Privacy policy — Penneo

Cited by

Facts read from this source

• Entity Report an error

  “PENNEO A/S - Gærtorvet 1-5, DK-1799 København V - CVR: 35633766”

• No data sale Report an error

  “Penneo does not sell, trade, or otherwise attempt to monetise personal data that is processed through any of the processes mentioned in this privacy policy.”

• Cookie consent Report an error

  “Penneo will only set analytical and advertising cookies based on a website visitor’s consent.”

• Job application retention Report an error

  “Penneo will automatically delete job applications after 6 months unless the job applicant revokes consent earlier.”

• Whistleblowing directive Report an error

  “Penneo complies with EU’s whistleblowing directive (Directive (EU) 2019/1937)”

• User experience retention Report an error

  “The collected data is stored for 2 years.”

• AI chatbot support Report an error

  “An end-user may get assistance via an AI-powered chatbot for instant support, utilizing only the information available in Penneo’s Help Center.”

• Support retention Report an error

  “Penneo will automatically delete support requests after 2 years.”

• Archive aws EU Report an error

  “Recipient: Penneo production environment. Hosting provider: Amazon Web Service with data hosting in the EU.”

• Archive retention Report an error

  “Documents within the Archive will be retained until deleted by the End Users.”

• Platform products Report an error

  “Penneo processes personal data in the Platform for the use of Penneo Sign and Penneo Collect.”

• DPA available Report an error

  “The Agreement includes a data processing agreement that covers the use of the Platform by the Customer and its employees. Data Processing Agreement can be found here: https://penneo.com/terms/”

• Platform personal data Report an error

  “Penneo users and end-users: Name, email address, IP address”

• Platform optional data Report an error

  “Penneo users and end-users- optional depending on the signing method selected: Job title, phone number, electronic ID information, national identification number”

• Controller processor roles Report an error

  “The Customer assumes the role of data controller. Penneo assumes the role of data processor.”

• Archive controller exception Report an error

  “Penneo will assume the role as data controller In the cases where end-users have chosen to store signed documents in a personal archive.”

• Customer data deletion Report an error

  “Penneo will delete Customer’s data 90 days after the expiration of an Agreement with the Customer.”

• Security measures 2FA Report an error

  “Penneo ensures 2FA is activated on all systems that store any of the data, as described above, to prevent unauthorized access.”

• Certifications referenced Report an error

  “e.g. ISO 27001 certification, SOC 2 reports or similar.”

• External audit standards Report an error

  “Penneo engages an external auditor to conduct regular audits of Penneo’s Information Security and Privacy Management System, following best practices in accordance with ISO 27001 and ISO 27701 standards.”

• SSO access management Report an error

  “Penneo has implemented access management in Penneo’s joiner, mover, leaver processes and uses two factor authentication and single sign-on to further protect access to the systems used within the organisation.”

• Data centers EU Report an error

  “Customer data processed in the Platform is stored in data centers in the EU.”

• Daily backups Report an error

  “Penneo takes daily backups of storage and databases as part of its business continuity planning.”

• Disaster recovery testing Report an error

  “Penneo has a disaster recovery plan, tested at least annually”

• Encryption tls Report an error

  “The Customer’s data processed in the Platform is encrypted in transit using TLS 1.2 or higher and at rest.”

• Subprocessor annual review Report an error

  “At least once a year, Penneo will request and review relevant compliance documentation from the sub-processors.”

• Penetration testing Report an error

  “Penneo also engages external security penetration testers, at least annually, to test for vulnerabilities in the Platform.”

• Policy version Report an error

  “Version 1.9 2026-10-12”

7 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Data Protection Officer Signer identification
• The Data Protection Officer Evidence, validation & retention
• The Data Protection Officer European sovereignty
• The HR Operations Lead Signer identification
• The HR Operations Lead Evidence, validation & retention
• The HR Operations Lead European sovereignty
• The Integration Engineer Evidence, validation & retention
• The Integration Engineer European sovereignty
• The Legal Counsel Evidence, validation & retention
• The Legal Counsel European sovereignty
• The Revenue Operations Lead Evidence, validation & retention
• The Skeptic Signer identification
• The Skeptic Evidence, validation & retention
• The Skeptic European sovereignty