Privacy policy
12 November 2026
This is a translation. If the versions differ, the Danish version applies.
1. Adverts – only if you say yes
We do not use Google Analytics. We would like to use Google Ads to measure whether our adverts lead businesses to sign up. The cookies for this are only set when you have actively said yes in the cookie choice. «Reject all» is as easy as «Accept all», and you can always change or withdraw your choice under «Cookie settings» at the bottom of the page. If you say no, we delete Google’s cookies again.
| Cookie | What it does | How long |
|---|---|---|
| rishah_samtykke | Remembers your cookie choice (necessary) | 12 months |
| _gcl_au | Google Ads – measures our adverts (only with your yes) | 90 days |
We keep what you chose, when, and under which version of the cookie policy, so we can document your consent. The data from Google may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework.
2. What data do we process?
- The business’s name, company or VAT number and address
- Name, e-mail and phone number of the contact person and the account’s users
- The e-mail address we are to send our invoices, notifications and forwarded invoices to
- Login: the password (stored so that no one can read it) and the secret key for the code from the app
- The account’s log: what has happened on the account (for example logins and changes), when and from which IP address
- Which package the customer has, and what the customer has bought and paid
- The invoices and attachments the customer sends and receives – here we are the data processor for the customer (see section 1)
When a business signs up, we fetch its name and address from the public company register.
Reviews: If you write a review of us through the link we sent you, we store your stars, your text and – if you choose to – your name. The review is only shown on our website if you have given permission, and only with the name you have chosen. We store when you gave permission. You can always withdraw the permission with the link in the thank-you e-mail, and the review is then removed from the website at once. The basis is your consent.
The contact form: If you write to us through the form on the website, we send what you wrote – name, e-mail, company, company number, phone, message and the expected number of documents – as an e-mail to support@rishah.dk. We only use it to answer you and keep it as long as the enquiry needs. To stop spam we keep, for one hour, a code made from your IP address, so the address itself cannot be read.
3. Purpose
The data is only used to deliver Rishah: to create and register the customer in Peppol and NemHandel, to send and receive the invoices, to secure the account, for customer service and for our own invoicing and administration. The basis is the agreement with the customer and our duty to keep accounts.
4. Upload PDF
If the customer uses «Upload PDF» or «Add an invoice you have received», we send the file the customer has chosen to a sub-processor in the USA (see the list of subcontractors), which reads the invoice and sends the information back so that the form is filled in. This only happens when the customer presses the button – never otherwise. The transfer to the USA is based on the European Commission’s standard contractual clauses. It may only use the file to read it for us – not to train its models – and deletes it within 30 days at the latest.
5. How long do we keep the data?
The account and its data are kept for as long as the agreement runs. When the account has been closed, we keep the agreement, the signature and the check of who signed for 5 years as documentation – after that we delete the account completely.
Sent and received invoices are kept for up to 5 years while the account is open – with Enterprise, as long as the agreement runs. How far back you can see and fetch them depends on your package, as stated in the price list. If the account is closed, we delete the invoices, drafts and the customer and product register 30 days after the closing. Our access point may keep a copy for up to 5 years for documentation and logging.
The account’s log keeps the latest 200 events; older events are deleted automatically.
Our own invoices to you are kept for 5 years, as the Danish Bookkeeping Act requires.
A review is kept until you withdraw your permission or your customer data is deleted.
If there is a pending case or a legal requirement, data may be kept longer.
6. Whom we share the data with
Data is only passed on to the extent necessary to deliver Rishah:
- The Peppol network and NemHandel, which deliver the invoices to the receivers
- Our subcontractors – among them our access point to Peppol and NemHandel, the company that runs our server, and our accounting system. Who they are, what they do and where the data is processed is shown on the list of subcontractors.
- The public Danish company register (CVR), where we look up the business’s name and address
We never sell data and do not use it for advertising.
7. Data security
The connection to Rishah is encrypted. Invoices and account data are stored encrypted. Login requires both a password and a code from an app on your phone, and every change on the account is written in the account’s log.
8. The website
The website does not use Google Analytics. It only uses Google Ads (measuring our adverts) if you have said yes in the cookie choice. The data is processed by Google and may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework. You can always change or withdraw your choice under «Cookie settings» at the bottom of the page. See the cookie policy.
9. Your rights
You have the right of access, rectification, erasure and restriction of the processing of your personal data. You also have the right to data portability, to object to the processing and to withdraw a consent at any time. Contact us at support@rishah.dk.
10. Complaints
If you wish to complain about our processing of personal data, you can contact the Danish Data Protection Agency (Datatilsynet) or the data protection authority in your own country.