Privacy & GDPR

Effective 16 May 2026. Last updated 16 May 2026.

1. Data controller

The data controller for the processing of personal data on this microsite is:

  • Particulair (sole proprietorship)
  • Højtoften 12, 2690 Karlslunde, Denmark
  • Danish CVR no. 34129894
  • Contact regarding privacy and GDPR: gdpr@particulair.com

Particulair is not required to appoint a Data Protection Officer (DPO). Thomas Lyngskjøld personally handles enquiries about data protection.

2. What personal data we process

We process the following categories of personal data about visitors to the Life Science Hub:

  • Information from the contact form and email enquiries: name, company, email address, phone number (optional), environment type (optional) and the content you write in your message.
  • Statistics via Google Analytics 4: an anonymous client pseudo-identifier (user_pseudo_id), a truncated IP address, browser and device type, language, referring URL, pages visited, timestamps, scroll depth and approximate geographic location at city/region level.
  • Google Ads conversion data: a click identifier (_gcl_au) and information about the defined conversion events: click on email link, click on phone link, contact page view and scroll depth.
  • Google Consent Mode v2 pings: when you have not given consent, Google Tag Manager sends anonymous, cookieless pings without a persistent identifier. These pings are used by Google for aggregate modelling and do not contain personally identifiable information.
  • Weply chat: if you open the chat window and write messages, Weply A/S processes your conversation on our behalf. The chat widget only loads after you give marketing consent.

We do not process special categories of personal data (GDPR Article 9), no data on criminal convictions or offences (Article 10) and no payment or accounting data on this site.

3. Purposes and legal basis

Each processing activity has an explicit purpose and an explicit legal basis:

  • Contact form and email correspondence. Purpose: to respond to your enquiry, send quotes and serve you as a potential or existing customer within pharma, cleanroom, OEB facilities, 3D printing and other life science segments. Legal basis: GDPR Article 6(1)(f) (legitimate interest). Our legitimate interest is being able to respond to a B2B professional who has reached out to us. See section 10 for our written legitimate interest assessment (LIA).
  • Google Analytics 4 (statistics). Purpose: to understand how visitors use the site and improve the content. Legal basis: GDPR Article 6(1)(a) (consent), obtained via our cookie banner (Statistics category).
  • Google Ads conversion tracking and remarketing. Purpose: to measure the effectiveness of our ads and optimise campaigns. Legal basis: GDPR Article 6(1)(a) (consent), obtained via the cookie banner (Marketing category). For a defined part of this processing, Particulair is a joint controller together with Google. See section 5.
  • Weply chat (Marketing). Purpose: to let you chat with us directly from the site. Legal basis: GDPR Article 6(1)(a) (consent, Marketing category). The content of the chat itself is processed on the basis of Article 6(1)(f) (legitimate interest) on the same grounds as the contact form.
  • Consent Mode v2 pings and consent cookie. Purpose: to record and respect your cookie choice and meet our documentation obligations. Legal basis: GDPR Article 6(1)(c) (legal obligation, read with the Danish cookie order) for the consent cookie itself, which is technically necessary and therefore exempt from the consent requirement.

4. Recipients and data processors

We do not share your personal data with third parties beyond the data processors and joint controllers needed to operate the site. The following parties process personal data on our behalf, or jointly with us and a third party:

  • Complitia.eu (CVR 43505130, Denmark) is the data processor for the setup and ongoing administration of Google Tag Manager, Google Analytics 4, Google Ads and Google Consent Mode v2 on our behalf. The processing is governed by a written data processing agreement based on the Danish Data Protection Agency’s standard contractual clauses under GDPR Article 28.
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the contracting party for Google Analytics 4, Google Tag Manager and Google Ads in the EU and EEA. Google Ireland acts as a sub-processor for Particulair via Complitia.eu.
  • Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is a sub-processor for the technical operation of the Google platforms. Transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework. See section 6.
  • Infomaniak Network SA (25 Eugène-Marziano, 1227 Les Acacias, Switzerland) is the data processor for hosting the site and for the email system. Switzerland is recognised by the European Commission through an adequacy decision, and data does not leave Swiss territory during normal operation.
  • Weply A/S (Denmark) is the data processor for chat conversations you start yourself via the chat window. Data is stored in Denmark and the EU.

5. Joint controllership for Google Ads conversion data

When you click on one of our Google ads and subsequently trigger a conversion event on the site (click on email link, click on phone link, contact page view, scroll depth), the conversion signal itself is processed jointly by Particulair and Google Ireland Limited. Both parties have a defined purpose for the data: Particulair wants to measure the effect of advertising, and Google wants to operate its advertising platform and provide services to other advertisers.

For this specific part of the processing there is therefore joint controllership under GDPR Article 26. The allocation of responsibilities follows Google’s Controller-Controller Data Protection Terms, which Particulair has accepted via the Google Ads management interface. The main points are:

  • Particulair is responsible for having a valid legal basis (your consent in the Marketing category) for sending conversion signals to Google.
  • Google Ireland is responsible for its own subsequent processing of the signal, including any internal Google purposes.
  • Both parties are required to respond to data subject requests. You may always send your request to Particulair at gdpr@particulair.com, and we forward or coordinate as needed.
  • You may withdraw your marketing consent at any time, and conversion tracking then ceases for your future visits.

The other processing in the Google stack (GTM, GA4 statistics, internal operation) is ordinary data processing under Article 28 and is described in section 4.

6. International transfers

Part of the personal data we process is transferred to the USA through Google LLC’s operation of Google Tag Manager, Google Analytics 4, Google Ads and Google Consent Mode v2. The transfer takes place on the basis of the EU-U.S. Data Privacy Framework (DPF), adopted by the European Commission on 10 July 2023 (implementing decision 2023/1795). Google LLC is actively certified under the DPF, and we verify the certification at least quarterly on dataprivacyframework.gov.

The General Court of the European Union upheld the DPF on 3 September 2025 in case T-553/23. The decision is currently under judicial review at the Court of Justice of the European Union, and a future ruling may affect the adequacy basis. Should the DPF be set aside or invalidated, we will suspend or move the processing to an EU-based alternative without delay.

Hosting with Infomaniak in Switzerland is covered by the European Commission’s own adequacy decision for Switzerland and requires no additional transfer safeguards. You may always request a copy of the relevant basis by writing to gdpr@particulair.com.

7. Retention

We do not retain personal data longer than necessary. The following periods apply by data category:

  • Contact form and email correspondence: until the matter is closed plus 1 year, after which the material is deleted. Accounting records that may contain personal data are retained for 5 years pursuant to the Danish Bookkeeping Act.
  • Google Analytics 4 event data: 14 months, after which client-level data is automatically deleted at Google. Aggregate report data remains available.
  • Google Ads conversion data: 13 months at Google for client-level data.
  • Weply chat logs: in accordance with our data processing agreement with Weply A/S and Weply’s own deletion procedure.
  • Consent Mode v2 pings: contain no persistent identifiers and are therefore out of scope for individual retention.
  • The consent cookie particulair-consent: 12 months from the last update, after which the banner is shown again and you can make a fresh choice.

8. Your rights

You have the following rights under GDPR Articles 15-21:

  • Access to the personal data we process about you (Article 15).
  • Rectification of inaccurate or incomplete data (Article 16).
  • Erasure of your data under defined conditions (Article 17).
  • Restriction of processing (Article 18).
  • Data portability for data processed on the basis of consent or a contract (Article 20).
  • Objection to processing based on legitimate interest (Article 21).

You can exercise your rights by writing to gdpr@particulair.com. We respond within one month of receipt and may, in complex cases, extend the deadline by a further two months.

An important practical limitation. Our statistics and advertising data from Google Analytics 4 and Google Ads are linked to a pseudonymous client identifier (user_pseudo_id) or a click identifier (_gcl_au). We cannot directly link these identifiers to you as a named person. For us to carry out access, erasure or data portability on your specific tracking data, we need you to provide your GA4 client_id or other concrete reference points. You can always end the processing for your future visits by withdrawing your consent (see "Withdrawing consent" in our cookie policy) and clearing your cookies in the browser.

9. Hosting and security

The site is hosted with Infomaniak Network SA with the servers located in Switzerland and within the EU. Infomaniak is ISO 27001-certified, and the hosting environment includes TLS-encrypted data transfer, encrypted storage and logical separation between customers. The infrastructure runs on 100% renewable energy, and the data centre in the Geneva region recycles its waste heat into the local district heating grid. We take regular backups of the site content and email data via Infomaniak’s own mechanisms.

Access to our systems is limited to people with a concrete job-related need and is protected by individual logins with multi-factor authentication.

10. Legitimate interest assessment (LIA) for the contact form

For the processing we carry out on the basis of GDPR Article 6(1)(f) (contact form and subsequent dialogue), we have performed a written legitimate interest assessment. It is informed by EDPB Guidelines 1/2024 and the CJEU ruling in case C-621/22 (4 October 2024).

  • Our interest. We have a real and present commercial interest in being able to respond to professional B2B enquiries about industrial vacuum technology for pharma, cleanroom, OEB facilities, 3D printing and other life science segments from visitors who have themselves reached out to us.
  • Necessity. To respond to the enquiry, it is necessary to process the data you provide (name, company, email, optionally phone and environment type, plus the message itself). No less intrusive alternative is available for the dialogue itself.
  • Balancing test. You initiated the contact and know its purpose. The dataset is minimised to fields strictly necessary. Phone and environment type are optional. The processing takes place in a B2B context and involves neither special categories of personal data nor automated decisions with legal effect. The retention period is limited to the closure of the matter plus 1 year. Overall, we conclude that your fundamental rights and freedoms are not overridden by our interest.
  • Your right to object. You may object to this processing at any time under Article 21. Write to gdpr@particulair.com, and we will consider the request individually.

11. Complaints and contact

If you have questions about how we process your personal data, or if you wish to exercise one of your rights, please write to gdpr@particulair.com.

You also have the right to lodge a complaint with the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, phone +45 33 19 32 00, datatilsynet.dk.

12. Changes to this policy

We update the policy when our processing changes or when new legislation or practice makes it relevant. Material changes are marked by a new "Last updated" date at the top of the page. For changes that affect your existing consent, we also show the cookie banner again so that you can make a new choice.

Particulair