, social media links, professional details, company affiliation
D. Learning & Progress Data	Course completion status, learning progress metrics, assessment scores, certificates awarded, experience points
E. Seat/License/Team Data	License assignments, team memberships, organizational hierarchies, seat allocations
F. Payment & Billing Data	Billing address, payment method tokens, transaction history, invoice records
G. Technical & Usage Data	Including but not limited to IP addresses, browser information, device identifiers, log files, behavioral data and usage patterns, data on interaction (clicks etc.) with email and services, session data, timestamps, approximate location,
H. Security Tokens	Authentication tokens, session identifiers, security credentials, multi-factor authentication data
I. Customer services data	Information provided when you contact us
J. Customer survey data	Information provided when responding to customer surveys, filing reviews or otherwise providing feedback on the services
K. AI Interaction Data	Chat messages, prompts, session logs
L. Cyber Self-Assessment Data	Answers submitted to assessment questions, identified focus areas, marketing consent status, consent-text version, and relevant timestamps.

4.3

Payment card details are processed exclusively by our third-party payment processor and are not stored on our systems, except where explicitly provided to us during direct communications.

4.4AI Mentor-prompts og personoplysninger

Users should not include personal data in prompts submitted to the AI Mentor unless strictly necessary for the relevant learning context. This includes names, social security numbers, health data, credentials, account information, and other personally identifiable information. Data submitted to the AI Mentor is processed by Microsoft through Azure AI Foundry to generate responses and support abuse monitoring and platform safety. Such data may be retained for up to 30 days in accordance with Microsoft’s platform policies and is encrypted at rest. We only transmit the user’s prompt and limited contextual information necessary to support the AI Mentor.

4.4.1 Automatic redaction of personal data is not currently applied, as some course exercises may contain fictional personal data as part of the learning scenario, and redaction would materially reduce the functionality and service quality of the AI Mentor.

5. Hvordan vi bruger dine data

5.1

We process your personal data for the purposes and under the lawful bases specified in Section 6, which include:

5.1.1 Service Provision and Account Management (SAM)
5.1.2 Business Operations (BO)
5.1.3 Statistik and Improvement (AI)
5.1.4 Legal Compliance (LC)

6. Hvorfor vi behandler dine data (retsgrundlag og formål)

6.1We process your personal data based on the following lawful bases under Article 6 of the GDPR:

Behandlingsformål	Datakategorier (afsnit 4.2)	Retsgrundlag (artikel 6 GDPR)	Vurdering af legitim interesse	Formålskategori (afsnit 5.1)
Create and maintain user accounts	A, B, H	(b) Contract performance	N/A	SAM
Authenticate users and secure platform	A, H, G	(b) Contract performance; (f) Legitimate interests	Necessary for security; expected by users; minimal privacy intrusion	SAM
Deliver training services	A, D, E, G	(b) Contract performance	N/A	SAM
Track learning progress and award credentials	A, D	(b) Contract performance	N/A	SAM
Report learning progress to employers	A (identifier only), D, E	(f) Legitimate interests	Necessary for employers to assess usage of the services, if usage is mandated by a contract with the employer	BO
Manage licenses, billing, and invoicing	A, E, F	(b) Contract performance; (c) Legal obligation	N/A	BO
Send mandatory service communications	A, B	(b) Contract performance	N/A	BO
Send voluntary service communications	A, B, D	(f) Legitimate interests	Increases your value of the services; no marketing; opt-out offered	BO
Send personalized marketing communications	A, B, C, D, G, L	(a) Consent;	N/A	BO
Provide user support and troubleshooting	A, B, G, D, I	(b) Contract performance; (f) Legitimate interests	Necessary for issue resolution; restricted staff access	BO
Conduct platform analytics and improvement	G (aggregated), D	(f) Legitimate interests	Data aggregated/pseudonymized; no direct marketing; user expectation of service improvement	AI
Ensure security and prevent fraud	G, H	(f) Legitimate interests	Essential for safety; minimal, justified privacy impact.	AI
Comply with legal obligations	A, F, B (minimal)	(c) Legal obligation	N/A	LC
Provide contextual learner support through the AI Mentor	K, and limited relevant contextual learning data	(f) Legitimate interests	Necessary to help users progress in assigned course material and receive contextual support within the learning service.	SAM
Detect misuse, harmful prompts, and improve AI safety controls	K, G	(f) Legitimate interests	Necessary to protect platform security, prevent abuse, and maintain safe and reliable AI responses.	AI
Deliver cyber self-assessment and provide results	A, L	(b) Contract performance	N/A	SAM
Evidence and administer marketing consent	L (consent status, version, timestamp only)	(c) Legal obligation	N/A	LC

6.2AI Mentor: omfang af behandlingen

When you use the AI Mentor, we process your prompts and limited relevant contextual data in order to provide contextual learner support within the learning service. We do not use user prompts or responses to train or fine-tune the underlying AI model unless a separate and explicit legal basis has been established for that purpose. At present, quality improvement is limited to controlled refinement of system prompts, response constraints, and safety mechanisms.

6.2.1 We have a legitimate interest in processing limited AI Mentor data in order to detect abuse, investigate malicious or harmful prompts, maintain platform safety, and improve the quality of the AI Mentor through controlled refinement of system prompts, response constraints, and safety mechanisms. Such processing is limited to what is necessary for these purposes and does not include training or fine-tuning the underlying AI model unless a separate and explicit legal basis has been established for that purpose.

6.3Cyber-assessment og marketingsamtykke

When you complete one of our cyber assessments, we process your name, email address, assessment responses and calculated result in order to calculate and send you the result you requested. If you separately consent to marketing, we share your name, email address, consent record and result category with Mailchimp, our email marketing processor, so we can send you relevant follow-up and marketing communications. Marketing consent is optional. It is not required to receive your assessment result, and you can withdraw it at any time using the unsubscribe link in our marketing emails or by contacting us.

7. Hvordan vi indsamler dine data

7.1Vi indsamler personoplysninger på følgende måder:

Indsamlingsmetode	Beskrivelse
Direct provision from you	When you register for an account, place orders, or voluntarily provide information
Direct provision from your employer	As part of our contract with your employer
Automated collection	Through cookies, log files, and similar technologies during website usage
Communications	When you contact us for support, feedback, or other communications
Third-party Integration	Through authorized integrations with third-party services

8. Hvordan dine data deles og overføres til tredjelande

8.1

We may share your personal data with the following categories of recipients:

8.2Databehandlere

We engage the following processors under appropriate data processing agreements and – to the extent personal data is transferred outside the European Economic Area – apply appropriate safeguards in accordance with Chapter V of the GDPR:

Databehandler	Ydelseskategori	Delte data	Placering	Overførselsgrundlag
Stripe, Inc.	Betalingsbehandling	Betalingsoplysninger, transaktionsdata, faktureringsdata	United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
Microsoft Corporation	Cloudinfrastruktur	Alle platformdata i hvile	European Union (West Europe)	N/A
Google LLC	Google Tag Manager, Google Analytics 4 og cloudtjenester	Pseudonymiserede brugsdata, cookie-identifikatorer, sidevisninger, serverlogfiler. Statistik- og marketingtags indlæses kun efter samtykke.	European Union/United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
HubSpot, Inc.	CRM, marketingautomatisering, leadhåndtering, mødebooking	E-mailadresser, navne, kontaktoplysninger, interaktionsdata, kampagnemålinger. Mødewidgetten indlæses, når du åbner “book et møde”.	United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
Meta Platforms Ireland Limited	Annoncemåling (Meta Pixel), kun efter marketingsamtykke	Pseudonymiserede browseridentifikatorer, sidevisninger, konverteringshændelser	Ireland / United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
LinkedIn Ireland Unlimited Company	Annoncemåling (LinkedIn Insight Tag), kun efter marketingsamtykke	Pseudonymiserede browseridentifikatorer, sidevisninger, konverteringshændelser	Ireland / United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
Hetzner Online GmbH	EU-cloudhosting	Sessionsdata, identifikatorer for labmiljøer	Germany (EEA)	N/A
The Rocket Science Group LLC (Mailchimp)	E-mailmarketing	E-mailadresser, navne, abonnementsdata, marketingsamtykke, resultat af cyber-assessment	United States	EU-US Data Privacy Framework (adequacy decision under Article 45(1) GDPR)
Mailgun Technologies, Inc.	Transaktionel e-mail	E-mailadresser, beskedmetadata	United States	Standard Contractual Clauses under Article 46(1) GDPR
Usercentrics A/S (Cookiebot)	Cookietilladelse	Samtykkepreferencer, anonymiserede identifikatorer	Denmark (EEA)	N/A

We conduct transfer impact assessments where required and implement supplementary measures to ensure adequate protection. Please contact us at security@campfiresecurity.dk, if you wish to obtain a copy of the standard contractual clauses.

8.3Andre modtagere

We may also share personal data with:

Employers or Organizations: Where you access our services through an organizational license, we may share learning progress data with your employer or organization, usage data and statistics
Legal Authorities: Where required by law, court order, or regulatory request
Professional Advisers: Including lawyers, auditors, and consultants under appropriate confidentiality obligations
Other users: Depending on your use of the services, your username may be visible to other users, including on leaderboards and in capture-the-flag exercises.

9. Hvordan vi opbevarer og sikrer dine data

9.1Data Storage Placering: Your personal data is primarily stored within the European Economic Area, with our primary hosting infrastructure located in Microsoft Azure's West Europe region.

9.2Security Measures: We implement appropriate technical and organizational measures pursuant to Article 32 GDPR:

Sikkerhedsområde	Foranstaltninger	Standarder
Encryption	AES-256 encryption at rest, TLS 1.2/1.3 in transit, Azure-managed encryption keys	FIPS 140-2 Level 2
Access Controls	Role-based access control (RBAC), multi-factor authentication, principle of least privilege	Internal security framework
Infrastructure Security	Distributed denial-of-service protection, intrusion detection, network segmentation	CIS18 IG1
Backup and Recovery	Bi-weekly encrypted backups, 5-year retention, tested disaster recovery procedures	Automated integrity verification
Monitoring	Continuous security monitoring, vulnerability scanning, penetration testing	Annual third-party security assessments

10. Opbevaring og sletning

10.1We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by law:

Datakategori	Opbevaringsperiode	Sletningsmetode	Begrundelse
Technical logs and session data	90 days	Automated purging	Security monitoring requirements
Active user accounts	Duration of service relationship plus 2 years	Secure deletion protocols	Service provision and support
Inactive user accounts	2 years from last login	Scheduled deletion with 30-day notice	Business continuity, potential service resumption
Billing and financial records	Current year plus 5 years	Encrypted archival, then secure deletion	Danish Bookkeeping Act compliance
Marketing communication data	Until consent withdrawal or 12 months with no marketing communication or 3 years of user inactivity. We may, however, retain documentation for your consent for a period of up to 5 years following withdrawal or expiry of the consent. The legal basis is our legitimate interest in being able to document a prior consent	Immediate removal from active lists	Marketing law compliance
AI Mentor data	30 days	Automated, handled by third party processor	Abuse monitoring and controlled quality improvements

10.2Upon expiration of the retention period, personal data will be securely deleted or anonymized in accordance with industry best practices.

11. Cookies og lignende teknologier

11.1Our Websites use cookies and similar tracking technologies. The legal basis for cookie processing is set forth in our Cookie Policy, which forms part of this Privacy Policy.

11.2Cookiekategorier:

Cookietype	Formål	Retsgrundlag	Opbevaring	Brugerstyring
Strengt nødvendige	Essential website functionality, security, load balancing	Article 6(1)(f) - Legitimate interests	Session to 1 year	Kan ikke slås fra
Funktionelle / præferencer	Remember user preferences, language settings	Article 6(1)(a) - Consent	1 day to 1 year	Bruges kun med samtykke
Statistik	Website usage analysis, performance monitoring	Article 6(1)(a) - Consent	Up to 2 years	Bruges kun med samtykke
Marketing	Targeted advertising, conversion tracking	Article 6(1)(a) - Consent	3 months to 2 years	Bruges kun med samtykke

11.3Detaljeret cookieliste:

11.4Cookie Management: You may manage cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may affect website functionality. Your current consent applies to the following domains: app.campfiresecurity.dk, campfiresecurity.dk.

12. Dine rettigheder og hvordan du udøver dem

12.1Under the GDPR, you have the following rights regarding your personal data:

Rettighed	Beskrivelse	Begrænsninger	Sådan udøves retten	Svartid
Access (Article 15)	Obtain confirmation of processing and copies of your data	May be restricted for others' rights and freedoms	Email request with identity verification	1 month (extendable to 3 months for complex requests)
Rectification (Article 16)	Correct inaccurate or incomplete data	Must not adversely affect others' rights	Email request with corrected information	1 month
Erasure (Article 17)	Request deletion of your data	Limited by legal obligations and legitimate interests	Written request with specific grounds	1 month
Restriction (Article 18)	Limit processing of your data	Available in specific circumstances only	Email request with justification	1 month
Objection (Article 21)	Object to processing based on legitimate interests	Must be balanced against our legitimate interests unless related to direct marketing	Email request with specific objections	1 month
Portability (Article 20)	Receive your data in structured format	Limited to data provided by you under contract/consent	Email request specifying data scope	1 month
Withdraw Consent	Withdraw consent where processing is consent-based	Does not affect lawfulness of prior processing	Email request or unsubscribe mechanisms	Promptly

12.2

To exercise these rights, contact us at security@campfiresecurity.dk with sufficient information to verify your identity and specify your request.

12.3We may request additional information to verify your identity and will respond within the timeframes specified by law.

13. Brug af AI Mentor

13.1

This section provides additional information on the practical use and limitations of the AI Mentor.

13.2

When you use the AI Mentor, you are interacting with an AI-based support tool powered by AI-models deployed through Microsoft Azure AI Foundry. The AI Mentor is designed to provide contextual learner support within Campfire’s training services by helping you progress in assigned course material when you are unable to proceed on your own. In order to generate responses, the AI Mentor processes your prompt together with limited relevant contextual information, which may include information about the current course step, challenge data and relevant lab context.

13.3

The AI Mentor is intended as a learning support tool only. It is not designed to provide full solutions, perform assessment or grading, detect cheating or provide cybersecurity guidance to be used in real-world situations. The AI Mentor may produce incorrect, incomplete, or misleading responses. You should not rely on the AI Mentor as a sole source of truth and should use own judgment when applying its guidance.

Campfire will restrict and/or disable access to the AI Mentor in cases of suspected misuse, abuse, or other use contrary to the intended purpose of the service. If you experience any issues or have concerns regarding the responses provided, you may contact Campfire Security support at the following contact point: support@campfiresecurity.dk.

13.4

You may not provide personal data when interacting with the AI Mentor, unless the information is regarding fictional individuals or companies within the current course material. This includes, but is not limited to, names, social security numbers, health data, credentials, account information, and other personally identifiable information.

Further information on how personal data is processed in connection with the AI Mentor is provided in Sections 4.4 and 6.

13.5

The AI Mentor is provided to support users in progressing through course steps by offering guidance based on user-submitted prompts. Users are encouraged to provide clear and relevant context, including prior attempts and encountered issues, to improve response quality.

Users should, where possible, attempt to solve course steps independently before using the AI Mentor.

14. Børns privatliv

14.1Our Services are intended for individuals aged 15 years and older. Campfire Security does not, to the extent of our capability, process personal data about children under 15 years of age.

14.2If we become aware that we have collected personal data from a child under 15, we will take steps to delete such information promptly.

14.3

Parents or guardians who believe we may have collected information from a child under 15 should contact us immediately at security@campfiresecurity.dk.

15. Automatiske afgørelser

15.1We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

15.2Any automated processing we conduct is limited to technical operations necessary for service provision and does not result in decisions that significantly affect your legal rights or interests.

16. Anmeldelse af brud på persondatasikkerheden

16.1In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

16.2En sådan underretning vil indeholde:

The nature of the breach and categories of data affected
The likely consequences of the breach
Measures taken or proposed to address the breach
Contact information for further inquiries

17. Ændringer i denne privatlivspolitik

17.1We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

17.2Væsentlige ændringer meddeles ved:

Email notification to registered users
Updated effective date at the top of this Privacy Policy

17.3Your continued use of our services after the effective date constitutes acceptance of the revised Privacy Policy.

18. Eksterne websites og links

18.1Our Websites may contain links to third-party websites that are not operated by us. This Policy does not apply to such external websites.

18.2We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any external websites you visit.

19. Kontakt og klager

19.1Kontakt til dataansvarlig:

Email: security@campfiresecurity.dk
Postal Address: Åbogade 15, 8200 Aarhus, Denmark

19.2Supervisory Authority: You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at

datatilsynet.dk if you believe we have not handled your personal data in accordance with applicable law.

19.3Svartids: We aim to respond to all privacy-related inquiries within 72 hours and formal data subject requests within one month as required by law.

Dokumentstyring:

Version: 1.9
Ikrafttrædelsesdato: July 29, 2026
Næste gennemgang: When applicable
Godkendt af: Ledergruppen
Klassifikation: Offentlig

Denne privatlivspolitik er udarbejdet i overensstemmelse med databeskyttelsesforordningen (EU) 2016/679, databeskyttelsesloven og anden gældende privatlivslovgivning. Den danske tekst er en oversættelse til brug på sitet. Ved uoverensstemmelse gælder den engelske version, indtil en jurist har gennemgået den danske tekst.