We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).

1. Who is responsible

The data controller is OneNine Consulting Group A/S, Birkedommervej 27, Stuen, 2400 København NV, Denmark, CVR 45847373. Please send any question about privacy to hello@onenineadvisory.com.

2. What personal data we collect

• Your question to Ask, the question bar on this site. Ask is built to answer questions about OneNine, so please do not write personal or confidential information in it. See section 4.
• Contact information (name, email, phone and your message) when you write to us. This site has no contact forms: you write to us by email.
• Event registration data (full name, work email, company, job title, the time of your registration and your consent) when you sign up for one of our events.
• Business contact data in our CRM system: the data above, your participation in our events and our interactions with you, such as meetings and emails.
• Technical data: the IP address your request comes from, used for a short time to keep the site and Ask secure, and to count visits without cookies. See sections 4 and 5.

We do not ask for sensitive personal data, such as information about health or political opinions.

3. Purposes, legal basis and retention

Purpose	Legal basis	How long we keep the data
Answering your question in Ask	Legitimate interest, Art. 6(1)(f) GDPR	Questions and answers are deleted automatically after 30 days.
Answering your inquiries	Legitimate interest, Art. 6(1)(f), or steps before a contract, Art. 6(1)(b)	As long as needed to handle your inquiry. If we stay in contact, the rules for business contacts below apply.
Registering you for our events and running them	Consent, Art. 6(1)(a)	Registration data in Google Sheets is deleted no later than 6 months after the event, once it has been transferred to Salesforce.
Keeping you as a business contact in our CRM system (Salesforce)	Legitimate interest, Art. 6(1)(f)	As long as we have a business relationship with you. We review our contacts regularly and delete contacts we have had no interaction with for 3 years.
Inviting you to future events by email	Consent, Art. 6(1)(a), and § 10 of the Danish Marketing Practices Act (markedsføringsloven)	Until you withdraw your consent. After that we keep only what we need to respect your choice.
Running and securing our website, including fair use of Ask	Legitimate interest, Art. 6(1)(f)	IP addresses are held in memory to count questions per visitor and are gone within a day. A visitor blocked for misuse is blocked for 24 hours.
Counting visits to improve the website	Legitimate interest, Art. 6(1)(f)	Only totals per day are kept, see section 5. Nothing that identifies a visitor is stored.
Complying with legal obligations	Legal obligation, Art. 6(1)(c)	As long as the law requires.

Our legitimate interests are to answer the questions people ask us, to build and maintain business relationships with the companies and people we meet, and to keep our website secure and fair to use. You can object at any time, see section 10.

4. Ask, the question bar

When you type a question in Ask, or an AI agent asks through our MCP server or our brief service, this happens:

• What is sent. Your question goes to our own server in the EU. From there, the question and the public content of this website are sent to a Mistral language model, run by Mistral AI, which writes the answer. We do not send your IP address, your name or anything else about you to Mistral AI. Only the words you typed.
• Where. Mistral AI is a French company. We use its EU service, which processes the question in data centres in the EU and EFTA countries. We have switched off the setting that would let Mistral AI use our questions to train its models.
• What we keep. Our server keeps the question and the answer for 30 days, so we can find faults and improve the answers. After 30 days they are deleted automatically, from the database and from the logs. We do not link questions to who asked them.
• Fair use. To stop misuse, our server counts questions per IP address: 20 per ten minutes and 100 per day. An address that keeps hitting the limit is blocked for 24 hours. Logs record which page was asked for and when, never the address itself.
• No decisions about you. Ask only answers questions about OneNine. It does not make decisions about you, and we do not use your questions for profiling or marketing.

Some questions, such as “What areas do you cover?”, are answered directly from our own pages and are not sent to Mistral AI.

5. How we count visits

We count visits on our own server, without cookies and without anything running in your browser. For each page we count how many people looked at it, which site linked to it, the language your browser asks for, and whether you use a phone or a computer. We also count questions to Ask, calls to our MCP server, and visits from search engines and AI agents.

To count a visitor once a day, our server makes a code from your IP address, your browser and a random value that changes every midnight. The code is kept only in the server’s memory, never written down, and is gone at the end of the day, so we cannot follow you from one day to the next. We store only the totals per day. We do not store IP addresses, and we share the totals with no one.

6. Event registrations

When you register on our event registration page, the form sends your name, work email, company and job title directly to OneNine’s Google Workspace account, where the registration is stored in a Google Sheet. We then transfer the registrations to our CRM system, Salesforce, where we manage the guest list and keep you as a business contact. Only OneNine employees who need the data for their work have access.

You need to provide your name, work email, company and job title and tick the consent box to register. Without them we cannot register you. We will only invite you to future events if you give us your separate consent, for example in your confirmation email or at the event. Your registration does not depend on it.

The registration page does not use cookies, analytics or tracking, and it does not load content from third parties. We do not use automated decision-making or profiling.

7. Who receives your data

We use the following service providers. They process personal data only on our instructions and under a data processing agreement with us:

• Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland: email, document storage, Google Sheets and the script that receives event registrations.
• Salesforce, provided by Salesforce, Inc. and its affiliates: our CRM system for business contacts, guest lists and invitations.
• Scaleway SAS, Paris, France: hosts this website and Ask on servers in the EU.
• Mistral AI SAS, Paris, France: the Mistral language model that writes Ask’s answers, see section 4.

We may also share personal data with public authorities, courts or our professional advisers (such as lawyers and auditors) when the law requires it or when it is necessary to establish, exercise or defend legal claims. We do not sell your data, and we do not share it with third parties for their own marketing purposes.

8. Transfers outside the EU/EEA

Google and Salesforce are global providers. Your data may be stored or accessed in countries outside the EU/EEA, including the United States. We only allow such transfers when they are protected by at least one of these safeguards:

• the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, such as Google LLC and Salesforce, Inc.,
• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), as part of our data processing agreements with the provider,
• for Salesforce, also its Binding Corporate Rules for processors, approved by EU data protection authorities.

You can ask us for a copy of these safeguards at hello@onenineadvisory.com.

9. How we protect your data

We use technical and organisational measures that fit the risk of the processing. Access is limited to employees who need the data for their work and is protected by personal logins. Our providers encrypt data in transit and at rest. Questions to Ask are deleted after 30 days.

10. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a copy (Art. 15).
• Have incorrect data corrected (Art. 16).
• Have your data deleted (Art. 17).
• Restrict our processing (Art. 18).
• Receive your data in a portable format (Art. 20).
• Withdraw your consent at any time (Art. 7(3)). This does not affect processing that took place before you withdrew it.

Your right to object (Art. 21 GDPR). You can object at any time to processing based on our legitimate interest, for example being kept as a business contact in our CRM system. We will then stop, unless we have compelling legitimate grounds or need the data for legal claims. You can always object to direct marketing, and we will then stop it at once.

To use your rights, email us at hello@onenineadvisory.com. It is free of charge. We answer within one month and may ask you to confirm your identity first. Because we do not link Ask questions to who asked them, we can only find a question if you tell us roughly what you wrote and when.

11. Complaints

If you are unhappy with how we handle your personal data, please contact us first, so we can try to solve it. You can also complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby, dt@datatilsynet.dk, +45 33 19 32 00, www.datatilsynet.dk.

12. Cookies

This website sets no cookies for visitors and does no tracking. We count visits on our own server without cookies, see section 5 and our cookie policy.

13. Changes

We may update this policy from time to time. The latest version is always on this page, and the date shows when it was last changed.