Privacy policy

This policy explains what personal data Agerup processes, why, for how long, and what rights you have. It covers agerup.farm and the enquiries, bookings and events we handle through it.

Last updated 25 August 2026.

1. Data controller

• Agerup v/Frederik Reventlow
• CVR (Danish company number) 40755748
• Agerupvej 16, 4990 Sakskøbing, Denmark
• Email: frederik@agerup.farm
• Phone: +45 31 43 42 13

Agerup is a sole proprietorship. No data protection officer has been appointed, and none is required. Write to the address above — Frederik answers data protection enquiries himself.

2. What we process

When you send an enquiry through the website we process what you fill in yourself:

• Email (required)
• First and last name
• Phone number
• Preferred month for the event
• Expected number of guests
• Your message

Only the email address is required. Everything else is optional, and a blank field means we do not hold that detail.

When you become a customer we also process what a booking requires: the name and address on the invoice, agreed dates, which buildings are hired, guest numbers, and the correspondence between us.

When you reply to an invitation (RSVP) we process what the hosting couple asked for: your name, any dietary requirements or allergies, and whether you are staying overnight. Allergy and dietary information may amount to health data depending on the circumstances, and we process it solely to serve you the right food. It is shared with the hosting couple and the kitchen preparing the meal, and with nobody else.

When you visit the website we process what is described in the Cookie policy. We use no analytics tools and do not track you across sites.

3. Why, and on what legal basis

• To answer your enquiry and enter into an agreement. Legal basis: GDPR Article 6(1)(b) — processing is necessary to take steps at your request before entering into a contract, and subsequently to perform it.
• To meet bookkeeping obligations. Invoices and accounting records must be retained. Legal basis: Article 6(1)(c) — legal obligation under Danish bookkeeping law.
• To protect the forms against abuse. We filter out automated submissions on our own servers in Belgium. Legal basis: Article 6(1)(f) — our legitimate interest in not having the forms flooded with spam. No third-party service is loaded for this, and nothing about you is sent to anyone else.
• To run your event. Dietary information from the RSVP is processed so the food can be served. Legal basis: Article 6(1)(b), read with Article 9(2)(a) where the detail reveals health information — you provide it voluntarily and may leave the field blank.

We do not use your data for marketing, and we do not sell it.

4. Who we share it with

We use the following processors. All process data on our instructions under a data processing agreement.

Beyond this we disclose data only where legally required.

5. Transfers outside the EU

We have chosen providers and regions so that personal data is stored and processed in the EU. Form submissions go directly from your browser to our servers in Belgium and pass through no country outside the EU.

Until 24 August 2026 the website loaded Google reCAPTCHA Enterprise, which could send technical information about your browser to Google outside the EU. That service has been removed.

One exception remains, and it applies only to signing in — to the guest portal or the admin app. When anyone tries to sign in, two Firebase functions at Google check whether the email address has been invited to a booking or is on our admin list, then record the sign-in and set up your seating plan. Google can run them only in the United States — there is no EU region for this type of function. The address entered, the sign-in method, and your booking's name and date are therefore processed in the US at that point, including when the attempt is refused. A technical log line about the sign-in is written there too.

If you only use the website, your enquiry goes straight to our servers in Belgium. The page does read free dates through Google's Firestore API, which is a global Google endpoint — your IP address is visible to Google for that request. Images and fonts are served from bunny.net in the EU.

6. How long we keep it

• Enquiries that do not lead to a booking: deleted after 2 years.
• Bookings and the correspondence about them: kept for 3 years after the event, so we can answer questions and handle any claims.
• Invoices and accounting records: kept for 5 years from the end of the financial year they relate to, because Danish bookkeeping law requires it.
• RSVP responses, including dietary information: deleted no later than 3 months after the event.

7. Your rights

You have the right:

• to access the data we hold about you (Article 15)
• to have inaccurate data corrected (Article 16)
• to erasure once we no longer have grounds to keep it (Article 17)
• to restriction of processing (Article 18)
• to receive your data in a machine-readable format or have it transferred (Article 20)
• to object to processing based on our legitimate interest (Article 21)
• to withdraw consent where processing relies on it — this does not affect the lawfulness of processing before withdrawal

Write to frederik@agerup.farm. We reply within one month. Exercising your rights costs you nothing.

8. Complaints

If you are unhappy with how we handle your data, please write to us first. You also always have the right to complain to a supervisory authority. The competent one is the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. You may also contact the authority in your country of residence.

9. Changes

If we change this policy we update the date at the top. Material changes affecting a live booking are communicated directly to those concerned.