Privacy Policy — polads.eu

Introduction

This privacy policy explains how Polads.eu processes your personal data.

Polads.eu, which is a brand under Step A/S, is a platform developed to enable, for example, advertisers of political advertisements and publishers of political advertisements to comply with their legal obligations when carrying out political advertising.

Data controller

The legal entity responsible for the processing of your personal data is:

STEP A/S
CVR no. 25 50 62 27
Banegårdspladsen 1
5000 Odense C
Email: compliance@polads.eu

Our processing of personal data

Individual users of our platform

Customer administration

• Purpose: When you create a user account on polads.eu, we process your personal data to administer your profile.
• Categories of personal data: General personal data — contact information, such as name, email, telephone and address.
• Sources: Directly from you.
• Legal basis: GDPR Article 6(1)(f), where our legitimate interest is to administer your user profile.
• Recipients: We share your personal data with our suppliers, including IT and support providers with whom we cooperate and who assist us. Data is shared in particular with the platform provider and, where relevant, its sub-processors. Finally, we may share your personal data with public authorities to whom we are legally required to report certain information.
• Retention: We retain your personal data for as long as you have an active user profile. Inactive user profiles are generally deleted after five years.

Support and customer service

• Purpose: In order to service our customers, we process personal data about you when you contact us via our contact form.
• Categories of personal data: General personal data — contact information, such as name, email, description of the enquiry.
• Sources: Directly from you.
• Legal basis: GDPR Article 6(1)(f), where our legitimate interest is to handle and respond to your enquiry.
• Recipients: See the above.
• Retention: Enquiries to customer service or support are retained for one year after the case is closed, after which they are automatically deleted. This is done in order to document that the enquiry has been received and handled.

Notifications about political advertisements

• Purpose: When you tell us that a political advertisement may not meet the requirements of Regulation (EU) 2024/900, we process your personal data to register your notification, pass it to the publisher responsible for the advertisement, and record how it was handled.
• Categories of personal data: General personal data. Your name and email address, a telephone number if you provide one, the description you write, and any screenshot you attach.
• Sources: Directly from you.
• Legal basis: GDPR Article 6(1)(f), where our legitimate interest is to operate the notification mechanism that Article 15 of Regulation (EU) 2024/900 requires publishers of political advertising to provide, and to enable the responsible publisher to examine your notification and reply to you.
• Recipients: The publisher responsible for the advertisement receives your notification so that they can assess it and answer you. Otherwise, see the above.
• Retention: Six months from the day we receive it. The personal data in a notification is erased at that point, in line with the data processing agreements we conclude with publishers. We keep the case record itself, which is the reference number, the response deadline, whether it was met, and the publisher's decision and reasoning. That record no longer identifies you.

Optimisation, adaptation and development of our services

• Purpose: We use data related to your use of our services to optimise, adapt and develop our services.
• Categories of personal data: See the sections above. To the greatest extent possible, the processing will be carried out only on the basis of aggregated data.
• Sources: Directly from you.
• Legal basis: GDPR Article 6(1)(f), where our legitimate interest is to optimise, adapt and develop our services.
• Recipients: We share your personal data with our suppliers, including IT and support providers with whom we cooperate and who assist us. Data is in particular shared with the platform provider and, where relevant, its sub-processors.
• Retention: Personal data processed for the purpose of optimising, adapting and developing our products and services will generally not be deleted, but will, to the greatest extent possible, be aggregated so that we cannot identify you on the basis of this data.

Use of chatbot

On the website, you can use our chatbot to ask questions about political advertising. If you use our chatbots, we do not process your personal data, but your interaction with our chatbot is used to improve our chatbot's responses and thereby the chat experience as well as our platform.

Testing and development

In connection with testing and development of our platform, it may be necessary to process your personal data as part of the final phase of our development. This processing is carried out solely to fulfil the original purpose of the processing, including to ensure an appropriate level of security.

Use of AI

At Step A/S, we use AI to support our business processes, including to deliver, develop and optimise the platform. For example, we use AI to support our customer service and advisory services so that your enquiries, as well as your customers' enquiries, are received and handled correctly. Our use of AI is solely to support the purposes set out in this privacy policy.

Transfers to countries outside the EU/EEA

As a general rule, personal data will only be processed within the EU/EEA. However, personal data may to a limited extent be transferred to third countries outside the EU/EEA, including, for example, the United States, in which case we will ensure that a transfer basis has been established for such transfer and that appropriate security measures have been implemented.

All transfers are subject to appropriate safeguards as described in GDPR Article 46, most often the European Commission's standard contractual clauses for the transfer of personal data to third countries outside the EU/EEA, cf. GDPR Article 46(2)(c), unless an adequacy decision applies, cf. GDPR Article 45, for example as a result of certification under the EU-US Data Privacy Framework for US companies.

Your rights

You have the following rights:

• You have the right to request access to, rectification of or deletion of your personal data.
• You also have the right to have the processing of your personal data restricted.
• If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of processing carried out before you withdrew your consent. You can withdraw your consent by contacting us, see below, or by using the unsubscribe link in the emails you receive.
• You have the right to receive the personal data that you have provided yourself in a structured, commonly used and machine-readable format (data portability).
• You may always lodge a complaint with a data protection supervisory authority, such as the Danish Data Protection Agency.

In addition, you have the right to object to our processing of your personal data in the following cases:

• If our processing of your personal data is based on GDPR Article 6(1)(f) (balancing of interests), see above under legal basis, you have the right at any time to object to such processing on grounds relating to your particular situation.
• Similarly, you have an unconditional right to object to our processing of your personal data if we process your data for direct marketing purposes.

You can exercise your rights by writing to compliance@polads.eu. The above rights may be subject to conditions or limitations depending on the specific circumstances of the processing activities.

Amendments to our privacy policy

This privacy policy replaces all previous versions. It may be necessary to update or adapt this policy from time to time, and in the event of material changes we will notify you accordingly.

Last updated: September 2026