Privacy Policy
Last updated: 17 August 2026
This Privacy Policy explains how HYCON A/S (“HYCON”, “we”, “us” or “our”) collects and processes personal data in connection with our website, customer and supplier relationships, sales activities, marketing, enquiries and other business activities.
1. Data controller
The data controller responsible for the processing described in this Privacy Policy is:
HYCON A/S
Juelstrupparken 11
9530 Støvring
Denmark
CVR/VAT no.: 10097061
Email: hycon@hycontools.com
Questions regarding our processing of personal data, requests to exercise data protection rights, and other privacy-related enquiries should be sent to hycon@hycontools.com.
2. Categories of personal data we process
Depending on your relationship with HYCON, we may process the following categories of personal data:
- name;
- company name and position;
- business address;
- country;
- telephone number;
- email address;
- billing and delivery information;
- customer and supplier information;
- order and transaction information;
- correspondence and enquiries;
- newsletter subscription information;
- information concerning your interaction with our website and marketing;
- IP address, device information, browser information and online identifiers;
- information derived from website analytics and sales intelligence tools;
- publicly available professional and company information; and
- other information you choose to provide to us.
We generally do not intend to collect special categories of personal data through our website. Please avoid including sensitive personal information in free-text contact forms unless it is necessary.
3. Contact forms and enquiries
When you contact HYCON through our website, by email or by telephone, we may process information such as your:
- name;
- company;
- country;
- telephone number;
- email address; and
- message and related correspondence.
We process this information in order to answer your enquiry, provide requested information, prepare quotations, follow up on potential business opportunities and maintain our business relationship with you.
Depending on the nature of the enquiry, our legal basis is:
- Our legal basis is primarily GDPR Article 6(1)(f) for our legitimate interests in administering customer and supplier relationships, communicating with business contacts, processing orders and providing customer service.
- GDPR Article 6(1)(b) may apply where the individual concerned is personally a party to the contract, or where processing is necessary in order to take steps at that individual's request prior to entering into a contract.
- GDPR Article 6(1)(c) applies where processing is necessary to comply with legal obligations, including accounting and tax requirements.
If your enquiry does not lead to an ongoing customer or business relationship, we normally delete or anonymise the personal data relating to the enquiry within 24 months after the last meaningful contact, unless continued storage is necessary for the establishment, exercise or defence of legal claims or due to another legal obligation.
4. Customers and customer contacts
When you or the company you represent purchases products or services from HYCON, we may process personal data relating to contact persons, purchasers, employees and other representatives.
This may include:
- name;
- company;
- job title or function;
- email address;
- telephone number;
- billing and delivery information;
- order history;
- correspondence; and
- other information necessary to manage the customer relationship.
We process this data for purposes including:
- processing and fulfilling orders;
- customer service;
- invoicing and accounting;
- delivery and logistics;
- product support;
- warranty and complaint handling; and
- maintaining our commercial relationship.
Our legal basis is primarily:
- GDPR Article 6(1)(b) where processing is necessary for the performance of a contract or related pre-contractual measures;
- GDPR Article 6(1)(c) where processing is necessary to comply with legal obligations, including applicable accounting and tax requirements; and
- GDPR Article 6(1)(f) for our legitimate interests in administering and maintaining business relationships, customer service, documentation and internal business management.
Accounting records and information required under applicable bookkeeping legislation are retained for the period required by law.
Other customer-related personal data is retained for as long as the customer relationship is active and thereafter for the period reasonably necessary for documentation, warranty, limitation, tax and legal purposes. As a general rule, we review such information for deletion five years after the end of the relevant customer relationship or transaction, unless a longer or shorter period is required or justified.
5. Suppliers and business partners
We process personal data relating to suppliers, distributors, dealers, consultants and other business partners.
This may include:
- name;
- company;
- position;
- business contact details;
- bank and payment information where relevant;
- correspondence; and
- contractual and transaction information.
The purposes include supplier administration, purchasing, payments, contract management, communication and maintaining our business relationships.
The legal basis is:
- GDPR Article 6(1)(b) where processing relates to contractual or pre-contractual matters;
- GDPR Article 6(1)(c) where we are required to retain information by law; and
- GDPR Article 6(1)(f) for our legitimate interests in operating and administering our business relationships.
Information is retained for as long as the business relationship exists and thereafter for the period required by applicable accounting, limitation and other legal requirements.
6. Newsletter and email marketing
HYCON uses ActiveCampaign to manage newsletter subscriptions and email marketing.
We only send newsletters and similar email marketing to recipients who have actively subscribed or otherwise validly consented to receive such communications.
When contacting HYCON through our contact form, the newsletter checkbox is optional and is not selected by default.
We may process:
- name;
- email address;
- company information where provided;
- subscription status;
- date and source of consent;
- information about delivery and interaction with our emails, to the extent permitted by applicable law; and
- records necessary to document consent.
Our legal basis for sending electronic marketing is your consent, cf. GDPR Article 6(1)(a), together with the applicable rules on electronic marketing.
You may withdraw your consent at any time by using the unsubscribe link included in our marketing emails or by contacting us.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Once you unsubscribe, we stop sending marketing communications. We may retain limited information in a suppression list in order to ensure that your opt-out continues to be respected and may retain documentation of the consent for as long as reasonably necessary to demonstrate compliance with applicable law.
7. Website analytics and cookies
We use cookies and similar technologies on hycontools.com for purposes including necessary website functionality, preferences, analytics and marketing.
Depending on your consent choices, we may use services such as:
- Google Analytics 4;
- Google Tag Manager;
- Microsoft Clarity;
- Meta Pixel;
- LinkedIn Insight Tag; and
- Lead Forensics.
Except for technologies that are strictly necessary for the operation of the website, optional technologies are only activated in accordance with the choices you make through our cookie consent solution.
Where personal data is processed through optional analytics or marketing technologies, our legal basis is generally GDPR Article 6(1)(a) – consent.
Further information about the cookies and similar technologies currently used, their purposes, providers and storage periods is available in our Cookie Policy and Cookiebot Cookie Declaration.
You may change or withdraw your cookie consent at any time through the cookie settings available on our website.
Further information about the cookies and similar technologies currently used is available in our Cookie Policy.
8. Lead Forensics and B2B sales intelligence
We use Lead Forensics as part of our business-to-business sales and marketing activities.
Lead Forensics may provide us with information intended to help identify companies that visit our website and understand how business visitors interact with our website.
We may combine such information with business contact information and publicly available professional information for purposes including:
- identifying potential business customers;
- understanding interest in HYCON products and services;
- sales research;
- prioritising business leads; and
- contacting relevant business representatives where permitted by applicable law.
Where this processing is based on personal data, our legal basis is generally GDPR Article 6(1)(f), based on our legitimate interest in identifying, developing and managing relevant B2B commercial opportunities.
Before relying on legitimate interests, we seek to balance our commercial interests against the privacy rights and reasonable expectations of the individuals concerned.
Any direct marketing communication is also subject to applicable marketing and electronic communications rules. Personal data being processed for direct marketing purposes may be objected to at any time.
Lead data that does not result in an active commercial relationship will normally be reviewed for deletion or anonymisation within 24 months after the most recent meaningful sales activity, unless a longer period is justified by an ongoing business opportunity, legal obligation or the need to establish, exercise or defend legal claims.
9. Microsoft Business Central and business administration
We use Microsoft Dynamics 365 Business Central for order processing and other business administration.
Personal data processed through Business Central may include customer and supplier contact details, order information, billing information, delivery details, transaction records and related correspondence.
This processing is carried out for the performance and administration of customer and supplier relationships, accounting, order processing, logistics and compliance with legal obligations.
The relevant legal bases are GDPR Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f), depending on the specific processing activity.
10. Website hosting, CMS and technical service providers
Our website is hosted through one.com and uses Umbraco as its content management system.
We also use Clienti in connection with development and technical support of the website.
These providers may process personal data on our behalf where this is necessary to provide hosting, maintenance, technical support, security or related services.
Where a service provider processes personal data solely on our behalf, it acts as a data processor and is subject to applicable contractual data protection obligations.
11. Microsoft 365 and communications
We use Microsoft services, including Microsoft 365, for business communications, email, document management and related administrative purposes.
Personal data contained in emails, documents, calendar entries and other business communications may therefore be processed through Microsoft's services.
The legal basis depends on the underlying purpose of the communication and may include GDPR Article 6(1)(b), 6(1)(c) or 6(1)(f).
12. Recipients of personal data
Where necessary, we may disclose or make personal data available to categories of recipients including:
- IT and hosting providers;
- website developers and technical service providers;
- email marketing providers;
- analytics and advertising technology providers;
- sales intelligence providers;
- Microsoft and other cloud service providers;
- accounting and professional advisers;
- transport and logistics providers;
- public authorities where required by law; and
- other business partners where disclosure is necessary and lawful.
We do not sell personal data.
13. International transfers
Some of the service providers used by HYCON are international companies or may use infrastructure, group companies or subprocessors located outside the European Economic Area (“EEA”).
This may involve transfers of personal data to countries outside the EEA, including the United States.
Where personal data is transferred outside the EEA, HYCON seeks to ensure that an appropriate transfer mechanism is in place in accordance with GDPR.
Depending on the recipient and circumstances, this may include:
- an adequacy decision adopted by the European Commission;
- participation by the recipient in the EU-U.S. Data Privacy Framework where applicable;
- the European Commission's Standard Contractual Clauses; and/or
- additional contractual, technical or organisational safeguards where required.
You may contact us if you would like further information about the safeguards applicable to a specific transfer.
14. Sources of personal data
We primarily receive personal data:
- directly from you;
- from the company or organisation you represent;
- when you communicate or transact with HYCON;
- through our website and cookie technologies, subject to your consent;
- from sales intelligence services such as Lead Forensics;
- from publicly available business and professional sources; and
- from existing customers, distributors, dealers or business partners where relevant.
Where we obtain personal data from sources other than the individual, we process the data in accordance with applicable data protection law and provide the required information where applicable.
15. Job applications
HYCON may occasionally receive unsolicited job applications by email.
We process applicant information for the purpose of assessing potential employment opportunities and managing the recruitment process.
The information may include:
- name and contact details;
- CV;
- education and employment history;
- application and correspondence; and
- other information voluntarily supplied by the applicant.
We normally delete information relating to unsuccessful applicants within six months after the recruitment process has ended, unless a longer retention period is necessary for a specific reason or the applicant has separately agreed that we may retain the information for consideration for future positions.
We ask applicants not to submit sensitive information unless it is relevant and necessary for the application.
16. No automated decision-making
HYCON does not currently use personal data to make decisions about individuals based solely on automated processing that produces legal effects or similarly significant effects.
Sales and marketing assessments are currently performed with human involvement.
17. Retention of personal data
We retain personal data only for as long as it is necessary for the purposes for which it was collected or for as long as required by applicable law.
Our general retention principles include:
- contact enquiries and inactive leads: normally up to 24 months after the last meaningful contact;
- active customer and supplier data: for the duration of the relationship and thereafter as necessary for legal, contractual and documentation purposes;
- accounting records: for the period required by applicable bookkeeping legislation;
- newsletter subscriptions: until consent is withdrawn, with limited suppression and consent documentation retained where necessary to demonstrate compliance;
- website analytics data: according to the retention settings and periods applicable to the relevant analytics services and as described in our Cookie Policy;
- unsuccessful job applications: normally six months after the end of the relevant recruitment process.
We may retain information for a longer period where necessary to comply with a legal obligation, establish or defend legal claims, resolve disputes or enforce agreements.
18. Your rights
Subject to the conditions and limitations set out in the GDPR, you may have the right to:
- access the personal data we process about you;
- rectify inaccurate or incomplete personal data;
- erase personal data in certain circumstances;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- object at any time to processing for direct marketing purposes;
- receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
- withdraw consent at any time where processing is based on your consent; and
- lodge a complaint with a supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Requests relating to your rights may be sent to:
We may ask you to provide information necessary to verify your identity before responding to a request.
19. Complaints
If you are dissatisfied with the way HYCON processes your personal data, you are welcome to contact us first.
You also have the right to lodge a complaint with the Danish supervisory authority:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
Further information is available from Datatilsynet's website.
20. Security
HYCON takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to personal data is limited to persons who need access for legitimate business purposes.
21. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example where our processing activities, service providers or legal obligations change.
The date at the top of the policy indicates when it was last updated.