Last updated: 28 September 2026

This Privacy Policy explains how QFactory ApS (“QFactory”, “we”, “us” or “our”) collects, uses, stores and protects personal data in connection with our business activities, website, social media presence, recruitment and communications with customers, partners and other stakeholders.

This policy is adapted from your supplied privacy notice, with QFactory's company details and wording suitable for its website. The descriptions of recruitment, social media and data retention should be confirmed against QFactory's actual practices before publication.

1. Introduction

QFactory ApS is committed to protecting your personal data and respecting your privacy.

This Privacy Policy describes how we collect and process personal data about external individuals as part of our business operations and the activities described in Section 3.

We process personal data in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

2. Data Controller

QFactory ApS is the data controller for the processing activities described in this Privacy Policy, unless otherwise specified.

If you have any questions about how we process your personal data, please contact us using the following details:

QFactory ApS

Ole Maaløes Vej 3 2200 Copenhagen Denmark

CVR: 44133482 Email: info@qfactory.dk

3. Processing Activities

3.1 Operation of our website and social media profiles

We process personal data about visitors to our website and social media profiles to provide a relevant, secure and functional online experience and to understand how visitors interact with our content.

When you visit our social media profiles, such as LinkedIn, the platform provider may collect personal data about you. Certain information may be made available to us in the form of aggregated statistics about visitors and interactions with our content.

For certain processing activities relating to LinkedIn Page statistics, QFactory and LinkedIn may act as joint data controllers.

Further information is available in the LinkedIn Pages Joint Controller Addendum .

3.1.1 Categories of personal data

Depending on how you interact with our website and social media profiles, we may process the following categories of personal data:

• Electronic identification data, including IP addresses and other identifiers associated with your device or browser.

• Information about your device, operating system and browser.

• Preferences indicated by you, such as language or location preferences.

• Information about how you navigate our website, including pages visited and links clicked.

• Information about your interactions with our social media profiles and published content.

Some of this information may be collected through cookies and similar technologies.

For further information about our use of cookies, please refer to our Cookie Policy.

For information about LinkedIn's processing of personal data, please consult the LinkedIn Privacy Policy .

3.1.2 Legal basis for processing

We process personal data where necessary to pursue our legitimate interests under Article 6(1)(f) of the GDPR.

Our legitimate interests include maintaining a secure and functional website, improving our online content and understanding engagement with our social media profiles.

Where we use non-essential cookies or tracking technologies, we obtain your consent where required. The legal basis for the associated processing of personal data is Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time through the cookie settings available on our website.

3.1.3 Recipients of personal data

We may share personal data with third-party service providers that support the operation, hosting, maintenance and security of our website.

These providers process personal data on our behalf and in accordance with our instructions where they act as data processors.

Where applicable, we may also act as joint controllers with social media platform providers in relation to certain statistical information about visitors and interactions with our profiles.

3.1.4 Retention

The retention period for information collected through cookies depends on the specific cookie and its purpose.

Please refer to our Cookie Policy for further information about the cookies we use and their retention periods.

For information about the retention of personal data collected by LinkedIn, please consult its privacy policy.

3.2 Recruitment

When you apply for a position at QFactory, we process your personal data to evaluate your application, assess your qualifications and determine your suitability for the position.

This applies to applications submitted in response to advertised vacancies and unsolicited applications.

3.2.1 Categories of personal data

Depending on the recruitment process, we may collect and process:

• Name and contact information.

• Educational background, qualifications and diplomas.

• Current and previous employment history.

• Professional experience, competencies and certifications.

• Language skills and other relevant qualifications.

• Results from recruitment assessments or tests, where applicable.

• Information available through publicly accessible professional profiles, such as LinkedIn.

• Information obtained from references you have authorised us to contact.

• Other information you voluntarily provide in your application, CV or during interviews.

Where relevant and legally permitted, additional information may be requested for specific positions.

We generally obtain personal data directly from you or from publicly available professional sources.

3.2.2 Legal basis for processing

Our processing of personal data during recruitment may be based on:

• Consent — Article 6(1)(a) of the GDPR: Where we request your consent for specific activities, such as retaining your application for future opportunities.

• Pre-contractual measures — Article 6(1)(b): Where processing is necessary to take steps at your request before entering into an employment contract.

• Legitimate interests — Article 6(1)(f): Where processing is necessary for our legitimate interest in assessing candidates and selecting suitable employees.

Where special categories of personal data or information about criminal offences are processed, we will ensure that an additional applicable legal basis is established.

3.2.3 Recipients of personal data

Where necessary, we may share recruitment-related personal data with external recruitment consultants, professional advisers and service providers assisting us with the recruitment process.

Our IT service providers may also process and store personal data on our behalf in accordance with our instructions and applicable data protection requirements.

3.2.4 Retention

Where a recruitment process results in employment, relevant information may be transferred to the employee's personnel file and retained in accordance with our internal employee privacy procedures.

For unsuccessful candidates, we ordinarily delete recruitment information within six months after the end of the month in which the recruitment process concluded, unless we obtain consent to retain it for longer.

Unsolicited applications may be retained for up to 12 months after the end of the month in which they are received, where an appropriate legal basis exists.

We may retain information for longer where necessary to comply with legal obligations or to establish, exercise or defend legal claims.

3.3 General business administration

As part of our ordinary business operations, we process personal data about individuals who contact or interact with QFactory.

This may include customers, prospective customers, suppliers, research collaborators, business partners, advisers and other stakeholders.

We process this information to respond to enquiries, maintain professional relationships, administer contracts and carry out our business activities.

3.3.1 Categories of personal data

Depending on the nature of our relationship, we may process:

• Name.

• Email address.

• Telephone number.

• Postal address.

• Job title, employer and professional affiliation.

• Information relating to your enquiry or business relationship with QFactory.

• Correspondence and other information relevant to our interactions.

3.3.2 Legal basis for processing

The legal basis for processing depends on the purpose of our interaction.

We may rely on:

Article 6(1)(b) of the GDPR — Performance of a contract

Where processing is necessary to enter into or perform a contract with you.

Article 6(1)(f) of the GDPR — Legitimate interests

Where processing is necessary for our legitimate interests in responding to enquiries, managing professional relationships and conducting our business operations.

Article 6(1)(c) of the GDPR — Legal obligations

Where processing is necessary to comply with applicable legal requirements, including accounting and recordkeeping obligations.

3.3.3 Recipients of personal data

Depending on the nature of our interaction, we may disclose relevant personal data to third parties where necessary for legitimate business purposes or compliance with legal obligations.

These may include professional advisers, external consultants, insurance providers, public authorities and relevant business partners.

Personal data may also be processed by IT and other service providers acting on our behalf and in accordance with our instructions.

3.3.4 Retention

Where a business relationship involves financial transactions, relevant accounting records and associated personal data are generally retained for five years from the end of the financial year to which the records relate, in accordance with applicable Danish bookkeeping requirements.

For other business interactions, we ordinarily retain personal data for up to three years from the end of the year of our latest interaction, unless a shorter retention period is appropriate.

We may retain personal data for longer where required by law or where necessary to establish, exercise or defend legal claims.

4. Transfer of personal data outside the EU/EEA

In connection with our business operations, we may use external service providers that process or store personal data outside the European Union (EU) or European Economic Area (EEA).

Where personal data is transferred to countries outside the EU/EEA, we ensure that an appropriate legal transfer mechanism is in place, as required by the GDPR.

Depending on the circumstances, this may include:

• An adequacy decision issued by the European Commission confirming that the recipient country provides an adequate level of data protection.

• The European Commission's Standard Contractual Clauses, together with any necessary supplementary safeguards.

• The EU-US Data Privacy Framework, where the recipient is an eligible, certified US organisation.

• Other lawful transfer mechanisms permitted under the GDPR.

These mechanisms are described in the European Commission's guidance on international data transfers.

European Commission

+2

Where applicable, you may request further information about the safeguards used for international transfers by contacting us using the details provided in Section 2.

5. Your rights

When QFactory processes personal data about you, you have certain rights under the GDPR.

These rights include:

Right to withdraw consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

Right of access

You have the right to request confirmation of whether we process personal data about you. Where we do, you may request access to that data and information about how it is processed.

Right to rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure

Under certain circumstances, you have the right to request that we delete personal data concerning you.

Right to restriction of processing

In certain circumstances, you have the right to request that we restrict how your personal data is processed.

Right to data portability

Where the applicable legal requirements are met, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller.

Right to object

Where processing is based on our legitimate interests, you have the right to object to the processing of your personal data on grounds relating to your particular situation.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

Exercising your rights

If you wish to exercise any of these rights, please contact us at info@qfactory.dk.

Certain rights are subject to legal conditions and exceptions. We will assess your request in accordance with applicable data protection legislation.

Where necessary, we may request additional information to verify your identity or process your request.

For further information about your rights, please visit the Danish Data Protection Agency .

6. Making a complaint

If you believe that QFactory's processing of your personal data violates applicable data protection legislation, you have the right to lodge a complaint with the relevant supervisory authority.

In Denmark, the supervisory authority is:

The Danish Data Protection Agency (Datatilsynet)

Carl Jacobsens Vej 35 2500 Valby Denmark

Email: dt@datatilsynet.dk Website: www.datatilsynet.dk 

You may submit a complaint through the agency's website or by contacting it directly.

We encourage you to contact us first if you have any concerns about how we process your personal data so that we have an opportunity to address them.

7. Updating our Privacy Policy

QFactory may update this Privacy Policy from time to time to reflect changes in our business operations, personal data processing activities or applicable legal requirements.

When we make changes, we will update the date displayed at the beginning of this policy.

Where material changes affect the processing of personal data we already hold, we will provide additional notice where required by applicable law.