Legal
Privacy Policy
This Privacy Policy describes how The Creative Company ApS ("Casan", "we", "us") processes personal data when you visit our website, create an account, or use the Casan platform for property management.
The Creative Company ApS — CVR 44404974 · 14 July 2026
1. Data controller
The Creative Company ApS (CVR 44404974) is the data controller for the processing of personal data relating to our customers, users, and visitors to https://casan.co, unless otherwise stated in a separate data processing agreement.
Privacy contact: fpa@casan.co.
2. Who this policy applies to
This policy applies to landlords, property managers, employees, and other users who create an account or use Casan. It also applies to visitors to our marketing website.
When you, as a customer, enter information about tenants, applicants, contractors, or other third parties in Casan, you are generally the data controller for that information. Casan processes it on your behalf as a data processor in accordance with our Data Processing Agreement.
3. What information we process
Account and contact details: name, email address, password (encrypted), organisation and role information, MFA settings, and support enquiries.
Company and portfolio data: company name, CVR number, billing address, property addresses, units, tenancies, and related documents.
Tenant and tenancy data: name, contact details, lease relationships, rent, deposit, contract data, move-in/move-out inspection reports, photos, signatures, and communications via Casan.
Financial data: payment overviews, transactions, invoices, bank connections via integrated services (e.g. Plaid), Betalingsservice details, and in some cases CPR numbers in encrypted form where required for statutory payment services.
Operations and communications data: maintenance tasks, calendar appointments, email threads via Casan addresses, AI assistant queries, and technical log data.
Technical data: IP address, browser type, device information, session data, and security logs.
4. Purposes and legal basis
We process personal data to provide and operate the Casan platform, including portfolio management, lease contracts (Typeformular A), move-in/move-out inspections, finance, operations, communications, and integrations.
We also process data for customer support, security, troubleshooting, product improvement, legal compliance, and subscription administration.
The legal basis is typically performance of a contract (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f)), including secure operation and abuse prevention, and in some cases consent or legal obligation (Art. 6(1)(a) and (c)).
5. Data processors and third parties
We use trusted suppliers for hosting, authentication, storage, email, mapping, bank integration, accounting, payment services, and AI assistance. These include Supabase, Microsoft Azure, Plaid, Visma e-conomic, Betalingsservice, Mapbox, Mailgun, and Stripe.
These parties may only process personal data on our instructions and under data processing agreements. We do not sell personal data or use it for cross-site advertising.
6. Transfers to third countries
We aim to store personal data within the EU/EEA. If data is transferred outside the EU/EEA, this is done only with appropriate safeguards, such as the EU Commission's Standard Contractual Clauses or equivalent lawful transfer mechanisms.
7. Retention
We retain personal data for as long as you have an active account or organisation with Casan, and thereafter for the period necessary to comply with legal requirements, enforce agreements, or document transactions.
You may request deletion of your account where technically and contractually possible. Backups may retain data for a limited period after deletion.
8. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to processing where provided under the GDPR.
Where processing is based on consent, you may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we process your information in breach of applicable law.
9. Security
We implement technical and organisational security measures, including access control, encryption in transit, role-based access, logging, and ongoing monitoring.
Access to customer data is limited to authorised personnel and systems with a legitimate need.
11. Changes
We may update this Privacy Policy when our services, legislation, or data processing practices change. Material changes will be communicated via the website or directly to registered users where relevant.