Privacy policy
This page describes what personal data Esbensen Engineering collects, why, how long it is kept, and what rights you have. It applies to eeng.dk.
Data controller
Esbensen Engineering, Jesper Højmark Esbensen, Parkgade 89, 6400 Sønderborg, Denmark. Company reg. 25 54 75 27. Write to jesper.esbensen@eeng.dk or call +45 21 68 37 91.
What I collect, and why
| Situation | Data | Purpose | Legal basis | Kept |
|---|---|---|---|---|
| You register interest in a course | Name, email, language, timestamp | To let you know when a new course date is scheduled | Your consent (Art. 6(1)(a)) | 12 months, then deleted automatically |
| You book a place on a course | Name, email, company if given, whether you buy as a business or privately, language, for private buyers your consent to the course taking place within the withdrawal period, payment status, amount and any refund. Name and email are required to book | To run the course and account for the payment | Our contract (Art. 6(1)(b)) and accounting law (Art. 6(1)(c)) | 5 years after the end of the financial year, as required by law |
| You pay for a course – an account for the course material is then created | Name and email. You log in with a link sent to your email, so there is no password | To give you access to the material from your course | Our contract (Art. 6(1)(b)) | For as long as you have a paid booking. If you cancel, the course is cancelled, or the booking is deleted after the accounting-law period, the account is deleted automatically |
| You request a login link | Email, time and a one-way encrypted (hashed) version of your IP address | To send the link and limit how many links can be requested, so the form cannot be misused | My legitimate interest in a secure login (Art. 6(1)(f)) | One day, then deleted automatically |
| You write to me | Whatever you write in the email | To reply to you | My legitimate interest in replying (Art. 6(1)(f)) | As long as the correspondence matters, at most 3 years |
Who else receives the data
I never sell or rent data. The site loads nothing from other servers unless you have accepted cookies from Google Ads and LinkedIn — fonts and images are hosted here. To make the site work, data is processed by two suppliers with whom I have data processing agreements. If you have accepted cookies, Google and LinkedIn also receive data:
- Simply.com A/S (Denmark) — hosting, database and sending email.
- Stripe Payments Europe Ltd. (Ireland) — card payment. Stripe receives your email from me and what you enter yourself on the payment page (card details and the name on the card), and may transfer data to the USA under the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses. Your card details are entered at Stripe and never pass through this site.
- Google Ireland Ltd. (Google Ads) — only if you have accepted cookies from Google Ads. The purpose is to measure whether clicks on my ads lead to a sign-up or a purchase. Google receives your IP address, information about your browser and device, the address of the page you are on, and the ad click ID — for a purchase also the amount and an order number. Your name and email are never sent to Google. Google processes the data as an independent controller under its own terms (policies.google.com/privacy) and may transfer it to the USA under the EU-U.S. Data Privacy Framework and standard contractual clauses.
- LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag) — only if you have accepted cookies. The purpose is to measure whether my ads on LinkedIn lead to visits and sign-ups, and to be able to show my ads on LinkedIn to people who have visited the site (retargeting). LinkedIn receives your IP address, information about your browser and device, the address of the page you are on, and the time — for a sign-up also the fact that a sign-up took place. If you are logged in to LinkedIn, LinkedIn can link the visit to your profile; I only see aggregate figures and never who visited the site. Your name and email are never sent to LinkedIn. LinkedIn and I are joint controllers for the collection via the tag, and you can exercise your rights against either of us; LinkedIn alone is responsible for any further processing under its own terms (linkedin.com/legal/privacy-policy). LinkedIn may transfer the data to the USA under the EU-U.S. Data Privacy Framework and standard contractual clauses.
Visitor measurement
I measure which pages are viewed, how long they stay open, which country and city the visit comes from, and what kind of site you came from (e.g. LinkedIn, Google or an email) — only the category, not the address. If you sign up, the category is stored with your sign-up. I use this to see which courses attract interest, and where. The city is looked up from your IP address in a database on my own server (DB-IP City Lite) while the page is shown; the IP address is not passed on and is not stored. In the same way it is looked up whether the visit comes from a data centre; if so, it is counted as a robot and not stored. The measurement uses no cookies. To count visitors — rather than just page views — a pseudonym is derived from your visit, and it changes every day. The same person therefore cannot be followed from one day to the next, and I have no figures for repeat visits. The basis is my legitimate interest in knowing what is in demand (Art. 6(1)(f)). The measurements are deleted after 12 months.
Cookies
The visitor measurement described above uses no cookies. Without your consent, no cookies for tracking or marketing are set either. The necessary cookies only remember your own choices or keep you logged in:
- eeng_lang — remembers whether you read the site in Danish, English or German. Contains only "da", "en" or "de" and is kept for one year.
- eeng_kunde — remembers whether you want to see prices as a business (excl. VAT) or privately (incl. VAT). Contains only "erhverv" or "privat" and is kept for one year.
- PHPSESSID — keeps you logged in if you have an account. Set only when you log in, and disappears when you close the browser.
- eeng_taelles_ikke — set only in the administrator's own browser, so that my own visits are not counted in the visitor measurement. Kept for 400 days.
- eeng_samtykke — remembers your choice about cookies from Google Ads and LinkedIn. Contains only "ja" or "nej" and is kept for 6 months.
Cookies that require your consent
If you say yes in the cookie banner, the site loads Google's and LinkedIn's tags so that I can see whether my ads lead to sign-ups and can show my ads on LinkedIn to people who have visited the site. These cookies are then set:
- _gcl_au — Google Ads, conversion measurement. Kept for 90 days.
- _gcl_aw — Google Ads, stores the ad click ID when you arrive from an ad. Kept for 90 days.
- Google's own cookies on google.com, google.dk, googleadservices.com and doubleclick.net (e.g. IDE) — set by Google. Kept for up to 13 months.
- li_fat_id and li_giant — LinkedIn, links a click on a LinkedIn ad to a visit or a sign-up. Kept for 30 and 7 days.
- LinkedIn's own cookies on linkedin.com (e.g. bcookie, li_gc, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory) — set by LinkedIn. Kept for up to 1 year.
The legal basis is your consent (Art. 6(1)(a)). You can withdraw it at any time via "Cookie settings" at the bottom of the page. Google's and LinkedIn's cookies on eeng.dk are then deleted and the tags are no longer loaded; their own cookies on their domains can be deleted in your browser. If you say no or make no choice, nothing is loaded from Google or LinkedIn. Cookie settings
Server log
The hosting provider keeps an operational log of requests to the server, which may contain IP addresses. It is used for operations and troubleshooting and is deleted by Simply.com according to their own schedule. If an email to you cannot be sent, your email address is written to the error log so the fault can be found. I do not use the logs to track visitors.
Security
The site runs over HTTPS. Passwords are stored encrypted and cannot be read — not even by me. Login links work once and for half an hour. Course material sits behind a login and is released only to participants on that course. Card details are handled solely by Stripe.
Your rights
You can always ask to see the data I hold about you, have it corrected or deleted, have the processing restricted, object to it, or receive the data in a common format. If you have given consent, you can withdraw it at any time — this does not affect the lawfulness of what happened before.
Write to jesper.esbensen@eeng.dk. I reply within one month. If you are not satisfied with the reply, you can complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.
Changes
If this policy changes, the date below is updated. Significant changes are notified by email to those affected.
Last updated: 18 October 2026