Privacy and cookies

Last updated: October 2026.

Controller

EA Consulting V/Edis Adilovic, Danish company registration (CVR) 41699981, Pantheonsgade 5, 2. sal, 5000 Odense C, Denmark. Email edis@edisadilovic.com, phone +45 22 30 67 37.

When you contact me

When you send an enquiry or a speaking request through the form, I process your name, organisation, email, phone number, topic, message and anything you write about date, place and participants. I also store the text of the consent statement you accepted, the time, your language choice and an anonymised form of your IP address for abuse protection. A copy of the enquiry is sent to my own inbox so I can reply to you; it is deleted under the same rule.

The purpose is to answer your enquiry and contact you by phone or email, as you have agreed. The legal basis is your consent and the steps prior to a possible contract (GDPR article 6(1)(a) and (b)). You can withdraw consent at any time by writing to me.

The data is deleted no later than 24 months after our last contact, unless we enter into an agreement where Danish bookkeeping law requires longer retention of invoice data.

If you subscribe, I store your first and last name, your email address, language, the time of subscription and confirmation, the consent text you agreed to, status, and an anonymised form of your IP address for abuse protection. I use your name only to address you personally. You only receive the newsletter after confirming via the link in the first email (double opt-in). If you do not confirm within 48 hours, the details are deleted after 7 days. The basis is consent, which you can withdraw at any time. Every newsletter has an unsubscribe link. After unsubscribing, your data is deleted within 30 days.

Once you have confirmed, I send you one welcome email. After that you get the newsletters I write and, at most once a month, an overview of new blog posts, cases and upcoming talks. Every email is sent to you alone with your own unsubscribe link. For each send I keep a record of who it went to and whether it arrived, so an interrupted send can continue without anyone getting it twice. Your email address is removed from that record 90 days after the send, or at once if you ask me to erase your data.

Tracking in the emails I send

All emails from edisadilovic.com, including confirmations, reports and newsletters, are sent through Brevo. Brevo adds a small invisible image to each email and sends links through an address run by Brevo before the page opens. That address can be under my own domain (link.edisadilovic.com), but Brevo runs it. This tells Brevo whether an email was delivered and opened and whether a link was clicked. I have set Brevo to record opens and clicks anonymously, so they are counted but not linked to you as a person. I use the numbers only to see that my emails arrive and are read. You can avoid the tracking image by turning off automatic image loading in your email program; links still work. The legal basis is my legitimate interest in knowing that my emails reach you (GDPR Article 6(1)(f)).

Check your digital accessibility (EA Accessibility Scanner)

When you enter a web address on the Check your digital accessibility page, the scanner fetches the website's sitemap and robots.txt, if they exist, and then up to 5 publicly visible pages at that address and tests them automatically. The number of pages in the sitemap is shown with the result. I store the address, the result and an anonymised form of your IP address (used to limit the number of checks per day) for 7 days. You can use the check without saying who you are.

If you choose to check a PDF document, the file is processed only to run the check. It sits on my server while the check runs and is deleted as soon as it has finished, at the latest after 10 minutes. The files are not passed on, not shown to anyone and not stored. The result contains the document's title or file name, page count, technical properties (for example whether the document is tagged) and finding types with technical locations, never text from the document. If the document contains personal data, I therefore process it only for the minutes the check takes, in order to deliver the check you asked for (GDPR article 6(1)(b) and (f)). Only upload documents you are entitled to have checked.

If you request the full report, I process your name, organisation, email and phone number, the text of the consent statement you accepted, the time, your language choice, the checked address or the name of the document and an anonymised form of your IP address. The purpose is to send you the report and to call you once to go through it. If the report is for a website, I may check the whole website with the same automated tool from my own computer before the call, so I can offer you the full report. The tool fetches only public pages, and I keep the result as long as your other details. The legal basis is your consent and my legitimate interest in following up on the report you asked for (GDPR article 6(1)(a) and (f)). If you also tick the optional box, I may email you an offer for a manual test; that is marketing and happens only with your separate consent. The report never depends on the optional box. You can withdraw consent at any time by writing to me.

The report sits behind a link that only you receive, and it is deleted together with the PDF version after 30 days. Your contact details are deleted no later than 24 months after our last contact, as described under "When you contact me". The report contains information about the checked website or document, not about you.

The check only fetches pages anyone can see, the same way a browser or a search engine does. It does not log in, fill in forms or store page content beyond short excerpts of the code where a defect was found. If you own a website that must not be checked, write to me and I will exclude the address.

Comments on the blog

When you comment on a blog post, I store your name, your email address, your comment, which post and, if you reply, which comment you reply to, your language, the text of the consent statement you accepted, the time and a one-way hashed form of your IP address that changes every day, to protect against abuse. When you send the comment, I receive a short email saying that there is a new comment. It does not contain your name, your email address or your comment.

The comment is only shown once I have approved it. Then everyone can see your name, the date and the comment under the post, on both the Danish and the English version of the page. Your email address is never shown, and I do not write to you at it. I only use it to find your comments if you ask for access or deletion. My own replies are shown with my name. Do not include details about your health or other sensitive matters that you do not want shown publicly. If you are under 15, ask an adult before you comment.

The legal basis is your consent (Article 6(1)(a) GDPR) and my legitimate interest in keeping the comments free of spam and abuse (Article 6(1)(f)). You can withdraw your consent at any time by writing to me, and I will delete your comments.

The hashed IP address is deleted after 30 days. A comment I have not approved is deleted after 90 days, and a comment I reject or mark as spam is deleted 30 days later. An approved comment is shown for as long as the post exists or until you ask me to delete it. Your email address is deleted together with the comment. When I delete a comment, I also delete my own replies to it. Replies by others remain.

Write to me securely

On the page Write to me securely you can send me a message and up to 5 files with confidential details, for example CPR numbers or health information. I process your name, organisation, email, phone number, subject, message, files and the text of the consent statement you accepted, with the time.

The message and files are encrypted on my server the moment you send them, with my personal MitID certificate for secure email (S/MIME, AES-256). They are sent encrypted to my inbox, and only I can open them with my private key. The content is never stored unencrypted on the server, in the database or in logs. If the email cannot be delivered at once, the encrypted version stays in the database while it is retried, for at most 3 days, and is then deleted. Database backups may hold the encrypted version for up to 14 days. Apart from that the server keeps only a reference number, the time, the size, the number of files, your language and a hashed (one-way transformed) version of your IP address that changes every day, for 30 days, to protect against abuse.

You get a receipt by email through Brevo. It contains only the reference number, never anything you wrote.

The purpose is to help you with your request and contact you about it. The legal basis is the steps before or under an agreement (Article 6(1)(b) GDPR). For CPR numbers and health information the legal basis is your explicit consent (Article 9(2)(a) and section 11(2)(2) of the Danish Data Protection Act). You can withdraw your consent at any time by writing to me. If you send information about another person, for example a citizen, a family member or a colleague, you must be entitled to share it with me. If you work for a municipality, region or other authority and send details about a citizen as part of a task I carry out for you, you are the controller. I then process the information as your processor under a data processing agreement and only on your instructions. If we do not have a data processing agreement yet, contact me before you send details about citizens. In other cases I only process information about others if the person has given their own consent, or if you act on their behalf as a parent or guardian.

I keep the opened message encrypted in my email. If I save a file or details from the message elsewhere to carry out the task, the same time limits apply. I delete the message when I no longer need it for the task, and no later than 24 months after our latest contact, unless the law requires longer retention. If I process the information for a municipality or other authority, I delete or return it as set out in the data processing agreement.

If you want access to or erasure of a secure message, please give me the reference number from your receipt or the day you sent it. The messages are encrypted and cannot be searched on the server. I only send replies containing confidential details by secure email.

Processors and other recipients

Brevo (Sendinblue SAS, France): sending confirmations, reports from Check your website, newsletters, short notices to me about new comments (without name, email or text) and receipts for secure messages (without content), and storing the newsletter list. Data processing agreement in place.
Cloudflare (Cloudflare, Inc., USA; Turnstile): spam protection on all forms. When you use a form, Cloudflare briefly processes your IP address and technical browser signals to decide whether you are human. No cookies are set. The basis is my legitimate interest in keeping the forms free of spam and abuse (GDPR Article 6(1)(f)). Transfers to the US take place under the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and the EU Commission's standard contractual clauses. A data processing agreement is part of Cloudflare's terms. Read Cloudflare's Turnstile privacy policy and Cloudflare's general privacy policy.
Google (Google Ireland Limited, Ireland; Google Analytics 4): statistics, only if you accepted statistics cookies. Google's data processing terms for Analytics apply. Google Analytics is linked to my Google Ads account so I can see, in aggregate, whether visitors from ads use the site. Personalised advertising and Google signals are switched off. Data may be transferred to the US under the EU-U.S. Data Privacy Framework.
Google (Google Ireland Limited, Ireland; Google Ads): measuring which of my ads work, only if you said yes to marketing in the cookie banner. The Google Ads code runs on the site and receives your IP address, browser details, which pages you visit and their titles, including pages about blindness and visual impairment, and whether you came from one of my ads. When you request a report, send an enquiry, confirm the newsletter or click phone or email, it is recorded as a conversion. If you send a form, Google also gets your email address and phone number in hashed form (with SHA-256 in your browser), so Google can recognise you and measure more precisely (enhanced conversions). Google can link the measurement to your Google account if you are signed in. As an independent controller Google may also use the data for its own purposes, such as preventing fraud and improving its services. I do not use Google Ads to show you personalised ads. Because pages about blindness can say something about health, I ask for your explicit consent to exactly this (GDPR Article 6(1)(a) and Article 9(2)(a)). For Google Ads, Google is an independent controller under Google's controller terms (Google Ads Controller-Controller Data Protection Terms), and Google and I are jointly responsible for collecting the data on my website and sending it to Google. You can exercise your rights against both me and Google. I am responsible for information and consent on my website; Google is responsible for its own processing under Google's privacy policy. For the hashed contact details (enhanced conversions) Google is my processor under the Google Ads Data Processing Terms and uses them only to measure my conversions. See Google's privacy policy and How Google uses information from sites that use its services. Data may be transferred to the US under the EU-U.S. Data Privacy Framework.
Hetzner Online GmbH (Germany): hosting of the website, the database and the server that runs website checks and produces PDF reports. The database is backed up every night and the copies are deleted after 14 days, so erased data is gone from the copies within 14 days. I have a data processing agreement with Hetzner.
Simply.com (Denmark): my email at edisadilovic.com, where copies of enquiries and report requests arrive, notices about new comments (without personal data) and encrypted secure messages, which Simply.com cannot read. I have a data processing agreement with Simply.com.

Cookies and local storage

Necessary: your language choice (cookie ea_lang, 12 months) and your cookie choice (local storage, 12 months). The pages under /admin, used only by me, also set sign-in cookies (ea_admin, ea_admin_csrf, ea_admin_mfa). These do not require consent.

Statistics: Google Analytics 4 sets cookies (including _ga, 2 years) to measure how the site is used. They are only set if you choose so in the cookie banner. Data retention at Google is set to 2 months.

Marketing: Google Ads sets cookies (_gcl_au and, after a click on an ad, _gcl_aw, both up to 90 days; names may also be _gcl_gs, _gcl_gb and _gcl_dc), and Google may read and set its own cookies on google.com, googleadservices.com and doubleclick.net. They are only set if you tick marketing or choose Accept all. The basis is your explicit consent. If you withdraw it under Cookie settings, measurement stops and the site deletes the Google Ads cookies and local storage on edisadilovic.com. Google keeps the measurements under Google's retention rules; you can delete Google's own cookies in your browser.

You can change or withdraw your choice under "Cookie settings" at the bottom of every page.

Server logs

The web server stores IP address, time, the address of the page you visit and browser details for 30 days for security and debugging. The basis is my legitimate interest in running a secure website.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Write to edis@edisadilovic.com and I will reply within a month. You can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby.

Changes

If I change this policy, I update the date at the top. For significant changes to cookie use, you will be asked to choose again.