Privacy policy

Last updated: 3 November 2026

This is a translation. The Danish version prevails in case of any discrepancy.

Data controller

GN, CVR 38823574, Nordre Fasanvej 207A, 1. 02, 2000 Frederiksberg, Denmark, is the data controller for the processing of your personal data on postly.dk. Contact us through the contact form at postly.dk/en/contact.

What data do we process?

When you send a letter, we process: the sender's name and address, the recipient's name and address, your letter (uploaded file or typed text), number of pages, letter type, order number, your email, payment status and the time you accepted the terms. We never receive your card details; they are processed only by our payment provider.

To protect the service against misuse, we store a one-way value derived from your IP address. In case of technical incidents, we also store limited operational information about payment messages, errors and retries. This includes, among other things, an event ID, order number, status and error message.

Purpose and legal basis

We process the information to fulfil the agreement to print and send your letter (GDPR art. 6(1)(b)), and to comply with the Danish Bookkeeping Act (art. 6(1)(c)). Protection against misuse, troubleshooting and documentation of operations are based on our legitimate interest in running a secure and stable service (art. 6(1)(f)). The information in the order is necessary for us to perform the service.

When a business customer sends letters or uploads recipient lists, we process letter content and recipient details as a data processor on the customer's behalf and on the customer's instructions, only to print and send the letters. The customer is responsible for having a legal basis for the processing and for sending the letters. Postly remains the data controller for its own account, payment and operational data.

Marketing

If you have bought from Postly, we may send you emails about Postly's own, similar services. This is based on our legitimate interest in marketing our services (Article 6(1)(f) GDPR) and section 10(2) of the Danish Marketing Practices Act. If you have ticked that you want news, offers and reminders, it is based on your consent (Article 6(1)(a)).

You can unsubscribe free of charge at any time via the link in the email or by writing to gustav@postly.dk. You can also withdraw a consent. This does not affect processing that took place before.

We only use your email address and information about what you have bought. We keep it until you unsubscribe, but no longer than 3 years after your latest purchase. We keep unsubscriptions so that we do not write to you again.

Storage

Your letter (file or typed text) is stored encrypted in our private storage and deleted automatically and irreversibly by the clean-up 7 days after sending or 30 days after payment, whichever comes first. Documentation files, including copies of the letter, the first page and receipt photos, follow the same deletion deadlines. Delivery receipts from dao for registered letters are stored separately from the letter and deleted 90 days after we have forwarded them, and no later than 120 days after sending. The letter's fingerprint (hash), timestamps and documentation number are kept as order details without letter content. You can always ask us to delete your letter earlier through the contact form. After deletion we only have order details without the letter's content. Order and invoicing data are kept for 5 years from the end of the relevant financial year under the Danish Bookkeeping Act. Unpaid single orders and their files are deleted after 48 hours. Business drafts and their files and recipient lists are deleted after 30 days without updates. Shared letter content and the recipient list for a mailing are deleted when the content of all the mailing's letters has been deleted. Information used to protect against misuse is deleted after 24 hours. Technical event logs are kept as long as they are needed for troubleshooting, documentation and handling any disputes. If a letter sent with Postly as the sender comes back, we keep the physical letter for 30 days and then shred it.

Automatic categorisation of letters

Letters you order as a private person are categorised automatically by what kind of letter it is, for example a termination or a complaint. We use this for statistics. Before the text is analysed, we remove the sender's and recipient's names and addresses. Only the category is stored, never text from the letter. Letters from business customers are not categorised this way.

Recipients and data processors

Information is only shared when necessary for the order. We use suppliers for payment, hosting, operations and email. They only process information on our instructions and have the same data protection obligations as we do. Order emails to Postly's own inbox contain the sender's and recipient's names and addresses, but not the letter's content. Business customers can get a current list of sub-processors by writing to gustav@postly.dk, see also the data processing agreement (in Danish). Postly prints, envelopes and hands the letters to dao, the postal operator for physical letter delivery in Denmark. Personal data is stored within the EU/EEA. If a supplier exceptionally processes information outside the EU/EEA, this is done on a valid transfer basis, such as the European Commission's standard contractual clauses.

Cookies and browser storage

Postly does not use statistics cookies, marketing cookies or advertising pixels, so you do not see a cookie banner. When you fill in an order, your unfinished draft is stored temporarily in the browser's session storage, so the fields do not disappear when you reload. The selected file itself is not stored in the browser. The information is used only for this function and is cleared after a completed purchase or at the latest when the browser's session data is deleted. The administrator's login is stored locally in the administrator's browser and is necessary for protected access.

If you come to Postly through a referral link from one of our partners, we store an internal partner number in the browser's local storage for up to 30 days. It is used only to pay commission to the partner if you order a letter. We store neither your name nor your behaviour on other websites, and you can delete the information by clearing your browser data.

For our own visitor statistics we record which pages are viewed, which site you came from (domain only), any campaign parameters in the address, whether you use a phone or a computer, and how far you get in the order form. Nothing is stored in your browser, and the statistics contain neither your IP address, your email nor anything that can recognise you from one visit to the next. The statistics stay with us, are not shared and are deleted after 13 months.

Your rights

You have the right of access, rectification, erasure, restriction and data portability regarding your personal data. Contact us through the contact form to exercise your rights or to get a copy of the information about any transfers. We answer requests without undue delay and normally within one month. You can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.