How e-thomsen ApS processes personal data from public company registers, and data about the readers who have access to the register on e-lab.dk. Last updated 27 October 2026.
e-thomsen ApS, CVR 38642812, Denmark, is the data controller. Contact: jesper@e-thomsen.dk.
We do not process national identity numbers, addresses, contact details or any special categories of personal data. We do not collect data from the people concerned and do not contact them on the basis of this data.
The purpose is research and analysis of board composition, tenure and renewal in the largest Danish and Norwegian companies, presented to a restricted group of readers and used in our advisory work. The analysis is made at board and company level. We do not score, rank or profile individuals, and the data is not used for marketing.
The legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in analysing information that the law requires companies to make public. We have assessed that this interest is not overridden by the interests of the people concerned, because the data is already public, limited to professional roles, and used at board level.
The analysis is published on a password-protected part of e-lab.dk, which is operated by e-thomsen ApS, for invited readers. Each reader sees only the parts of the register they have been given access to. Both sites are hosted by Simply.com in the EU. We do not sell or otherwise pass on the data.
We keep role data for as long as a company is in the analysis and for up to ten years of history, which the analysis of renewal patterns requires. Data on a company that leaves the analysis is deleted at the next annual review. Data subject to a justified objection is removed within 30 days.
When we give someone access to the register on e-lab.dk, we process the following about that reader.
The purpose is to give each reader access to what they have agreed to, to stop access when it ends, and to see how the register is used so it can be improved. The legal basis is the agreement with the reader or their organisation (Article 6(1)(b) of the GDPR) and our legitimate interest in running and securing the service (Article 6(1)(f)).
Reader data is kept while the reader has access and for twelve months after access ends, then deleted. Visit records are deleted after twelve months. The hosting provider also keeps short-lived technical server logs, including IP addresses, for security and operation.
Whether you appear in the register or read it, you have the right to access the data we hold about you, to have it corrected, to object to the processing and to ask for it to be deleted. Corrections to the underlying records must be made in the public registers, and we will update our copy when they are. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or, for Norwegian data, to the Norwegian Data Protection Authority (datatilsynet.no).
Danish data: the Central Business Register (CVR) and annual reports published by the Danish Business Authority. Norwegian data: the Brønnøysund Register Centre, used under the Norwegian Licence for Open Government Data (NLOD 2.0).