Privacy policy

Data controller

Sitavo has not appointed a data protection officer (DPO), as this is not a requirement for our type of processing.

What information we process

Information you give us

• Account: name, email, username, account type (private/business), country, and for businesses the company name and CVR number. Your password is only stored as a one-way hash (argon2id).
• Profile (optional): profile picture, phone number, address, bio and website.
• Listings: text, images, key figures, documents in the data room and contact details you choose to show.
• Communication: messages, attachments, bids, counter-bids, NDA requests, meetings, deal processes and reviews.
• NDA signature: your name, email, CVR number if any, the time, IP address and browser — as proof that you signed. The seller sees your name and CVR number, if any, when the NDA is approved.
• Investor profile and acquisition requests (optional): what you write about what you are looking for. The profile and requests can be seen by sellers and visitors as described on those pages.
• Enquiries and appeals: what you write to us via the contact form, the live chat or email, answers to “Did you find an answer?” in the help centre and appeals against our decisions.
• Verification: the information you send to be verified (e.g. CVR number). If you choose verification with passport or driving licence, Stripe processes an image of the document and a selfie (see “Sensitive data” below).
• Newsletter (optional): your email and your consent (time and where you gave it).

Information we collect when you use Sitavo

• Log-in and security: IP address, browser/device (user agent), log-in times, active sessions and log-in attempts. Used to protect your account and show you your active devices.
• Two-step verification: an encrypted 2FA key and hashed backup codes if you turn on 2FA.
• Listing statistics: we count views and clicks on listings for the seller. The statistics are stored in aggregate (count, traffic source, country, search terms); we do not store your IP address in the statistics, only a short-lived, one-way encrypted key to avoid double counting.
• Ads in our network: featured listings are also shown on our look-up sites (including DanskAdresseAPI). When a visitor there sees or clicks an ad, Sitavo receives the visitor's IP address and information about the page (site, placement, industry or area). We only use this to choose a relevant ad and to count views and clicks for the seller. The IP address is only held in the server's memory for up to one day to filter out duplicate counts and bots and is never stored in the database; the statistics are stored as counts per listing, placement and day. The legal basis is our legitimate interest in delivering and measuring the ads the seller has bought (GDPR Art. 6(1)(f)).
• Data room: which documents you have opened and when (with a one-way encrypted IP key), so the seller can see who has seen what. Documents you download are watermarked with your name and email.
• Online status and latest activity: when you were last active (online status can be hidden under Settings → Privacy), and when you last logged in or used Sitavo — we use the latter to delete accounts that are no longer used.
• Fraud check of messages: messages are automatically checked for typical signs of fraud (e.g. requests for payment outside the deal). If there is a suspicion, the text is assessed by AI with emails and phone numbers hidden, and the recipient may get a warning. A short excerpt is stored so Sitavo can follow up.
• Email log: which emails we have sent you, when, and whether they were delivered. The content itself is deleted as soon as the email has been delivered or finally abandoned.
• AI usage: when you have used an AI feature (and the IP address for 30 days), so misuse can be limited.

Information from others

• Google: if you log in with Google, we receive your name and email from Google.
• The CVR register and VIES: when you enter a CVR number or an address, we look it up in public registers (via DanskCVRAPI and DanskAdresseAPI). A VAT number from another EU country is checked in the European Commission’s VIES.
• Stripe: the result of an identity verification and the payment status of your purchases.
• Other users: e.g. messages, bids, reviews and reports that others write to or about you.

Sitavo is for people aged 18 and over. To create an account, you must provide your name and email (and a CVR number for a business account) — without them we cannot enter into the agreement with you. All other information is optional, but some features require it (e.g. the “Verified” badge requires you to confirm your identity or business).

Purposes and legal basis

Sensitive data

The only sensitive data (Art. 9) we have processed is biometrics: if you verify with passport or driving licence, Stripe compares your selfie with the photo in the document. This only happens with your explicit consent, which you give in a separate field before Stripe’s window opens. Consent is voluntary, and you can withdraw it. We ask Stripe to delete images and document data 30 days after the decision and at the latest when you delete your account. Otherwise, please do not share sensitive data in listings or messages.

Automated checks and decisions

New and edited listings and acquisition requests are checked automatically for signs of fraud and prohibited content (rules and possibly AI), and messages are checked for typical fraud patterns. The check can put something up for manual review or show a warning, but the decision to reject or remove content or suspend an account is always made by a member of Sitavo’s staff. You always get a reason and a link to appeal. If the deadline for confirming your identity expires, the “Verified” badge is removed automatically, and you are notified first. Buyer matching compares your acquisition request with the listings using fixed, explainable criteria (e.g. industry, region and price) and shows why something matches — this is profiling, but without legal effects, and you decide yourself whether sellers can see you. We do no profiling that has legal effects for you.

Who can see your information

• All visitors: your public seller profile (first name and the first letter of your surname — or the company name if you sell as a business — username, bio, reviews, active listings), your public listings and a public investor profile or acquisition request if you have created one. Your full name is not shown publicly. You can make the profile invisible to search engines under Settings → Privacy.
• The other party: in messages, bids and meetings the other party sees your first name and the first letter of your surname (“First name I.”) and what you write. The other party only sees your full name, email and phone number once you share them yourself — and you can withdraw the sharing. Emails and phone numbers you write in a message or a bid comment are hidden from the other party until you have shared your contact details. In a discreet sale, the other party only sees an alias until the identity is released. In a deal, the information the agreement requires is shared once you have confirmed it yourself.
• The seller at NDA: when the seller approves your NDA, the seller sees your name and CVR number, if any, from the signature.
• Buyers with access: documents in the data room are only visible to buyers with an approved NDA, an accepted bid or an ongoing deal.
• Sitavo’s staff: only when necessary for support, moderation of reported cases, disputes, verification or security. We do not routinely read your messages. When a member of staff opens a conversation, a deal or a private file, it is logged.

Advisers with access to your account

You can give a Sitavo adviser (broker, lawyer, accountant or other adviser) access to help you. The adviser only sees and does what you choose — for the listings and the period you choose — and you can always change or revoke the access under Settings → Advisers.

• Who gets access: the advisery firm and the specific people in the firm assigned to you. You can always see who they are.
• What is shared: the information your access covers (e.g. listing content, bids, messages or deal documents). Information about counterparties (buyers/sellers) included in it is shared to the same extent.
• Roles: Sitavo is the controller for the platform and the log. The advisery firm is an independent controller for the advice it gives you and is bound by Sitavo’s terms for advisers (confidentiality and purpose limitation).
• Log: everything the adviser does on your behalf — and attempts that were denied — is stored and shown to you. The log is kept for as long as your account exists.
• The counterparty is informed: when an adviser writes on your behalf or takes part in a deal, the counterparty can see it (“on behalf of”).
• Power of attorney: you can grant an adviser a digital power of attorney for specific actions (offers up to a limit, NDAs and counteroffers) for a limited period. Your acceptance is stored with time, IP address and browser as evidence — this information is never shown to the counterparty. You are notified every time it is used, and you can revoke it at any time under Settings → Advisers.
• Legal basis: your consent/request (Article 6(1)(a) and (b)) for granting the access; our legitimate interest in security and documentation (Article 6(1)(f)) for the log.

Data processors and recipients

We use the following suppliers, who process information on our behalf under a data processing agreement. Our own data (database, files and backups) is stored in the EU. Some suppliers may transfer information to countries outside the EU — this is stated in the table, and the transfer takes place on the basis of EU standard contractual clauses or the EU-U.S. Data Privacy Framework.

Services you choose to use yourself: video meetings open at Jitsi (meet.jit.si, run by 8x8 Inc., USA), and if you connect ChatGPT or Claude to Sitavo, Sitavo sends the information you ask for to that service. Those services process the information under their own terms.

Brokers and advisers: if you ask for help from a broker or adviser via Sitavo, we pass on your name, contact details and enquiry to the advisory firm that is to help you — only by agreement with you. The firm is an independent data controller for the further advice.

We only disclose information to authorities when we are obliged to do so by law, or if it is necessary to establish or defend a legal claim. We never sell personal data and do not use it for advertising for others.

How long we keep the information

How we protect your data

• All traffic is encrypted with HTTPS (TLS).
• Passwords are only stored as an argon2id hash; login cookies are httpOnly, and the database only stores a hash of the session token.
• New passwords are checked against known data breaches (Have I Been Pwned). Only the first 5 characters of a one-way hash of the password are sent — never the password itself, your email or anything else about you.
• Two-factor authentication (2FA) with an app and backup codes. 2FA keys and demo logins shared in messages are encrypted (AES-256-GCM).
• Documents in the data room and attachments are private and require an access check on every view. Metadata (e.g. EXIF/GPS) is removed from uploaded images.
• Rate limiting against guessing attacks and spam, and a log of administrative actions — also when a member of staff opens private conversations, deals or files.
• Bank details in a deal are stored encrypted.
• We have a fixed procedure for personal data breaches: notification to the Danish Data Protection Agency within 72 hours and a message to you if the breach is likely to have serious consequences for you.

Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access to the information we hold about you.
• Rectification of incorrect information — you can correct most of it yourself under Settings.
• Erasure — you can delete your account yourself under Settings → Account. While a deal is in progress, the account can only be deleted once the deal is completed, so the other party is not left without a counterparty.
• Data portability — you can download your data yourself as a JSON file under Settings → Account. The file contains everything we have stored about you — including messages, offers, deals, payments, profiles, decisions and appeals and logs (without passwords, other security keys and other people’s information). Files you have uploaded are listed; write to us if you would like copies of them.
• Restriction of processing and objection to processing carried out on the basis of legitimate interest.
• Withdrawal of consent — e.g. to statistics via the cookie settings, to the newsletter with the link in every email, or to biometrics by writing to us. This does not affect the lawfulness of the processing before the withdrawal.
• Appeal against our decisions about your content or your account — via the link in the email about the decision, within 6 months.

Write to [email protected] to exercise your rights. We will reply within one month at the latest and may ask you to confirm your identity.

Complaints to the Danish Data Protection Agency

If you are dissatisfied with how we process your information, we would like to hear from you first. You can always complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, [email protected], datatilsynet.dk.

Changes

We update the policy when we change our processing — e.g. when payment or statistics are activated. You will be notified of material changes by email or notification. The date of the most recent change is shown at the top.