Last updated: 20 October 2026

This policy explains how Propstep ApS processes personal data in connection with Rotation. It covers rotationcrm.com, Rotation in the browser and the Rotation app for iOS and Android.

1. Data controller

Propstep ApS
Vesterbrogade 12, 1. th.
1620 København V
Denmark
CVR no. 39 12 11 66
support@rotationcrm.com

This policy applies when:

• you visit rotationcrm.com
• you are a Rotation user, in the browser or in the app
• you are a contact person at a customer or a prospective customer
• you subscribe to our newsletter
• you contact us about sales or support

2. When we process data on behalf of our customers

Rotation is used by landlords, property managers and letting agents to manage home seekers and tenants. Our customers register information about home seekers and tenants in Rotation, and we process that information as a data processor on the customer's behalf. The customer is the data controller, and the processing is governed by a data processing agreement. If you are a home seeker or tenant and want to exercise your rights, please contact the landlord you have been in contact with. This policy only covers the information for which Propstep is itself the data controller.

3. What information do we collect?

Visits to rotationcrm.com: Traffic data and, if you have accepted them in the cookie banner, statistics and marketing cookies. Read more in our cookie policy.

Rotation users (browser and app):

• Profile information: name, email, phone number, language and the company you are associated with
• Log and session data: login times, IP address, browser and actions in the system. We use these for operations, security and troubleshooting
• Calendar data, if you connect Google Calendar or Outlook yourself

Contact persons, leads and newsletter subscribers: name, email, phone number, company, job title and your correspondence with us.

4. The Rotation app for iOS and Android

The app is an optional supplement to Rotation in the browser. Only existing users can use it, and you cannot create an account in the app. When you use the app, we process the same information as in the browser, as well as:

• Device information: device model, operating system and version, app version and language
• Technical log data when the app communicates with our servers, including information about errors

The app contains no advertising tools, and we do not track you across other apps and websites. Data the app stores on your phone, such as your login session, is deleted when you log out or uninstall the app.

5. Purposes and legal basis

• Providing and operating Rotation, including the app, support, security and troubleshooting: performance of the agreement with the customer and our legitimate interest in providing the system to the customer's users (GDPR Art. 6(1)(b) and (f))
• Service messages about operations and new features: legitimate interest (Art. 6(1)(f))
• Sales and customer dialogue with contact persons: legitimate interest (Art. 6(1)(f))
• Newsletter and marketing: your consent (Art. 6(1)(a)), which you can withdraw at any time
• Statistics on the website: your consent (Art. 6(1)(a) and the Danish Cookie Order)
• Developing new functionality: legitimate interest (Art. 6(1)(f)), as far as possible based on aggregated or pseudonymised data
• Invoicing and bookkeeping: legal obligation (Art. 6(1)(c), the Danish Bookkeeping Act)

6. Retention and deletion

• User information is kept while your user account is active. If the customer closes your user account or the customer agreement ends, we delete or anonymise the information no later than 30 days afterwards.
• Log and error data are deleted after 90 days.
• Backups are overwritten on a rolling basis and no later than after 90 days.
• Newsletter data is kept until you unsubscribe.
• Invoicing and bookkeeping records are kept for 5 years from the end of the financial year.

Users are created and closed by the customer you work for. If you want your user account deleted, ask your administrator or write to support@rotationcrm.com.

7. How we protect your information

We store your personal data securely. We use encryption and standard security protocols, and only employees who need it for their work have access.

8. Sub-processors and transfers outside the EU

We use the following sub-processors to process personal data:

• Scaleway: database hosting in the EU
• Bunny.net: file hosting in the EU
• Postmark: sending system emails
• Cloudflare: CDN
• Stape: tag management in the EU
• PostHog: analytics
• HubSpot: CRM and email marketing
• Signicat: digital signatures
• Google Calendar and Microsoft Outlook: optional calendar integration

Some of these providers are US companies. Personal data is transferred to them on the basis of the EU-U.S. Data Privacy Framework, under which they are certified, or the European Commission's standard contractual clauses. PostHog data is hosted in the EU.

We do not share your personal data with others unless you have explicitly consented to it. If you have consented to being contacted by a specific party, we share your name, email and phone number with that party.

9. Your rights

You have the right to:

• access the information we hold about you
• have incorrect information corrected
• have your information deleted
• have the processing restricted
• receive your information in a commonly used, machine-readable format (data portability)
• object to processing based on our legitimate interest
• withdraw your consent at any time

Write to support@rotationcrm.com. We respond within one month.

10. Complaints

You can file a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk.

11. Changes

We update this policy when we change how we process personal data. The date at the top shows the latest change. We notify users of significant changes in Rotation or by email.