How we handle your information

Applies to the newsletter and the customer portal on cx2.dk. Draft, last updated 2026-09-18.

Who is responsible

CX1 ApS, company reg. no. (CVR) 37292044, Birk Centerpark 40, DK-7400 Herning, is the data controller. CX2 is developed and operated by CX1 ApS. You can contact us at cx1@cx1.dk.

What this page covers

Three things: signing up for news about CX2, the customer portal where you log in and work with your projects, and the file sharing area where a project's documents are kept. If you only use the public pages on cx2.dk, we store nothing about you. The site uses no tracking, no analytics and no third-party content; even the fonts are served from our own server.

The newsletter

When you sign up, we store your email address, the time, your consent and the language you chose. We use this for one thing: sending you emails about CX2. The legal basis is your consent. The information is kept on our own server in Denmark and is not passed on.

You can unsubscribe at any time by writing to cx1@cx1.dk. We then delete your address from the list.

The customer portal: account and login

Your account is your email address. There is no password. When you log in, we send a six-digit code to your address; the code is valid for ten minutes and is stored only as a cryptographic hash, so it cannot be read from the database. We also store when the code was requested and the IP address it was requested from, so we can slow down abuse. Your name is stored only if you enter it yourself, or if the person inviting you does.

After login you get a session that lasts two months and is extended each time you use the portal. For the session we store the time, the IP address and the browser's name, so you can see and close your sessions, and so we can detect abuse. The session key itself is stored only as a hash.

The portal sets three cookies, all technical and none for tracking: cx2s keeps you logged in, cx2c protects forms against forged submissions, and cx2f shows a confirmation after an action and is deleted after two minutes.

The legal basis is the agreement you have, or are about to enter into, with CX2 about a project, and for the security logging our legitimate interest in protecting the portal.

Projects

A project holds what you enter yourself: name, address, description, technology, floor area and year of construction. If you order CX2 Service or CX2 Care, billing details are added: legal name, CVR, EAN, invoice address, invoice email, reference and a contact person with a phone number. CX2 adds the phase, agreements and any edge servers with serial number, location and a service history that records who carried out an inspection.

The project is visible to the people invited to it and to CX2. If you invite a colleague or adviser, we store that person's email address and possibly name, and we send an email with a link that is valid for fourteen days. Participants from a different email domain than the owners' are marked as external, so everyone can see who is from outside.

The first files

Before a project's file sharing area exists, you can upload PDF files and images for the assessment, at most ten files and 25 MB in total. They are kept on our own server in Denmark, outside what can be reached from the web, and are handed out only to the project's participants and CX2 after login. They are deleted automatically 90 days after upload, or 30 days after the file sharing area is created. The files are not scanned for viruses; CX2 opens them only on protected machines.

File sharing

When CX2 creates file sharing for a project, the project gets a folder with Microsoft in CX1 ApS' Microsoft 365. The folder is shared with the project's participants by name; no anonymous links are used. If you are not part of CX1, you are created as a guest in CX1 ApS' Microsoft directory with your email address, and the first time you open the folder you confirm your identity with a one-time code from Microsoft. Microsoft processes information in that connection under its own terms, which Microsoft shows you on your first visit.

The sharing itself is carried out by a small service that CX1 ApS has set up in Microsoft Azure in Sweden. It can create and share folders but cannot read the contents of files. It logs each action and the folder number; email addresses are logged only as a shortened hash.

Access to the folder follows the project. When a project is closed, the participants' access ends; an empty folder is deleted, and if files remain, the folder stays with CX2 as part of the case file.

Meeting booking

If you book a meeting through the portal, we store your name, company, phone number, what you write about the subject, and the time. The meeting is created in CX2's calendar with Microsoft with you as an attendee, and you receive the invitation from Microsoft 365 with a Teams link. Free times are found by a service in Microsoft Azure that reads when the calendar is busy; it reads only free and busy, not the contents of other appointments. The information is used to hold and prepare the meeting.

Audit log

The portal keeps a log of actions: logins, creation and changes of projects, invitations, file sharing and administration. For each action we store the time, who did it, what it concerned, and the IP address. The log is used to investigate errors and abuse and is read only by CX2. The legal basis is our legitimate interest in security.

Who else processes the information

The portal and the newsletter are hosted by Simply.com A/S in Denmark, our data processor for web hosting and database. File sharing is hosted by Microsoft, our data processor for Microsoft 365 and Azure. We do not pass information on to anyone else, and we do not sell it.

For how long

Accounts are not closed automatically. The project's owner can remove participants at any time.

Your rights

You can request access to what we have stored about you, have it corrected or deleted, and you can object to a processing. If you withdraw a consent, it applies from that moment. Write to cx1@cx1.dk and it will be done without undue delay. Information we must keep because of an agreement or for accounting cannot be deleted before that period ends, but we will tell you which.

You can complain to the Danish Data Protection Agency (Datatilsynet) if you believe we handle your information incorrectly.

Changes

If we change this page, the new date appears at the top.