Legal

Privacy Policy

Last updated: May 2026

1. Who we are

Assembley is a governance and voting platform operated by Julius Specht. We are committed to protecting your personal data in accordance with GDPR and the Danish Data Protection Act (Databeskyttelsesloven). Contact: privacy@assembley.dk

2. Data we collect

Account data

Name, email address, password (hashed), organisation name and CVR number.

Shareholder/member data

Full name, email address, share count or voting weight, provided by the organisation administrator.

Voting data

Vote allocations per agenda item, timestamps. Votes are cryptographically decoupled from identity where anonymous voting is enabled.

Usage data

IP address, browser type, pages visited, timestamps. Used for security and audit purposes.

3. Legal basis for processing

  • Contract (Art. 6(1)(b)): Processing necessary to provide the Assembley service.
  • Legal obligation (Art. 6(1)(c)): Compliance with Danish company law and association regulations.
  • Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, audit logging.
  • Consent (Art. 6(1)(a)): Where you have explicitly consented, such as at account creation.

4. Data storage and security

All data is stored on servers in Frankfurt, Germany (EU) via Supabase. Security measures include encryption at rest and in transit, row-level security, audit logging, and access controls.

5. Data retention

Account dataUntil account deletion
Assembly and voting records5 years (legal requirement)
Audit logs3 years
Email logs90 days

6. Your rights

  • Right of access (Art. 15): Request a copy of your personal data.
  • Right to rectification (Art. 16): Correct inaccurate data.
  • Right to erasure (Art. 17): Request deletion of your data, subject to legal retention requirements.
  • Right to portability (Art. 20): Receive your data in a machine-readable format.
  • Right to object (Art. 21): Object to processing based on legitimate interests.

To exercise these rights: privacy@assembley.dk. We respond within 30 days.

7. Third party processors

Supabase

Database and authentication. EU region (Frankfurt).

Vercel

Hosting and deployment.

Resend

Email delivery for voting invitations.

8. Complaints

You may lodge a complaint with Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby. www.datatilsynet.dk