Info-Center privacy policy
Last updated 18 October 2026.
Who we are
Info-Center ApS, CVR [CVR], [Adresse], e-mail [E-mail], is the data controller for the personal data described here: about our customers and about the people who use the administration of Info-Center and NoirCMS.
When we process data for our customers
What our customers put in or collect with our solutions – websites, members, forms, webshop orders, newsletter sign-ups, bookings and content on screens – we process as a data processor on the customer's behalf under a data processing agreement. There, the customer is the data controller. Read the customer's own privacy policy, for example on the customer's website.
Users of the administration
We store your name, your e-mail address, your password (only as a one-way hash that nobody can read), your two-factor authentication setup, your language, which customers and websites you have access to and with which role, and when you last signed in.
We use this to give you access and protect your account. The basis is the agreement with the customer you work for and our legitimate interest in a secure system (Article 6(1)(b) and (f)).
Your account exists for as long as it is used. The customer's owner can remove your access, and you can ask us to delete the account. Invitations are deleted a month after they were used or expired.
If you write to our support or send a feature request, we store what you write, your attachments and who wrote what when, so we can help (the agreement). Every user at the customer can see the customer's tickets. Tickets and requests are deleted 24 months after they were closed or answered.
Log of changes
When you change something in the administration, we store who, what and when, so the customer can see what happened and we can fix mistakes and investigate misuse (legitimate interest). Passwords, keys and visitors' personal data are not put in the log. The log is deleted after 24 months.
Our customers
About our customers we store the company name, CVR number, address, contact person, e-mail and phone, plus licences, purchases and invoices. We use them to deliver and invoice our services (the agreement) and keep accounting records for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.
E-mails
The system's e-mails – invitations, password resets and alerts – are sent through Scaleway. If an e-mail cannot be delivered, we store the recipient's address and the reason for 3 months, so we can fix the problem.
Log files and security
Our servers log requests – the time, the page address without query data, the response, the response time and your user id if you are signed in – to keep the system secure and find errors (legitimate interest). We do not store IP addresses in our own log files; the web server's error log may contain them. All log files are deleted after 31 days.
To slow down attempts to guess passwords, your IP address is used briefly in the server's memory without being stored.
Cookies
The administration uses only necessary cookies:
- noir.admin: keeps you signed in until you sign out or have been inactive for 12 hours (if you choose "Remember me", also when the browser is closed).
- Identity.TwoFactorRememberMe: remembers that you approved this browser with two-factor authentication, if you choose to (14 days).
- .AspNetCore.Antiforgery.*: protects forms against forged requests (until the browser is closed).
- .AspNetCore.Culture: remembers your language (1 year).
We use no cookies for statistics or marketing.
Screens (Info-Center)
Every minute, a screen sends technical information about itself: whether it is running, the app version, uptime, memory and disk space, and how many times content was shown. No information is collected about the people who look at the screen; the player uses neither camera nor microphone.
If the customer shows bookings or shifts, they come from the customer's own systems. Bookings are deleted 7 days after they ended, and private meetings are shown only as "Booked". Shifts from Planday and employees' names are not stored – they exist only in the server's memory while they are shown. Of the screenshots the customer asks for, only the latest is kept for each screen.
Who processes data for us
- One.com: our server with the database and files (in Denmark).
- Scaleway SAS, France: sends the system's e-mails.
- Curanet A/S, Denmark: domains and DNS, and mailboxes for the customers who have them with us.
We do not transfer personal data to countries outside the EU/EEA. When customers connect their own systems (for example Microsoft 365, Google, Mailchimp, Planday or a payment provider), that is under the customer's own agreement with them.
Backups and deleted data
The database is backed up every night and every hour. The copies are kept 7 days on the server and 30 days on our own backup device in Denmark, so deleted data is gone for good at the latest 30 days after it was deleted. Pictures, files, articles, pages, teams, websites and screen content a customer deletes can be restored for 30 days and are then removed for good.
Your rights
You have the right to see the data we hold about you and to have it corrected, deleted, restricted or handed over in a usable format. You can also object to our processing. Write to us at [E-mail].
You can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.