Privacy Policy

Last updated 02-10-2026

This policy explains how we handle personal data when you visit our website, create or use an account, contact us or use our budgeting service. It also explains our role when a business customer uploads or connects accounting data.

1 Who we are

ESIO ApS, CVR 45129756, Snedronningen 32, 5240 Odense NØ, Denmark, operates ESIO Budgeting Software at esio.dk/budget.esio.dk. In this policy, “we”, “us” and “our” refer to that company.

For questions or requests concerning personal data, contact privacy@esio.dk.

2 Our role and your organisation’s role

We act as data controller when we decide why and how personal data is used to manage our business relationships, administer subscriptions and billing, respond to enquiries and protect our website and service.

When a customer imports accounting records, creates budgets or stores other personal data in its workspace, we generally process that information on the customer’s instructions under our Data Processing Agreement. The customer is normally the controller. If it acts for another organisation, it may itself be a processor and we may be a subprocessor.

The customer’s privacy notice explains its reasons and legal grounds for processing information about its employees, customers, suppliers and other individuals. This policy does not replace that notice or authorise additional uses of customer workspace data.

3 Information we collect and its sources

Account and business contact information: names, work email addresses, organisation details, account identifiers, access roles and authentication information. We receive these from you or from an administrator who invites you to a workspace.

Subscription and billing information: subscription plan, billing contact and address, CVR information, invoices and payment status.

Correspondence: information you provide in enquiries, support requests and feedback, including attachments. Please avoid sending personal data that is unnecessary for resolving your enquiry.

Technical information: IP address, browser and device information, login events, timestamps, error logs and service activity. Cookie and similar technology use is described in section 8.

4 Why we use information and our legal grounds

Accounts subscriptions and support

We use account, contact and subscription information to provide access, manage the subscription, communicate service changes and respond to support requests. Where you personally enter a contract with us, necessary processing is based on GDPR Article 6(1)(b). Where you act for an organisation, we rely on Article 6(1)(f): our legitimate interests in managing the business relationship and providing the service to authorised users.

Billing and legal obligations

We use billing records to invoice and administer payments on the same contract or legitimate-interest basis, as applicable. Where records must be kept to meet applicable Danish bookkeeping or tax requirements, we rely on Article 6(1)(c).

Security and legal claims

We use relevant account, technical and correspondence data to investigate faults, prevent misuse and protect accounts and systems. We rely on Article 6(1)(f): our legitimate interests in operating a reliable, secure service. Where necessary, we also retain relevant evidence to establish, exercise or defend legal claims on that basis. We assess these interests against the impact on individuals.

Optional analytics and marketing

We use optional analytics or marketing tracking only with your consent under Article 6(1)(a), where required. If you subscribe to our newsletter, or tell us that you would like to receive news and offers from us by email, we use your email address with your consent. You give or withdraw the consent to news and offers when you sign up and at any time afterwards under Profile in the app, and you can unsubscribe through each email. We record your choice and when you made it for as long as your account exists. You change tracking consent through our cookie settings. Essential service messages are separate from marketing.

Feedback about the product

If you tell us that you would like to be contacted for your opinion of the product, we use your email address to write to you and ask about your experience with it. This is based on your consent under Article 6(1)(a). It is optional, it is separate from marketing emails, and the service works the same without it. You give or withdraw this consent when you sign up and at any time afterwards under Profile in the app. We record your choice and when you made it for as long as your account exists.

Required information

Information needed to establish an account, authenticate users and administer the subscription is necessary to provide the relevant service. If it is not provided, we may be unable to create the account, provide access or process the subscription. Optional fields and consents are identified separately; declining them does not prevent use of the core service.

5 Accounting integrations and workspace data

When an authorised user connects ESIO to an accounting software (such as Dinero or e-conomic), the service receives the information permitted by that connection, such as accounting entries, transaction descriptions, balances and customer or supplier information, to provide budgets, calculations and reports.

We receive this information from the customer, its authorised users and the connected accounting provider. It may identify people who do not have an account with us. We process it on the customer’s instructions, including for relevant support and recovery, as set out in the DPA.

Disconnecting an integration does not by itself delete information already imported. Requests to delete workspace information are handled under the customer’s instructions and the DPA.

6 How long we keep information

We retain personal data for the purposes described in this policy and delete or irreversibly anonymise it when it is no longer needed, subject to applicable legal retention requirements. Different records have different retention periods. For further information about deletion, please feel free to contact us.

Customer workspace data

Following termination, customer workspace data remains available for a 90-day access period unless the customer instructs us to delete it earlier. We delete or irreversibly anonymise the data in active systems, including historical records and previous versions, within 30 calendar days after that access period expires, or within 30 calendar days after receiving an earlier deletion instruction, unless applicable law requires retention.

Backups are retained for up to 30 days. Where individual deletion from backups is technically possible, we delete the relevant information. Otherwise, remaining copies are isolated from ordinary use and expire within 30 calendar days after deletion from active systems. If a backup is restored, previously deleted information is deleted again before ordinary processing resumes.

This means remaining backup copies may persist for up to 150 days after termination, or up to 60 days after an earlier deletion instruction. This workspace schedule does not determine the retention of our separate billing and legal records described above.

7 Who receives information and where it is processed

Personal data is accessible to authorised personnel and service providers to the extent needed for their work. Providers processing information on our behalf are subject to data protection terms. Customer workspace subprocessors are governed by the DPA and listed in the same document.

Where necessary, we may disclose relevant information to professional advisers for advice or legal claims and to competent authorities where disclosure is legally required. Workspace information may also be accessible to users authorised by the customer within that workspace.

You can contact us at the privacy email above for information about applicable transfer safeguards and to obtain a copy, subject to necessary redactions to protect confidential information and others’ rights.

8 Cookies and similar technologies

We use cookies and similar technologies in our application and on our public website.

Our application uses necessary authentication and session cookies to keep you signed in and associate requests with your account.

Our public website also uses optional analytics technologies to help us understand how visitors use the website and improve its usability. We use these technologies only with your consent. Where they involve personal data, we rely on consent under GDPR Article 6(1)(a).

Our separate Cookie Policy at at https://esio.dk/legal/cookies identifies the technologies and providers used, explains their purposes and retention periods, and describes how you can accept, reject or withdraw consent.

9 Your rights and how to contact us

Depending on the circumstances, you may request access, correction, erasure or restriction of your personal data. Where processing is automated and based on consent or a contract with you, you may request portability of information you provided. You may object to processing based on legitimate interests for reasons relating to your situation, and you may object to direct marketing at any time.

You may withdraw consent at any time without affecting the lawfulness of earlier processing. You withdraw the consent to be contacted for feedback and the consent to news and offers under Profile in the app, a newsletter subscription through the link in each email, and tracking consent through our cookie settings; you can also write to privacy@esio.dk. Contact privacy@esio.dk to exercise your rights. We may request information needed to verify your identity. We normally respond within one month; if a permitted extension is necessary, we explain it within that month.

For information processed for a customer, contact that organisation first. If you contact us, we will assist it in handling your request. You may complain to Datatilsynet, Denmark’s supervisory authority, at www.datatilsynet.dk, or to another competent EU/EEA supervisory authority.

10 Changes to this policy

We update this policy when our practices change. The date above identifies the current version. We will provide appropriate notice of material changes and obtain fresh consent where required. This policy describes processing; accepting our terms does not constitute blanket consent to it.