Privacy policy

This policy explains what information Vakano collects, why we do it, how long we keep it, and what rights you have. It applies when you visit the site, create an account, publish a listing, or send a booking request.

Last updated: 14 October 2026

1. Who is responsible for your information

Vakano is the data controller for the information processed on this site.

• Email: kontakt@vakano.dk

Questions about this policy or about your information are welcome at the address above. We normally reply within 30 days.

2. What information we process

We only collect what is necessary to run the service. That is information you give us yourself, and information that arises when you use the site.

When you create an account

• Name and email address — so we can contact you and show who is behind a listing.
• Password — is never stored as such, only as an encrypted hash (bcrypt). We cannot read it.
• Phone number — optional. Used if a guest or a host needs to be able to call.
• IP address — so we can stop abuse and detect if someone creates many accounts from the same address.

When you publish a listing as a host

• Information about the home: title, description, address, town, region, size, number of rooms, facilities and prices.
• Photos you upload yourself.
• Calendar and prices: which days the home is available or booked.
• Your contract details, if you fill them in: name or company name, address, phone, email and possibly CVR. They are used on the rental agreement the guest receives.

When you send a booking request or write to a host

• Name, email address and phone number.
• Arrival and departure dates, number of guests and which extra services you have chosen.
• The message you write and the subsequent conversation with the host.
• We compare your email address with previous confirmed bookings with the same host to show a welcome when you return. We do not create a separate profile or show details about previous stays; the purpose is personal service, and the processing is based on our legitimate interest.
• Offers to previous guests: Only when the host has enabled the feature, the host may send one offer for the same ISO week next year to a guest who has separately and voluntarily consented to offers from that specific host. The offer gives an extra 10% discount on the rental price, lasts 30 days, does not reserve the dates and does not create a booking. The email address is used to send it; offer and unsubscribe keys are stored only as hashes, and a link in the email can withdraw consent. Consent and offer information are deleted with the booking data 24 months after departure.

When you use the contact form, save homes or write a review

• The contact form: name, email, subject, the message itself and the IP address.
• Saved homes: which homes you have saved. Only you can see this.
• Reviews: name, rating and the text. The email address is only used to confirm that the review comes from a real guest.

When an administrator records an entry in the accounts

Administrators record the business income and expenses of the service. Each entry includes the date, description, type, amount and administrator email; a receipt may contain supplier information. Private files can only be downloaded by administrators. The purpose and legal basis is to meet bookkeeping requirements. Entries and any receipt are automatically deleted five years after the end of the financial year.

The accounts keep a change log: if an administrator corrects or cancels an entry, we store who did it, when, and what was changed (before and after). The log has the same retention period as the entry — five years after the end of the financial year — because it explains a figure that forms part of the accounts. An entry therefore cannot be deleted following a request for erasure; it is accounting material under the Danish Bookkeeping Act. The administrator’s email address, however, is removed from the entry and the log when the account is deleted.

Recurring expenses — rent, insurance, subscriptions — can be set up as a recurring expense with a name, an interval and a start date. The rule posts itself, and no email is sent per entry.

When you subscribe to the newsletter

• Your email address and the time of your consent, so we can send the monthly newsletter and document the subscription.
• The address is stored encrypted. A separate HMAC hash is used to find duplicates without storing a searchable address in plain text.
• Confirmation and unsubscribe links are stored only as hashes. Delivery status is stored to avoid repeated mailings.

Subscription is voluntary, and existing accounts are not subscribed automatically. The address is only activated once you confirm it. The newsletter contains available holiday home weeks and can be unsubscribed using the link in every email. Active subscriber information is kept until you unsubscribe; unconfirmed subscriptions are deleted after 30 days, and information about unsubscribed addresses and delivery history is deleted after 24 months.

When you create a price alert

• Your email address, your name — if you provide it — and which houses or areas you are watching. We also store the last price we saw, so we can determine whether the price has FALLEN. That is the entire purpose: we only send an email when something changes.
• We do not store what you have been looking at, and the alert does not tell the host that anyone is following the house.
• Confirmation and unsubscribe links are stored only as hashes — never in plain text.

A price alert is an ongoing notification. The legal basis is therefore your CONSENT (Article 6(1)(a) of the General Data Protection Regulation), and you can withdraw it at any time with one click in the email — without logging in. You can also create an alert without an account; the address is only activated once you confirm it through the link in the email. If the address is not confirmed, the alert is deleted after seven days. A cancelled alert is deleted after 24 months.

Technical information

• A session cookie, so you stay logged in. It contains a random id — not your personal data.
• IP address and time in our security log when someone logs in, creates an account, or an administrator changes something.
• When a technical error occurs, we store the error message, the shortened stack trace and which page it concerned, so the error can be found and fixed. Passwords, tokens and session IDs are removed before the error is stored. An error that repeats is stored as one line with a count — not as a thousand lines.

The list of recently viewed holiday homes is stored as a functional feature in your browser's local storage, at most six home ids at a time, and expires after 30 days. When the list is shown, the browser sends the ids to Vakano to fetch current information about public homes. The feature does not use third-party analytics or advertising. You can clear the list at any time from the "Recently viewed holiday homes" section, or delete your browser's local data.

We use no cookies for advertising, cross-site tracking or profiling. We do not sell information, and we do not pass it on to advertisers.

Travel time from your postcode

If you enter a postcode or a town in the "Travel time" field on a holiday home, it is stored only in your own browser — not with us. To calculate the distance, your browser sends it to our server, which passes it on to the map service OpenStreetMap Nominatim (and, if it does not respond, Photon) to look up the place. The map service sees our server's address, not yours, and the information is used only to find the coordinates. Neither your name, your email nor your address is sent.

The coordinate returned by the service is stored on the server together with the postcode, so it does not have to be looked up again for the next guest with the same postcode. It is a reference work on the geography of Denmark and cannot be traced back to you. We do not store your postcode, and so there is no deadline for deleting it either.

The distance is an estimate: the straight line between the two points multiplied by a fixed road factor and divided by an average speed. We do not use a routing service, and the figure is not a timetable.

Maintenance log and damage report with photos

• The maintenance log belongs to the HOUSE and not to a person: what work was carried out (roof, chimney, heat pump, oil boiler, woodwork), when, and how long may pass before it is due again. It contains no personal data, and the landlord deletes it himself.
• A photo you add to a maintenance entry may have a face or a number plate in the background. That is personal data, and the photos therefore have their own retention period in the table below.
• A damage report belongs to one booking: the guest's note and departure photos, and the landlord's note and arrival photos. The notes are your own words about the stay, and they may mention names, damage and amounts.
• The report and its photos can ONLY be seen by the landlord of the house, by the guest on the booking the report belongs to, and by an administrator. Another guest, another landlord or a random visitor is told "not found" — even if they guess the address.
• The photos are kept in a folder outside the website and are handed out only through a page that first verifies who you are. They are not shown to anyone else, and they are not used for marketing.

Saved replies and automatic replies

• As a host you can save a finished reply (a "template") and use it again in your conversations. The template belongs to YOU and not to an individual house, and it may contain a name, an agreement or an amount, because it was written as a reply to a guest.
• No other host can see or use your templates. Access is verified on every single lookup, and another host's template does not exist for you — not even if you guess its number.
• If you set an absence period with a text, a guest who writes to you during it gets one automatic reply straight away. The reply is marked as automatic in the conversation, so the guest can see that it was not you who read the message. The guest gets only one reply per period, no matter how many times she writes.
• The legal basis is contract (Article 6(1)(b)): both exist in order to reply to the guest. A template you have not used for three years is deleted automatically, and the absence period with its text is deleted one year after the holiday ends. If you delete your account, both disappear immediately.
• The automatic reply is the host's own text. We do not read it through and we do not use it for anything else — it is sent only to the guest who wrote first.

Area guide written by the host

• An area guide is the host's own text about the area the house is in: where to eat, where the beach is, what to do when it rains, and what else you should know. The text is public once it has been approved.
• The guide may not contain personal data about others: no neighbours' names, no private addresses, no number plates, no phone numbers and no children's names. The rule is stated in the form, and the host confirms it when submitting the guide.
• The guide is invisible to everyone until an administrator has read and approved it. If the host edits the title or the text afterwards, the guide must be reviewed again — until then it is not shown.
• If you are mentioned in a guide and want it removed, you can write to us. We take the guide out of the display immediately, and you have the right to access (Article 15), rectification (Article 16) and erasure (Article 17) of what is written about you.
• The legal basis is legitimate interest (Article 6(1)(f)): a guest must be able to find out what is nearby, and a host must be able to tell it in his own words. The editorial review is our balancing against your interests — nothing is public until a human being has read it.

The chat on the home page

• You can write directly to the host who owns the home without creating an account. If you write without being logged in, we ask for your name and email address, because the host must be able to reply to you — and because it is the only way we can give you access to your own conversation again.
• If you are logged in, we take your name and email address from your account, and you cannot change those fields through the chat. If you edit them anyway, the change is stored only on the conversation — your account is not changed behind your back.
• If you have a case number or a booking number, you can enter it in the field. Your message is then placed in the case that number belongs to, instead of a new one being created. The field is optional.
• The case number is a reference, not a key. You are welcome to read it out over the phone or pass it on — but on its own it does not give access to the conversation. You get access through a personal link that we send to the address you provided. The link is random, is stored only as a hash on our side, expires after 30 days, and a guessed or foreign link returns "not found" — it does not reveal whether the case exists.
• The host can see whether you are in the panel right now — and you can see whether she is. She is shown as online only when she has HERSELF marked herself available in the panel and has also been active recently. It is a single timestamp and a single flag, overwritten on every activity: we keep no history of when anyone was on, no IP address, no device and no page view. If the host is not active, she gets one email saying there is something new; no email is sent per message.
• The legal basis is contract (Article 6(1)(b)): the information exists so that we can reply to you and enter into the agreement the enquiry concerns. The access link and the timestamp also rest on legitimate interest (point (f)): without the link you could not return to your own conversation without an account, and without the timestamp the host would get an email while sitting in front of the screen.
• We do not store the IP address together with the conversation, and we do not use the chat to track you. The counters that stop abuse are the same as those of the contact form, and they are cleared after 24 hours.
• If you want your conversation deleted, you can write to us. See section 7 about your rights.

When you write to Vakano (support)

• If you write to us in the chat without an account, we ask for your name and email address so we can reply to you — and for an earlier case number, if you have one. The enquiry is stored as a conversation, and it can be found again by the number and the address it was sent from.
• If you look up a case number, we require BOTH the number and the address belonging to the case — or the access you already have from a booking. A number alone does not give access: the numbers are sequential and can be guessed, and a guessed number must not become a key to someone else's conversation.
• Once a conversation has ended, its history is no longer shown in your chat — you start a new one. It is NOT deleted: our staff can read it, and you can request a copy by writing to us (right of access, Article 15). See section 7.
• Our own staff can see earlier enquiries, bookings and conversations linked to your email address when they need to reply to you. The look-up is not stored with your address in clear text.
• The legal basis is contract (Article 6(1)(b)): the information exists so that we can reply to you. The look-up by number and address is additionally based on legitimate interest (point (f)): without it, you could not find your own case again without an account.

Filtering of the chat — and what we record

• Messages in the chat are filtered before they are stored. Phone numbers, email addresses, account numbers, IBANs, card numbers and payment requests are removed automatically and replaced by a notice that both the sender and the recipient can see.
• We do not store the number, address or account number that was written. It appears neither in the message, in the log, nor in an email.
• We record the attempt: what kind of information it was, when, which conversation, and a short pseudonymous trace (an HMAC). The trace makes it possible to see that the same information has been sent several times, without the information being readable. It is personal data, and it therefore has a retention period — see the table in section 4.
• The number of attempts is stored on your account together with the time of the most recent one. After 3 attempts the account is marked, and our administrators can see it. After 5 attempts the account is blocked from booking and from writing in the chat — not from logging in: you can still search and view holiday homes and reach your own details and bookings.
• The count and the block have no expiry date. They remain until an administrator opens the account again. If you change your mind, or believe it is a mistake, you can contact us — we will reply, and an administrator can lift the block.
• The legal basis is legitimate interest (Article 6(1)(f)): preventing fraud where payment is moved outside the platform. The balancing test is that we store neither the content nor the IP address, that the trace cannot be read, and that the block can be lifted by a person.

The welcome email when you create an account

• When you create an account as a guest, we send one email explaining how the site works without payment, what a booking number is, and how to get in touch with the host. It is information about the service you have just created an account for — not a newsletter, and it contains no offers or discounts.
• We send it once per account. A UNIQUE index in the database keeps track of that, not a to-do list: the row is written before the email is sent, so a repeat is not possible.
• You can say no thanks with one click in the email. It does not require you to log in, and it costs nothing. If you say no, we send you no welcome email — and we record that you said no, so that we do not start again.
• The legal basis is legitimate interest (Article 6(1)(f)): without the email you would have to write to us to find out whether payment is made through the site. The balancing test comes out in your favour, because you have just created the account and because you can object with one click (Article 21).
• We do not store the text of the email or a copy of your information: the row says only when the email was sent, to which address, and whether you said no. It disappears with your account and is also cleared automatically after the period stated in the table below. An unsubscription is not cleared — a no thanks must not expire on its own.

Local partners

• On /partnere we may show agreements with local businesses — bicycles, rowing boats, fishing licences, riding or a guide — with a discount for you who rent a holiday home through us.
• These are agreements and not recommendations, and each one therefore states what you get and what Vakano gets out of the agreement. If the agreement is an advertisement, it is labelled as one too.
• We pass on NO information about you to a partner — not your name, not your email and not your dates. You contact the partner yourself through the contact details stated in the agreement. There is therefore no data processing agreement with the partners, because nothing is transferred to process.
• The agreements are not public until an administrator has approved them, and a change requires a new review. We cannot guarantee the discount a partner offers: it is the partner's service, and the partner is liable for it.
• An agreement concerns a business. If the partner is a sole trader, the name may be a person's name; we treat that as personal data on the basis of legitimate interest (Article 6(1)(f)). The agreement remains for as long as it runs and is removed when it ends.

The 48-hour reply deadline, reply statistics and cancellations

• If a host does not reply to a booking enquiry within 48 hours, the enquiry is cancelled automatically and the dates are released again. Both the host and the guest are notified. The new status on the booking is "expired" and not "cancelled", so the course of events can still be read afterwards.
• We measure how many of a home's enquiries are answered within those 48 hours. The figure is shown on the home's page once there have been at least three enquiries in the last 12 months, and it disappears by itself as the old ones roll out of the period. The host can always see their own figure in their dashboard.
• We also count cancellations: two cancellations within 30 days produce a label for both parties — the host's is shown on the home's page, and the guest's is shown only to the host she contacts. There is no public guest profile. A DECLINED enquiry is not a cancellation and does not count.
• Both figures are factual measurements and not a judgement of a person: they read "Replies to 2 of 5 enquiries" and "Has cancelled 2 bookings within the last month", never a rating or a word about what someone is like. You can assess a measured figure yourself; a judgement would take that position away from you.
• If you have set an absence period, the hours in it do not count towards the 48 — the deadline is extended while you are away. You should not get poor statistics for deliberately taking a holiday.
• The legal basis is legitimate interest (Article 6(1)(f)): a guest must be able to see how likely a reply is before she commits a week, and the other party must be able to see a pattern of cancellations before doing the same. The records contain no reason, no free-text field and no copy of the agreement, and they are deleted on the deadline shown in the table below. You may object under Article 21 — see section 7.

3. Why we are allowed to process it

Under the General Data Protection Regulation, all processing must have a legal basis. It is:

• Contract (Article 6(1)(b)): so we can create your account, show your listing and put guest and host in touch when you ask us to.
• Legitimate interest (point (f)): to keep the site secure and free from abuse, to be able to answer enquiries and to improve the service. We always weigh your interests against ours. This also covers the landlord role: an account that has been a landlord for 30 days without publishing a holiday home reverts to guest, and the home — if there is one — is put on hold instead of being deleted. You can become a landlord again with one click, and nothing of your content disappears.
• Consent (point (a)): for example when you subscribe to the newsletter yourself or write a review. You can withdraw your consent to the newsletter using the unsubscribe link in every email.
• Legal obligation (point (c)): where the law requires us to store or disclose something.

4. How long we keep it — and that it happens automatically

We do not keep personal data longer than we need it (Article 5(1)(e) of the General Data Protection Regulation). The retention periods below are enforced automatically: a scheduled job on the server reviews the information several times a day and deletes or clears whatever is too old. So it does not depend on anyone remembering it.

The periods are the same ones the cleanup uses. Last run: 2026-10-22 14:49:48.

About deletion: An account that has been created but whose email was never confirmed is deleted automatically — unless a home has been created, a booking sent or a message written from it. In that case it is in use, and it is not deleted without further ado.

If you want your information deleted earlier, you can always write to us. See section 7.

5. Who we share information with

• The host, when you send a booking request. That is the whole point of the service: the host must be able to reply to you. That is why your contact details and dates accompany the request — and appear on the rental agreement you receive.
• Our data processors, who process the information solely on our instructions: the web host that runs the site, and the email provider that sends our emails. They are not entitled to use the information for anything themselves.
• The map service (OpenStreetMap Nominatim and Photon): when you use "Travel time", your postcode or town is sent to them to look up the place. They see our server's address — not yours — and receive no other information about you.
• Authorities, if we are legally obliged to disclose something.

We do not sell personal data, and we do not pass it on to third parties for marketing.

6. Transfer to countries outside the EU/EEA

Your information is processed and stored within the EU/EEA. We do not transfer it to countries outside the EU/EEA. Should that ever become necessary, it would only happen with a valid transfer basis (for example the European Commission's standard contractual clauses), and this policy would be updated first.

7. Your rights

Under the General Data Protection Regulation, you have the right to:

• Get access — see what information we hold about you, and get a copy.
• Get it corrected information that is wrong or incomplete. You can do this yourself under My account.
• Get it erased information we no longer need. If you delete your account, your information disappears — though not bookings and agreements that the other party or the law requires us to keep for a period.
• Get it restricted the processing while a case is being investigated.
• Object to processing based on our legitimate interest.
• Receive a copy of your information in a common, machine-readable format (data portability).
• Complain to the Danish Data Protection Agency (Datatilsynet) if you believe we process your information incorrectly: datatilsynet.dk.

Write to kontakt@vakano.dk to exercise one of these rights. We normally reply within 30 days. You do not have to give a reason for your request, and it costs nothing.

8. Cookies

We only use cookies that are necessary for the site to work:

• Session cookie — keeps you logged in while you use the site. Without it you cannot log in or send a booking. It expires automatically.
• CSRF token — a security measure that prevents another site from submitting forms in your name.

There are no cookies for statistics, advertising or cross-site tracking. The visitor figures are cookie-free, and your IP address is not stored. You can delete cookies in your browser at any time — you will then be logged out. The list of recently viewed homes uses your browser's local storage, not cookies; see the section on technical information above.

We count page views per day, route and country — without cookies, without a stored IP address and without following you from page to page. Your IP address is used only at the moment the page is shown, to determine whether the visit is new today; after that it is discarded. What is stored is a short hash together with a salt that is changed every day — and that makes the hash useless afterwards. If your browser honours "Do Not Track" or "Global Privacy Control", the visit is not counted at all.

9. Security

• All traffic to and from the site is encrypted with HTTPS.
• Passwords are stored as encrypted hashes (bcrypt) — never in clear text.
• Access to the administration panel requires an account with the administrator role, and all changes are written to a log.
• Forms are protected against CSRF, and all input is validated and escaped so that it cannot be used to inject code.
• Backups of the database are taken, so that information can be restored after an error.

We cannot guarantee that the internet is 100 % secure. If you notice anything suspicious, please write to us straight away.

10. Children

The service is for people over the age of 18. We do not knowingly collect information about children. If you are under 18, you must not create an account. If we discover that an account belongs to a minor, it is deleted.

11. Vakano is an intermediary — not a party to the rental agreement

Vakano puts guests and hosts in touch with each other. The rental agreement is entered into directly between them, and payment takes place directly between them. We charge no payment and are not liable for the stay. That also means that the host is the data controller for their own processing of the information you send in a request — for example if the host uses it for their own bookkeeping.

12. Changes to this policy

We may update the policy if the rules change, or if we start processing information in a new way. The date at the top shows when it was last revised. We will tell you about changes that matter to you on the site or by email.

13. Contact

If you have questions about how we process your information, you are always welcome to write to kontakt@vakano.dk. You can also use the contact form.