EndWiz.comEndWiz Privacy Policy & GDPR Notice
Effective Date: November 1, 2026
Last Updated: November 1, 2026
At EndWiz ("we," "our," or "us"), we respect your privacy and are committed to protecting personal data in full compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This Privacy Policy outlines our data handling practices for our public website and connected cloud services.
1. Data Controller Details
For the purposes of the GDPR, the Data Controller for technical data collected on our websites and connected endpoints is:
- Legal Entity Name: EndWiz ApS (Update with actual entity name)
- CVR / Reg. No.: [Insert CVR Number]
- Address: [Insert Street Address, City, Denmark]
- Contact Email: [email protected]
2. Data Minimization & Self-Hosting Architecture
EndWiz is designed around strict data minimization and privacy by default:
- Zero Access to Customer Application Data: Because EndWiz is a self-hosted product, your operational data and user content remain exclusively on your own infrastructure. We cannot access, view, or store your application data.
- Connected Services Information: If you opt to use our connected features (such as AI capabilities, package mapping, or update checks), our endpoints process only the bare minimum payload required to fulfill the request along with your current EndWiz software version.
3. Infrastructure & Data Residency (EU-Hosted)
- Hosting Region: All EndWiz web services, APIs, licensing validation endpoints, and cloud infrastructure are hosted exclusively within Azure Denmark (European Economic Area).
- Private AI Infrastructure: Connected AI processing is executed privately on our dedicated, self-managed NVIDIA Blackwell-based server infrastructure located within the EU, ensuring complete isolation and performance.
4. AI Processing & Zero Data Retention (ZDR)
Our AI services operate under a strict Zero Data Retention (ZDR) policy:
- Data sent to our private AI infrastructure is processed in-memory solely to generate the immediate response.
- Inputs, outputs, and intermediate data are never stored, logged, or archived once the response is complete.
- Customer data is never used to train AI models or shared with third parties.
5. Lawful Basis of Processing, Cookies & Retention
We process limited technical data strictly necessary to deliver and secure our services under the following legal bases:
We process technical and operational personal data strictly necessary to deliver, manage, and secure our services under the following legal bases:
| Purpose | Data Processed | Legal Basis (GDPR) | Retention Period |
|---|---|---|---|
| Customer Portal User Management | User Principal Name (UPN), associated Tenant ID / Domain Name | Contractual Necessity (Art. 6(1)(b)) – managing customer access and subscription licenses | Stored for the duration of the active subscription |
| Deployment & Setup Logging | Tenant ID, Subscription ID, Resource Group ID/Name, Web App Name, Default Domain, App Registration ID, and deployment error logs | Legitimate Interest (Art. 6(1)(f)) – troubleshooting application deployment and startup issues | Stored securely in Denmark for up to 30 days (auto-purged) |
| Contact Form Inquiries | Name, email address, message contents | Legitimate Interest (Art. 6(1)(f)) / Pre-contractual steps (Art. 6(1)(b)) | Max 30 days (automatically deleted) |
| Session Management | Essential session cookies | Legitimate Interest (Art. 6(1)(f)) / Contract (Art. 6(1)(b)) | Cleared upon closing browser session |
| Security & Threat Prevention | Network IP address, request headers, traffic logs | Legitimate Interest (Art. 6(1)(f)) – protecting service integrity | 30 days (automatically purged) |
| Connected Services & Updates | App version, API payload | Contractual Necessity (Art. 6(1)(b)) | Processed transiently (in-memory only) |
We do not use tracking cookies, advertising trackers, or third-party behavioral analytics across our public web properties.
6. Contact Form & Communications
When you contact us using the contact form on our website:
- Privacy & Protection: The information you submit (such as your name, email address, and message content) is used strictly to process and respond to your inquiry. We never sell your information or share it with third parties for marketing purposes.
- Retention Period: Contact form submissions and associated communication logs are automatically and permanently deleted no later than 30 days after submission.
- Your Rights (Access & Erasure): You have the right to request access to or immediate deletion of your submitted contact data at any time by emailing [email protected].
7. Data Subject Rights Under GDPR
Under GDPR Articles 15–22, European Union data subjects have the following rights regarding personal data we process:
- Right of Access & Rectification: Request details or corrections to personal data held about you.
- Right to Erasure & Restriction: Request deletion or restriction of processing of your technical logs.
- Right to Object: Object to data processing based on Legitimate Interest.
- Right to Data Portability: Request a copy of your personal data in a structured, machine-readable format.
To exercise any of these rights, please submit your request to [email protected].
8. Right to Lodge a Complaint
If you believe our processing of your personal data infringes upon the GDPR, you have the legal right to lodge a complaint with a supervisory authority. In Denmark, the competent authority is:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
Website: www.datatilsynet.dk
9. Changes to This Policy
We reserve the right to modify this Privacy Policy to reflect updates in our services or legal requirements. Updated versions will be posted here with a revised effective date.
10. Contact Us
If you have any questions or concerns about our privacy practices, please contact us at:
- Email: [email protected]