emplio

Privacy Policy

How Emplio processes personal data, in compliance with GDPR and Danish law.

Published: 11 October 2026 · version 2026-10-11-3

This privacy policy describes how Emplio ApS, Rugmarken 21, 2860 Søborg, Denmark, CVR no. 46460316 (“Emplio”, “we”, “our” or “us”), processes personal data when you visit emplio.io, create an account, contact us or are contacted by us. It also describes our role when a company uses Emplio to measure employee wellbeing.

1. Our roles

Emplio as controller. We are the controller of the data we process about visitors to emplio.io, about people who create an account or ask us to call them, and about contact persons at our customers. This covers our sales, customer administration, communication and marketing. The rest of this policy concerns this role unless stated otherwise.

Emplio as processor.When a company uses Emplio’s wellbeing application, the company is the controller of the data about its employees and their responses. Emplio processes it as a processor on the company’s behalf and only on its instructions. See section 3.

The role of our suppliers depends on the individual service. See section 4.

2. What we process, why and on what basis

Creating and administering an account.When you create an account, we process the company name and CVR number, your name, your email address, your phone number (if you provide it) and the size of the company. We look the company up in the Danish CVR register when you enter a CVR number. The purpose is to create the account, perform the agreement and send service emails, such as a confirmation of the registration. The basis is Article 6(1)(b) (performance of a contract) and otherwise point (f) (our and the customer’s interest in creating and administering a customer relationship). The data is necessary to create an account. The phone number is optional.

Documenting acceptance and consent. When you create an account or submit a call request, we store when and from which IP address and browser (user agent) the action took place, which version of the texts applied, whether you accepted the terms, and whether you had given consent to marketing cookies in Cookiebot at that time. The purpose is to be able to document what was accepted and to defend legal claims. The basis is Article 6(1)(f).

Call-back requests.When you fill in the form on our call-back page, we process the CVR number, the company name and number of employees from the CVR register, your name and phone number, the page you submitted from and any campaign parameters (utm) from the address. The request is sent as a message to Slack so that a colleague can call you, and it is stored in Emplio’s system. The purpose is to answer your request and contact you about Emplio. The basis is Article 6(1)(f) (our interest in answering business enquiries and selling to companies), and, to the extent you ask us to contact you before entering into an agreement, point (b). All fields are required to submit the form. The form has no marketing checkbox, and we do not sign you up for newsletters based on it.

Contact. When you write to us, for example at hi@emplio.io, we process your name, email address and the content of your message in order to reply. The basis is Article 6(1)(f). The contact form on the site opens your own email program. The data only reaches us when you send the email.

Operation, security and protection against misuse. When you use the website, our hosting provider processes technical data such as IP address, browser, the address you request and the time. The forms are protected against spam and misuse, for example with a hidden field and a measurement of how long the form takes to fill in. The basis is Article 6(1)(f) (our interest in a secure and stable website).

Statistics. We use Google Analytics 4 to understand how the website is used. This may include page views, device, browser, approximate location and cookie identifiers. The basis is your consent (Article 6(1)(a)) to statistics cookies.

Marketing and ad measurement.We use Google Tag Manager, Google Ads, Meta Pixel and the LinkedIn Insight Tag to measure the effect of our advertising. This may include visits and actions on the website, cookie and device identifiers and IP address. If you arrive from an ad, the address contains a click ID (gclid, gbraid, wbraid or fbclid). If you have given consent to marketing cookies, we keep the click IDs in your browser’s session storage and in a cookie for up to 90 days so that they can follow along when you create an account, and we store gclid, gbraid and wbraid with the account. Without consent, we do not store them. When you submit the call-back form or create an account, the event may be registered with Meta (“Lead” or “CompleteRegistration”). If you have given consent, a SHA-256 hash of your email address is placed in the website’s data layer (dataLayer) when an account is created, where Google Tag Manager can read it. What is passed on from there depends on how the tags are configured. The basis is your consent (Article 6(1)(a)) to marketing cookies.

Conversion measurement from our server to Meta and LinkedIn. If the account is created successfully and your browser reports at that moment that you have given consent to marketing cookies in Cookiebot, we may send a conversion event directly from our server to Meta and LinkedIn.

  • Meta (Conversions API)receives the event “CompleteRegistration”, an event ID, the time, the address of the page you created the account from, a SHA-256 hash of your email address, your IP address, your browser’s user agent and, if present, Meta’s cookie values (_fbp and _fbc).
  • LinkedIn (Conversions API) receives a conversion reference, an event ID, the time and a SHA-256 hash of your email address.

A hash is not anonymisation. The platforms can compare the hash with the hashes they hold for their own users and thereby recognise you if you have an account with them. The event is used to measure and optimise our advertising. The basis is your consent (Article 6(1)(a)). If the event is not sent, your account is not affected. You can withdraw your consent at any time, see section 8.

Newsletters and email marketing. We send newsletters and marketing emails to those who have given us consent, and otherwise only where the Danish Marketing Practices Act allows it. The consent is separate and can be withdrawn through the unsubscribe link in every email. We use Brevo for sending. The basis is Article 6(1)(a).

3. When Emplio is a processor for a company

Data processing agreement. Publication does not itself authorise AI processing or constitute an accepted agreement.

If you are an employee at a company that uses Emplio, your employer is the controller of the data processed about you in the wellbeing application. This may include name, work email, team, job title, other information your employer chooses to add and your responses.

  • The employer determines the purposes and means and must have a valid legal basis. This also applies if a survey may contain health data. The employer then needs a basis under both Article 6 and Article 9. The employer informs the employees about the processing.
  • Emplio processes the data only on the employer’s documented instructions and under the data processing agreement with the employer. We do not use it for our own marketing, advertising or sales.
  • If you want access to, or rectification, erasure or restriction of, data about you, or want to object, you should contact your employer. If you contact us, we forward the request to the employer.
  • e-studio ApS provides hosting of the application and sending of system emails, such as invitations, reminders and emails about access to the account. e-studio is our sub-contractor.

Free text and separately selected AI processing. Free-text fields are used for ordinary workplace wellbeing and management follow-up. We do not request health data or other special categories of personal data under GDPR Article 9, and the purpose does not include collecting or analysing such data or handling sensitive individual cases. On the employer’s separate documented instructions and fulfilment of Appendix D of the Data Processing Agreement, the entire dataset for the instructed report, including wellbeing figures, free-text responses and relevant, scoped report history, is processed automatically through Google Cloud/Vertex AI in the EU to generate suggested management, HR and employee reports. This does not include all employer data or the entire report archive. We do not carry out prior manual review of responses. OpenRouter is not involved. Creating an account or accepting the general terms does not activate AI processing.

System instructions and unintended data. Predefined system instructions require the model to summarise only overarching work-related themes and omit sensitive data, individual cases and identifying information from the final report. This is neither prescreening nor a guarantee of complete exclusion or anonymisation. Unintended sensitive data may therefore be processed in raw data and AI input even if absent from the report. Omission from the report does not delete raw data or supplier copies and does not itself provide a legal basis or an exception under Article 9. AI output requires human review and must not be used for automated decisions producing legal or similarly significant effects on employees.

Guidance and handling. Before responses are submitted, the employer must instruct respondents not to enter health data or other sensitive data and to omit names and other identifying details about themselves or others. Free text may also unintentionally contain criminal offence data. On becoming aware of specific data outside the instructions, we restrict further use, including export and AI, and our DPO coordinates clarification with the employer without undue delay. Rectification, restriction and deletion, including follow-up on reports and supplier copies, follow the employer’s lawful instructions and C.5–C.5.2 of the Data Processing Agreement. There is no guarantee of automatic detection of all sensitive data.

Identifiability and access. The absence of names does not guarantee anonymity. Invitations and participation are recorded, and technical links, teams, demographics, timestamps and free text may make individuals identifiable. Report and export access depends on user permissions and team scope; authorised Emplio personnel may have necessary administration and support access. All Emplio staff can technically open customer data when needed; access may only be used for necessary work and is subject to confidentiality. Comments are not routinely deleted or edited, but customer instructions and applicable erasure requirements are followed. Do not include names, diagnoses or other identifying or sensitive details in comments. Contact your employer about correction or deletion.

WHO-5 and health data. Planned use of WHO-5 requires separate clarification of instructions, legal grounds, access, retention and employee information. It is not automatically covered or activated by accepting the standard agreement. This policy supplements the employer’s specific information to employees.

4. Recipients and suppliers

We use the following suppliers. Where a supplier processes data on our behalf, this must take place under a data processing agreement. Where a supplier determines purposes and means itself, for example parts of ad measurement at Google, Meta and LinkedIn, the supplier is an independent or joint controller, depending on the service and the terms that apply.

  • e-studio ApS:hosting of Emplio’s wellbeing application and sending of system emails.
  • Vercel Inc.:hosting of emplio.io. Vercel processes technical request data and the data you enter in the forms while it passes through the website’s servers.
  • Slack: receives call-back requests as a message: name, phone number, company and CVR number, number of employees from the CVR register, the page you submitted from and any campaign.
  • Cookiebot (Usercentrics A/S): consent management. Cookiebot stores your choice and technical data so that the consent can be documented.
  • Google Cloud/Vertex AI: subprocessor for separately instructed AI analysis of application data. This is separate from Google services for website analytics and advertising. Review item: Google’s precise contracting entity, address and agreement coverage must be confirmed in Appendix B of the data processing agreement before activation.
  • Google (Tag Manager, Analytics 4 and Ads), Meta and LinkedIn: statistics and ad measurement as described in section 2.
  • Brevo: sending of newsletters and marketing emails.
  • The Danish Business Authority:when you enter a CVR number, our server sends the number to the CVR register to retrieve the company’s public information.

5. Transfers outside the EU/EEA

Google, Meta, LinkedIn, Slack and Vercel are, or are part of, US groups, so data may be processed in the US or other countries outside the EU/EEA. The basis for such a transfer is the individual supplier’s transfer mechanism under Chapter V of the GDPR, for example the adequacy decision for the EU-US Data Privacy Framework for certified recipients or the European Commission’s standard contractual clauses. Write to hi@emplio.io if you want to know which basis applies to a specific supplier, or to obtain a copy of the safeguards.

Google Cloud/Vertex AI calls are configured to use an EU endpoint. This alone does not establish where all support, logging or other processing takes place. Processing countries, any international transfers and safeguards must be documented in the data processing agreement before AI is activated. No undocumented Zero Data Retention guarantee is made.

6. Retention

  • Account and customer data: for as long as the customer relationship lasts. After that we keep it for as long as necessary to comply with legal requirements, for example the Danish Bookkeeping Act, which requires accounting records to be kept for five years after the end of the financial year, and to defend legal claims.
  • Documentation of acceptance and consent: for as long as we may need to document what was accepted, including after the customer relationship has ended.
  • Call-back requests, including the copy in Slack: for as long as the dialogue with you continues and you remain a relevant contact for us. If you ask us to delete them, we do, unless we need them to document an agreement or defend a legal claim.
  • Emails to us: for as long as necessary to answer and follow up on the enquiry.
  • Click IDs:only if you have given consent to marketing cookies. They are then kept in the browser’s session storage until you close the tab, and in a cookie for up to 90 days. A click ID stored with an account follows the retention of the account.
  • Cookies and consent choices: for the lifetime stated for each cookie in the cookie policy.
  • Newsletters: until you unsubscribe or withdraw your consent.
  • Events sent to Meta and LinkedIn: kept by them under their terms.
  • Employee data in the application: according to the employer’s instructions and the data processing agreement. Necessary scores, measurement history and ordinary free-text comments are retained during the active customer relationship without automatic age-based deletion. The employer reviews necessity at least annually, including the need for raw comments. Earlier deletion requirements and loss of necessity take precedence.
  • When the customer relationship ends: The customer may choose deletion or return followed by deletion. For return, the export is ready at planned termination, otherwise without undue delay and within 14 calendar days. The customer may retrieve it for six months after termination. Active copies are deleted within six months and all remaining backup copies within 12 months of the same termination date. These periods are not cumulative, and shorter backup rotations are not extended. Ordinary use and AI analysis stop at termination.
  • Other categories and specific deletion requests: The shorter periods in Appendix C of the data processing agreement apply to profiles, invitations, logs and temporary exports, among other categories. The termination periods above do not generally apply to Emplio’s own billing, sales or marketing records.

Data is deleted or anonymised when the purpose has been fulfilled and there is no longer a lawful basis to keep it.

7. Data security

We protect personal data with technical and organisational measures appropriate to the risk. This includes separation of customers’ data, access control and protection of passwords.

8. Your rights

  • Right of access to the data we process about you.
  • Right to rectification of inaccurate data.
  • Right to erasure (“right to be forgotten”) when conditions are met.
  • Right to restriction of processing.
  • Right to data portability when processing is based on consent or a contract.
  • Right to object to processing based on legitimate interests. You always have the right to object to processing for direct marketing, and we will then stop processing for that purpose.
  • Right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal. You can change your cookie consent in the cookie policy, and you can unsubscribe from newsletters through the link in the email.

Requests to exercise these rights can be sent to hi@emplio.io. If your request concerns data we process as a processor for your employer, we refer you to your employer.

9. Contact and Complaints

Emplio ApS
Rugmarken 21
2860 Søborg, Denmark
CVR: 46460316
Email: hi@emplio.io

If you believe that our processing of your personal data violates applicable laws, you may lodge a complaint with the Danish Data Protection Agency (Datatilsynet) at www.datatilsynet.dk.