Privacy Policy
1Who we are
BankConnector ApS, Denmark. Contact: privacy@bankconnector.com.
2What we process, why, and on what legal basis
| Context | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account users | Name, work email, role, password hash, optional TOTP enrolment, session data | Providing login and the service; account security | Art. 6(1)(b) contract; Art. 6(1)(f) security |
| Activity and audit logs | User id, actions taken, timestamps | Tamper-evident audit trail; documenting payment instructions and approvals; establishing, exercising or defending legal claims; security; abuse prevention | Art. 6(1)(f); Art. 6(1)(c) where record-keeping is required |
| Usage events | Coarse product actions (e.g. "payment sent") and tenant/user ids, never payment content | Service operation and improvement | Art. 6(1)(f) |
| Fault diagnostics | Error message, stack trace, the screen in view, browser user-agent, and any personal data the error incidentally quotes; tenant and user ids | Diagnosing and fixing faults in the web portal | Processed as processor on the customer's behalf; governed by the Data Processing Agreement |
| Sandbox users | IP address, request logs, temporary sandbox provisioning and rate-limit data; never real payment content | Providing the no-signup test sandbox; rate-limiting; security and abuse prevention | Art. 6(1)(f) |
| Website analytics | Aggregated, cookieless, non-identifying traffic analytics | Understanding and improving the website | Art. 6(1)(f) |
| Session recording | Website sessions recorded via session-replay technology, with typed input masked | Understanding and improving the website | Art. 6(1)(a) consent |
| Support and contact | Correspondence, contact details | Answering enquiries, providing support | Art. 6(1)(b)/(f) |
| Prospects and customers | Business contact details, our correspondence and contact history | Following up on your interest; managing the customer relationship | Art. 6(1)(f) |
| Newsletters and product news | Name, work email, whether emails are opened | Sending news about BankConnector | Art. 6(1)(a) consent. Customers may receive news about our own similar services without consent, as the Danish Marketing Practices Act ยง10(2) allows (Art. 6(1)(f)). Every email lets you unsubscribe. Service messages about your account are not marketing. |
| Invoicing and payment | Billing contact, subscription, invoice and payment records (card payments are handled by our payment provider; we do not store full card numbers) | Billing; bookkeeping | Art. 6(1)(b); Art. 6(1)(c) (Danish Bookkeeping Act) |
We do not use your data for automated decision-making with legal effect, and we do not sell personal data.
3The developer sandbox
We offer a public sandbox at sandbox.bankconnector.com that anyone can use without an account, so developers can try the API against a simulated bank. As described in the table above, we process a limited amount of data about your use of it (your IP address, request logs, and the technical data needed to provision a temporary test environment) on the basis of our legitimate interest in operating and securing the service (Art. 6(1)(f)). Sandbox environments and their data are temporary and are removed automatically after a period of inactivity.
The sandbox provisions a simulated bank and processes no real payments. It is not intended for real personal or payment data. Please use only the example and test values provided, and do not submit real names, account numbers, or other personal data belonging to you or anyone else. If you enter such data despite this notice, you are responsible for ensuring you have a lawful basis to do so; we process it only transiently to run the test, and it is removed with the sandbox.
4Cookies, analytics and session recording
We use strictly necessary cookies for login sessions and security (for example session and CSRF cookies); these do not require consent. A cookie remembers the language you choose.
Our hosting platform provides aggregated, cookieless analytics (which pages are read, and roughly where visits come from); it does not identify you or store anything on your device. With your consent to statistics, website analytics and session recording providers record how our website is used, including which companies visit it, and record website sessions so we can find interface problems. Typed input is masked in these recordings. If you then contact us through a form, we link your message to that use and keep the link for as long as your company is a contact or customer of ours. With separate advertising consent, we also use advertising platforms' measurement tags for ad measurement and ad optimization. The advertising platforms receive page and referrer information, browser and device information, timestamps, advertising click and browser identifiers, and supported contact information detected on this website, normalized and hashed in your browser for automatic advanced matching. Hashing does not make personal data anonymous. We do not intentionally send payment files, bank statements, or bank-account data to these platforms.
Session recording starts only if you accept it in the consent notice. You can change your choice at any time through the "Cookie settings" link at the bottom of every page of the website; declining stops further recording on your device. You can also write to privacy@bankconnector.com.
Advertising measurement starts only after explicit advertising acceptance in every region because automatic advanced matching is enabled. Existing analytics acceptance does not authorize advertising. Rejecting advertising or a browser Global Privacy Control signal blocks it. You can withdraw through Cookie settings at the bottom of any website page; withdrawal stops future measurement and does not undo processing already completed. Analytics and advertising can be selected separately. We store a visitor reference, each choice, timestamp, and the notice version and wording in your browser, preserving earlier acceptance when you withdraw. The advertising platforms use first-party advertising identifiers and consent storage, listed below. Clearing browser storage removes the local consent history.
The cookies and browser storage used with your consent, and who places them:
| Choice | Placed by | Cookies and storage (lifetime) |
|---|---|---|
| Statistics | HubSpot | __hstc and hubspotutk (6 months), __hssc (30 minutes), __hssrc (until you close the browser) |
| Statistics | _ga and _ga_LWZJQVRFEJ (2 years) | |
| Statistics | Microsoft | _clck (1 year), _clsk (1 day), _cltk in session storage (until you close the tab); on clarity.ms: CLID (1 year) |
| Advertising | _gcl_au (90 days); after a click on one of our ads, _gcl_aw, _gcl_gb, _gcl_gs or _gcl_ag (90 days) and _gcl_ls in browser storage; on Google's own domains: IDE (13 months), GCL_AU_P and GCL_AW_P (90 days), ar_debug (90 days), test_cookie (15 minutes) | |
| Advertising | li_fat_id (30 days) and li_giant (7 days), only after a click on one of our ads; li_adsId in browser storage; on linkedin.com: bcookie (1 year), li_sugr (90 days), UserMatchHistory, AnalyticsSyncHistory, lms_ads and lms_analytics (30 days), lidc (24 hours) | |
| Advertising | OpenAI | __obref (1 year), __oppref (30 days, only after a click on one of our ads), __oaiq_consent (30 days) |
5Recipients and transfers
We share personal data with service providers that help us run BankConnector, within these categories: hosting and infrastructure; email delivery; error monitoring; payment processing; customer-relationship management; website analytics and session recording; and advertising platforms for consented advertising measurement, matching and optimization. We also share it with professional advisors under confidentiality, and with authorities where required by law. Customer workspace data is stored in the EU/EEA. Some of our providers may process personal data outside the EEA; where they do, the transfer is protected by a Chapter V GDPR mechanism, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
6Retention
- Account data: for the life of the account, then deleted or anonymised per the wind-down and retention schedule in the Service Description.
- Audit records: 5 years from creation, also after the account has ended.
- Usage events: 365 days.
- Browser error reports: 30 days.
- Sandbox data: removed automatically after 30 days of inactivity.
- Website analytics and session recordings: up to 14 months, then deleted. Website use linked to a form message: see section 4.
- Support correspondence: up to 2 years after the case is closed.
- Invoicing records: 5 years (Danish Bookkeeping Act).
7Your rights
You have the right to access, rectify, erase, restrict, and receive a copy of your personal data, and to object to processing based on legitimate interest. Write to privacy@bankconnector.com. Where we act as processor for a customer's workspace, we will refer your request to the controller and assist them in answering it. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk).
8Changes
We update this policy as the service evolves; material changes are announced on the website and, for account holders, in the product. Superseded versions remain available at bankconnector.com/legal.