Privacy policy

Who we are

Just Software ApS (CVR 43432117), Automatikvej 1, 3., 2860 Søborg, Denmark, is the data controller for the personal data described in this policy.

We have not appointed a data protection officer, as we are not required to. For any question about personal data or security, contact us at security@just-software.com.

What this policy covers

This policy explains how we handle personal data when we decide why and how it is processed. That happens when you visit our website, contact us, buy or administer our products, or are in contact with us as a business contact.

Personal data inside our products

When your organisation uses our products, your organisation is the data controller for the personal data held in them, including support requests its staff send us. We process that data only on your organisation's behalf, under our Data Processing Agreement. Questions about that data should go to your organisation; if we receive such a request, we forward it to them.

For each product, our Trust Center at https://just-software.com/trust describes where data is hosted, which subprocessors are used, and which optional features, such as AI, process personal data.

What we collect, why, and on which legal basis

We collect only what we need for the purposes below.

Answering your enquiries

• Data: name, business e-mail, company and the content of your message.
• Source: you, through our contact form or by e-mail.
• Legal basis: our legitimate interest in answering you (GDPR Art. 6(1)(f)), or steps you ask us to take before entering into a contract (Art. 6(1)(b)).
• Retention: 365 days from your last message.

Customer accounts, subscriptions and billing

• Data: name, role, business contact details, company, and subscription, administrator and billing records.
• Source: you or your organisation. If you subscribe through Microsoft Azure Marketplace, Microsoft passes your contact details to us.
• Legal basis: performance of our contract with your organisation (Art. 6(1)(b)). For accounting records, our legal obligation under Danish bookkeeping and tax law (Art. 6(1)(c)).
• Retention: for the duration of the customer relationship. Accounting records are kept for 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.

Records of administrative access to our management and support systems

• Data: user identity, time, actions performed and IP address.
• Source: generated when you use these systems.
• Legal basis: our legitimate interest in, and obligation to, keep our systems secure (Art. 6(1)(f) and Art. 32).
• Retention: 13 months, after which the records are deleted automatically.

Business contacts and sales

• Data: name, role, business contact details and our interactions with you.
• Source: you, your organisation, and publicly available sources.
• Legal basis: our legitimate interest in developing business relationships (Art. 6(1)(f)).
• Retention: 2 years after our last interaction with you.
• We use AI to enrich business contact records and to prioritise contacts. This is a form of profiling (see "Use of AI"). You can object to it at any time.

Website, cookies and analytics

We place cookies other than strictly necessary ones only with your consent. You can change or withdraw your consent at any time in the cookie settings on our website, and the website still works without them. Our Cookie policy explains which cookies we use, what each one stores, and for how long.

Use of AI

We use AI to help us work efficiently, for example to sort incoming e-mail and to enrich and prioritise business contacts. For this, we use an AI provider located in the EU, so the processing stays within the EU. We do not allow our AI providers to use the data to train their models.

AI output is a suggestion that a person reviews. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. If you disagree with an outcome where AI was involved, you can ask for a human review at security@just-software.com.

AI features in our products are optional and off by default. Customers who need to keep data within the EU use our EU-based AI provider. Customers who do not need to keep data within the EU can choose Anthropic (USA) instead. Details for each product are on our Trust Center.

Who receives your data

We share the personal data described in this policy only with providers that help us run our business: hosting and productivity, support ticketing, accounting, AI assistance, and website analytics. Each provider is bound by a data processing agreement.

The subprocessors that process personal data inside our products are listed for each product on our Trust Center.

• Research: we do not share your data for research.
• Marketing: we do not share your data with others for their marketing.
• Resale: we never sell or rent personal data.
• Storage outside the EU: see the next section.

Transfers outside the EU/EEA

We mainly process personal data within the EU/EEA. Where a provider processes data outside the EU/EEA, for example for website analytics, the transfer is based on an EU adequacy decision or the EU Standard Contractual Clauses.

How we protect your data

We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, multi-factor authentication, and least-privilege access.

Audit logs of access to our own infrastructure and key management systems record actions by our staff and our systems. We keep them to detect and investigate security incidents and to document our security controls in audits. They are kept for 13 months, protected against alteration, and then deleted automatically.

Your rights

You have the right to:

• get access to the personal data we hold about you
• have incorrect data corrected
• have your data deleted
• have processing restricted
• receive your data in a portable format
• object to processing based on our legitimate interest, including profiling, and to object to direct marketing at any time
• withdraw consent at any time, where we rely on consent. Withdrawal does not affect processing that took place before.

To use your rights, e-mail security@just-software.com. We may need to confirm your identity. We reply within one month. For complex requests this can be extended by up to two more months, and we will tell you if that happens and why. Using your rights is free of charge.

Questions and complaints

You can send questions or complaints about how we use personal data, or about our IT security, to security@just-software.com.

We confirm that we have received your message, look into it, and reply within one month with what we found and what we will do.

You can also complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk.

Changes to this policy

We review this policy at least once a year, and whenever our processing of personal data changes.