Privacy policy

Operator

BLXMP

CVR

43440489

Address

Hvidovrevej 92C, 2650, Hvidovre, Denmark

Contact

wmd@blxmp.dk

Privacy

wmd@blxmp.dk

1. Who this covers

This policy explains how BLXMP processes personal data in connection with Omnie Connect and the website e-conomic.omnie.dk. It is written in accordance with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

2. Our role

• Processor: data we read from a customer's e-conomic agreement is processed on the customer's behalf and under their instructions, as set out in our data processing agreement. The customer is the controller.
• Controller: we are controller for the limited data needed to run the connection and the website, described below.

3. What we process

Connection data (controller)

The e-conomic agreement number, company name, an encrypted e-conomic access grant, and the time the connection and consent were given. When you connect, e-conomic also returns the connecting user's name and email; we discard these and do not store them.

Accounting data (processor)

When a report runs, we read the data it needs from e-conomic, which may include:

• Company and agreement details (name, agreement number, base currency)
• Chart of accounts, accounting years, periods and booked entries
• Customers, suppliers, invoices and orders (as needed for the reports you request)
• Projects, project activities and time/cost entries (if you use project management)
• Departments and dimensions used for reporting

This can contain personal data such as names and contact details of your customers, suppliers and employees. The connector does not store this data. It is passed to the reporting workflow for the report being produced, which uses the AI providers listed in section 7 to analyse it and draft report text.

Technical data (controller)

Our hosting provider processes IP addresses and request metadata to deliver the site and protect it against abuse. We use only strictly necessary cookies: a session cookie (1 hour) and a connection-state cookie (15 minutes). We use no analytics, advertising or tracking cookies.

4. Purposes and legal bases

• Providing the Service and the reports agreed with the customer: performance of a contract (GDPR art. 6(1)(b)) and, for accounting data, the customer's instructions (art. 28).
• Securing the Service and preventing misuse: legitimate interest (art. 6(1)(f)).
• Complying with legal obligations, such as bookkeeping rules: legal obligation (art. 6(1)(c)).

5. Artificial intelligence

Reports are prepared with AI models from Anthropic, OpenAI and Mistral AI, accessed through their business APIs. The models analyse the data needed for a report and draft its text. Under those providers' API terms, data sent through the API is not used to train their models. We never use e-conomic data to train, fine-tune, adapt or optimise AI models, and we do not allow our sub-processors to do so. AI is not used to make decisions with legal or similarly significant effects on individuals.

6. Retention

• The encrypted access grant: until you disconnect or remove the app, and at the latest 30 days after our agreement with you ends.
• Accounting data: not stored by the connector. It is held only while a report is being produced. Reports delivered to you are kept as agreed with you.
• AI providers: may keep API requests and responses for a limited period for abuse monitoring (at most 30 days under their current terms) before deleting them.
• Hosting logs: as set by our hosting provider, generally a few days.

7. Recipients

We share personal data only with the sub-processors below, under data processing terms, and never sell it.

8. Transfers outside the EU/EEA

Stored data is kept in the EU. Where a sub-processor is established outside the EU/EEA, transfers rely on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

9. Security

• Read-only access: the service only issues HTTP GET requests to e-conomic and rejects any other method.
• No replica of customer data: accounting data is fetched on demand for each report and is not written to a database by the connector.
• Encryption in transit (TLS/HTTPS with HSTS) and at rest: e-conomic grant tokens are encrypted with AES-256-GCM, bound to their agreement number, with keys held as platform secrets outside the database.
• Data residency: the token database is restricted to Cloudflare's EU jurisdiction.
• Access control: the reporting workflow authenticates with a long random API key, compared in constant time; secrets are never logged.
• Browser protection: strict Content-Security-Policy, no third-party scripts, no tracking or analytics cookies, HttpOnly/Secure/SameSite cookies, CSRF protection on state-changing actions.
• Least privilege and minimisation: only the agreement number and company name are stored alongside the encrypted grant; user details returned by e-conomic are discarded.
• Incident handling: suspected breaches are investigated immediately and reported to the customer, and where applicable to Visma e-conomic, without undue delay.

10. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. For data we process on a customer's behalf, please contact that customer; we will assist them. To exercise your rights, contact wmd@blxmp.dk. You may also complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk.

11. Changes

We update this policy when our processing changes. The date at the top shows the latest version.