Legal Changelog

Paid plans start straight away. Terms of Service §3.1 said that if a consumer did not make the express request at checkout, we would not start the paid service until the 14-day withdrawal period had expired. Checkout does not offer that option: we offer Paid Plans to consumers only with immediate start, and a consumer who does not want the paid service to begin within the withdrawal period can keep using the free plan and buy later. §3.1 now says so. The right of withdrawal is unchanged: a consumer can still withdraw within 14 days and pays only the proportionate amount, and if we ever begin the paid service without the express request and the consumer withdraws, the consumer is entitled to a full refund without deduction.

Documents updated:

• Terms of Service · Vilkår for brug (§3.1; version 1.15)

A new section on demo links. We may send a private link to a demo of PennaSystems to a business that asked to see it. Privacy Policy §3 now says what happens to anything typed into a demo (it is never sent to anyone and is erased automatically 24 hours after the demo was opened), what we record about how a demo was used and why, how long that summary is kept, and our legal basis. Nothing changes for existing accounts.

Documents updated:

• Privacy Policy · Privatlivspolitik (§3; version 1.12)

How long we keep encrypted backups. Privacy Policy §7 said that we keep encrypted off-site backups of the platform database for about five years. That understated the period. Each backup is kept until the end of the sixth calendar year after it is taken, which is up to about seven years: the Danish Bookkeeping Act (Bogføringsloven) requires us to keep our own bookkeeping records for five years from the end of the financial year they concern, and that period is counted from the end of a financial year, not from the day of the backup. §7 now states the real period. How long backups are kept has not changed, only the description.

Checkout consent for consumers. When a consumer asks us to start a paid plan before the 14-day withdrawal period ends, the confirmation step now also asks them to acknowledge that once the contract has been fully performed by us, they will no longer have the right of withdrawal, as the Danish Consumer Contracts Act requires (Forbrugeraftaleloven § 13 stk. 3). Terms of Service §3.1 says the same, and adds that a Paid Plan runs for a month or a year, so it is not fully performed within the 14 days and the right of withdrawal lasts for the whole period. No right was removed.

Documents updated:

• Privacy Policy · Privatlivspolitik (§7; version 1.11)
• Terms of Service · Vilkår for brug (§3.1; version 1.14)

Norwegian accounting material. A new Terms of Service §7.2 applies to users who are bokføringspliktig in Norway. Norwegian law lets them keep their electronic accounting material outside Norway, provided it stays readable and printable in Norway and they notify their tax office in writing (bokføringsforskriften § 7-5). §7.2 says where we store that material: the database in the Netherlands, and issued invoice PDFs, uploaded files and our encrypted backups in the European Union. It adds three commitments: the user can read, print and download the material from Norway at any time; when the user asks us, or when the Norwegian Tax Administration (Skatteetaten) asks us in a control that concerns the user’s accounts, we make the material available without undue delay, once we have verified the request, and we tell the user about the request unless the law forbids it; and we give at least 30 days’ notice before we move this storage to another country. §7.2 also says what the user can name in the notice to the tax office, and that we are not the user’s archive: keeping the records for the period Norwegian bookkeeping law requires remains the user’s responsibility. Nothing changes for users outside Norway.

This entry was added on 20 October 2026; it was missing when the change was published.

Documents updated:

• Terms of Service · Vilkår for brug (§7.2; version 1.13)

An online withdrawal function for consumers. Consumers can now withdraw from a paid plan with the »Withdraw from contract here« button in their account (Settings → Plan & billing), as the Danish Consumer Contracts Act requires since 19 June 2026 (§ 20 a). Terms of Service §3.1, the model withdrawal form and the order confirmation e-mail now say where the function is, and that we send a receipt by e-mail with the content of the withdrawal and the date and time it was sent. Withdrawing by e-mail or with the model withdrawal form works as before.

When the withdrawal period starts and ends. §3.1, the model withdrawal form and the order confirmation e-mail now state when the 14-day period runs. It runs from the day the contract was concluded, or from the day the order confirmation reached the consumer by e-mail if that was later, and ends at the end of the 14th day after that day (Danish time), or at the end of the next working day if that day is a Saturday, a Sunday, a public holiday, Constitution Day, 24 December or 31 December.

No VAT is added to our prices. PennaSystems is not registered for VAT. §5 said that prices shown to consumers include VAT and that VAT is added for business customers at checkout. It now says that no VAT is added, so the price shown before checkout is the total price, for consumers and businesses alike. The pricing pages and the order confirmation e-mail say the same.

No refunds for part of a billing period: business customers only. Terms of Service §5 said that no refunds are issued for partial billing periods, without saying that this rule does not apply to consumers. It now applies to business customers only, and §5 says what applies to consumers: §3.1 during the withdrawal period, and after it, cancellation under Forbrugeraftaleloven §28 with a refund of any prepaid part of the term after the cancellation takes effect. This describes how cancellation already works for consumers; no right was removed.

Documents updated:

• Terms of Service · Vilkår for brug (§3.1, §5; version 1.12)
• Model withdrawal form · Standardfortrydelsesformular (version 1.9)

Inactive accounts. Privacy Policy §7 said that when we close an inactive account, bookkeeping records under the Danish Bookkeeping Act (Bogføringsloven § 12) “are retained for their full mandated period”. That contradicted the rest of §7: your invoices and other records are deleted 30 days after your account is deleted, and keeping them for the period the Act requires is your responsibility as data controller. §7 now says so, and says that an inactive account is closed through the same deletion process.

Our data processing agreement. Terms §7 said we delete or return your data at the end of the service “subject to retention obligations under Danish or EU law (notably the 5-year retention under Bogføringsloven § 12)”. That read as if we keep your bookkeeping records for you. We do not. §7 now says that keeping your own bookkeeping records for the § 12 period is your responsibility, as §9 already said.

Not a registered bookkeeping system. Terms §2 listed “Provide registered bookkeeping under Bogføringsloven (yet)” among the things the service does not do. “Yet” suggested a plan to register; there is none, so the word is gone.

This corrects the wording; how we handle your data has not changed.

Documents updated:

• Privacy Policy · Privatlivspolitik (§7; version 1.10)
• Terms of Service · Vilkår for brug (§2, §7; version 1.11)

Our address on the withdrawal form was wrong. The model withdrawal form, and the confirmation email we send to consumers who buy a paid plan, gave our address as Carl Jacobsens Vej 35, 2500 Valby. That is the address of Datatilsynet (the Danish Data Protection Authority), not ours. Our registered address is Banevænget 5C, 5270 Odense N, Denmark, as stated in the Impressum. The form and the email now give that address. You can still withdraw by email to support@pennasystems.com; that address was always correct. Your right of withdrawal has not changed.

Documents updated:

• Model withdrawal form · Standardfortrydelsesformular (version 1.8)

The automatic language cookie no longer lasts a year. When you open a Danish page, our server sets the penna-locale cookie so that the next pages stay in Danish. That cookie used to last 1 year. It is now a session cookie, and our server sets it only if your browser has no language cookie yet, so it never replaces a language you chose. The 1-year cookie is now set only when you choose a language yourself: with the language switch, or by saving a language in your settings.

Your saved language comes first. A language you save in your account settings now always takes precedence over the cookie in the app. Saving a language in your settings also sets the cookie in that browser, so our public pages follow your choice there too. No cookie was added or removed.

Documents updated:

• Cookie Policy (version 1.5) · Cookiepolitik (version 1.4)

Income records described as they actually work. Privacy Policy §3 said we keep “income records derived from Stripe webhooks when your clients pay you”. That was wrong. Your clients pay you directly, using the payment details on your invoice; their payments never pass through accounts controlled by PennaSystems, and we receive no payment data from them. §3 now says what we do record: the amount, currency, exchange rate and a short description when you mark an invoice or a deposit as paid, and a record of your own subscription payments for our bookkeeping. §4 now names those subscription-payment records as the ones we keep for 5 years under the Danish Bookkeeping Act. This corrects the description; how we process your data has not changed.

Current domains named. Our marketing site moved from pennapay.com to pennasystems.com on 30 August 2026, and pennapay.com now only redirects there. The Privacy Policy, Cookie Policy, Impressum and Subprocessors pages still named pennapay.com as a site we operate. They now name pennasystems.com and app.pennasystems.com and say that pennapay.com redirects.

Language cookie described accurately. The Cookie Policy said the penna-locale cookie is set only when you click the language toggle. Our server also sets it when you open a Danish page, so that the app opens in the language you chose. Both cookie policies now say so and give its domain as .pennasystems.com. The Danish Cookiepolitik also misspelled the cookie’s name (penna_locale); that is fixed. No cookie was added or removed.

Documents updated:

• Privacy Policy · Privatlivspolitik (§2, §3, §4, §9; version 1.9)
• Cookie Policy (version 1.4) · Cookiepolitik (version 1.3)
• Impressum · Juridisk information (version 2.1)
• Subprocessors · Underdatabehandlere (version 1.8)

Contact addresses moved to @pennasystems.com; the old @pennapay.com addresses keep forwarding. Our public contact addresses (hello@pennasystems.com, support@pennasystems.com, privacy@pennasystems.com, billing@pennasystems.com) now end in @pennasystems.com instead of @pennapay.com, and the legal documents below name the new addresses. The old @pennapay.com addresses still reach us: mail sent to them, for example from an older invoice or PDF, keeps being forwarded to the same inbox. This is an address change only: it does not change the service, the terms of these documents, or how we collect, use or store your data.

Documents updated:

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular
• Cookie Policy · Cookiepolitik
• Impressum · Juridisk information
• Subprocessors · Underdatabehandlere
• Data Processing Agreement · Databehandleraftale

No AI features; Anthropic is now a former subprocessor. PennaSystems switched off all of its AI-assisted features on 2 October 2026, and no feature of the service now sends your data or your clients' data to an AI provider. Anthropic, which provided those features, has moved from the current subprocessor list to "Former subprocessors". Privacy Policy §5.1 now says this, explains how content sent while the features were available was handled under Anthropic's Commercial Terms, and states that our operator uses AI tools, including Anthropic's Claude, to help write and maintain the software without giving them personal data. Wording about AI opt-in switches and per-client AI settings has been removed throughout the Privacy Policy. Our own audit records of past AI-feature use are still deleted no later than 12 months after each use.

Bookkeeping integrations disclosed. If you connect your own Billy, Dinero or e-conomic account, we send the invoice and client data you choose to that account on your instruction. These providers are services you choose and contract with directly, not PennaSystems subprocessors. They are now described under "Optional third-party integrations" on the Subprocessors page and in Privacy Policy §5. Privacy Policy §3 now lists the few things we receive back from a connected bookkeeping system.

Audit right on the Data Processing Agreement page aligned with the Terms. §5 of the Data Processing Agreement page said audits were "primarily fulfilled by providing documentation", with the scope and costs of a physical audit agreed in advance. It now quotes the binding text in Terms of Service §7.1 word for word: a written compliance statement once a year at our expense, and physical inspections on 14 days' written notice at your expense.

Encryption in transit described accurately. Privacy Policy §10 said "TLS 1.3". Current browsers do connect with TLS 1.3, but older TLS versions are still accepted, so it now says that. The Subprocessors page's Railway row no longer states a minimum TLS version.

Documents updated:

• Privacy Policy · Privatlivspolitik (§3, §4, §5, §5.1, §6, §7, §8, §10; version 1.8)
• Subprocessors · Underdatabehandlere (version 1.7)
• Data Processing Agreement · Databehandleraftale (§5; version 1.3)

Breach-notification deadline made consistent, with a firm upper limit. The Data Processing Agreement in Terms of Service §7.1 promised to notify you of a personal data breach "without undue delay and, where feasible, no later than 36 hours", while the standalone Data Processing Agreement page said "no later than 48 hours". Both now say the same thing: without undue delay, where feasible within 36 hours, and in any event no later than 48 hours after we become aware of the breach. This adds a firm limit to the Terms and keeps the 36-hour target on the Data Processing Agreement page; neither document's protection was reduced.

Encryption at rest described as it actually works. §2 of the Data Processing Agreement page said all data was protected with "AES-256 encryption at rest", naming one cipher for everything. It now says what each part uses: the database is encrypted at rest by our hosting provider; uploaded files and off-site backups sit in object storage encrypted with AES-256, and backups are also encrypted before they leave our servers; access tokens for third-party services you connect, such as bookkeeping systems and messaging channels, are additionally encrypted by the application. On the Subprocessors page, the Railway row's unqualified "AES-256" label was replaced with what Railway itself commits to in its Data Processing Agreement: the database is encrypted at rest. No security measure was removed.

Privacy Policy §7 now discloses backup retention. We keep encrypted off-site backups of the platform database for about five years, the retention period the Danish Bookkeeping Act sets for bookkeeping records. §7 previously described when data is erased from the live service but did not mention that erased data can remain inside older encrypted backups until they expire. It now says so, and states how the backups are protected and what they are used for. This describes an existing practice; how we process your data has not changed.

Danish Privacy Policy brought into line with the English version. The Danish Privatlivspolitik had fallen behind: it had no scope section (§2) and no cookies section (§9), did not list all of the platform's modules, and numbered its sections differently from the English Privacy Policy. It is now a translation of the English Privacy Policy, section for section, and carries the same version number (1.7). The English Privacy Policy is unchanged apart from §7 above.

Documents updated:

• Terms of Service · Vilkår for brug (§7.1)
• Data Processing Agreement · Databehandleraftale (Version 1.2)
• Privacy Policy (§7, Version 1.7) · Privatlivspolitik (version 1.7)
• Subprocessors · Underdatabehandlere (Version 1.6)

Danish Terms of Service rewritten to structural parity with English. The Danish Vilkår for brug previously diverged from the English Terms in ways that mattered: it carried no GDPR Article 28 Data Processing Agreement clause at all, and no auto-renewal clause. Both are now present in Danish — §7/§7.1 (Data ownership and DPA) and §5 (Payment, billing and refunds) — and Danish section numbering is aligned to the English document throughout.

Plan-switch proration and the Free Tier client limit, both languages. §5 gained a clause describing how switching a Paid Plan between monthly and annual billing is prorated against the current billing period, and now discloses that Free Tier accounts may save one client record at a time (Paid Plans have no limit). Neither disclosure existed in either language before this version.

EU Online Dispute Resolution platform removed; replaced with the current Danish consumer complaint route. The European Commission's ODR platform was discontinued on 20 July 2025 under Regulation (EU) 2024/3228 and no longer resolves anything. §10 (Terms of Service) and the equivalent clause on the Impressum pages now instead direct consumers to the Danish consumer complaint system: a complaint starts with the Mediation Team for Consumer Complaints (Mæglingsteamet for Forbrugerklager) and, if unresolved, may proceed to the Consumer Complaints Board (Forbrugerklagenævnet); both are administered by Nævnenes Hus. General consumer guidance from the Danish Competition and Consumer Authority (forbrug.dk) remains linked.

Also corrected: stale pennapay.com references in the Terms were updated to pennasystems.com following the 2026-08-30 domain consolidation, and "PennaOrders" was added to the §6 trademark list alongside the platform's other module names.

Documents updated:

• Terms of Service · Vilkår for brug
• Impressum · Juridisk information

Marketing website domain consolidation. Our marketing website — the pages you are reading now, our free invoice builder, template pages, pricing and this legal information — is moving from pennapay.com to pennasystems.com, at the same page paths. Links to the previous pennapay.com address redirect permanently (HTTP 301) to the equivalent page on pennasystems.com, and will continue to do so. This is a hosting/domain change only: it does not change the service we provide, does not change these legal documents' terms, and does not change how we collect, use or store your data. Our email addresses (hello@pennapay.com, support@pennapay.com) are unchanged and continue to work as before.

No documents in this changelog's scope were revised by this notice.

New consent category: advertising measurement (Google Ads). We have added a Google Ads conversion tag, which — when you permit it — tells us whether someone who clicked one of our advertisements went on to create an account. It is the only advertising technology on the site. It is declined by default, and it is additionally gated by a server setting, so that your consent alone does not load it; while that setting is off, no Google host is permitted by our Content Security Policy and no request reaches Google from any visitor. We will announce the activation of that server setting here, at least 14 days before it takes effect, as required by section 10 of the Cookie Policy. This changelog is the authoritative record of whether we are advertising.

New cookie banner: Accept all / Reject all. The banner now offers Accept all, which grants both optional categories (analytics and advertising measurement) and names both before you press it, and an equally prominent Reject all, which grants neither. Manage preferences still offers a separate on/off control per category, nothing is pre-ticked, and closing or ignoring the banner grants nothing. Consent choices already recorded are carried forward unchanged and you are not asked again; a record made before the advertising category existed is read as declining it.

Cookie Policy rewritten around this. The cookie table now lists the _gcl_* / _gac_* conversion cookies with their purpose and lifetime, marked as requiring consent — they are created only if you switch the permission on. Section 6 sets out what does and does not happen in each state: Google's basic consent mode, so nothing is requested before consent (not even the cookieless "consent signal" that Google's advanced mode permits); no ad personalisation, no remarketing, no advertising audiences; no Enhanced Conversions and no email address, hashed or otherwise, sent to Google; Google acting as an independent controller for what the tag sends it; and immediate deletion of those cookies when the permission is withdrawn. Sections 2, 7, 8 and 9 (including the Do Not Track statement) were reworded so that each remains accurate whether or not the tag is active. Nothing was weakened: the commitments not to track you across other sites, not to build advertising profiles and not to sell data are unchanged.

Privacy Policy §9 gained a matching paragraph naming Google, its controller relationship and the cookies involved, and describing the Accept all / Reject all banner. The Danish Cookie Policy also gained a "Administrer Deres cookieindstillinger" button it previously lacked.

Documents updated:

• Cookie Policy · Cookiepolitik
• Privacy Policy (§9)

Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish): the parenthetical citation of Forbrugeraftaleloven §13 stk. 3 was removed from the no-return-costs provision following verification against the statute; §13 stk. 3 concerns the express request to begin the service before the withdrawal period expires and does not govern return costs. The substantive statement — that a consumer bears no return or restitution costs on withdrawal, as no goods are involved — is unchanged. The same correction was applied to the model withdrawal form.

Correction note (2026-07-05): the statutory citation for the five-year bookkeeping retention in §7.1 and §9 was updated from §10 to §12 of the Danish Bookkeeping Act (Act 700/2022). The obligation described is unchanged; only the section number was corrected.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular

Two statutory consumer disclosures added to Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish) and to the model withdrawal form: on withdrawal, the refund of the remaining balance is made to the original payment method without undue delay and at the latest 14 days after receipt of the withdrawal notice (Forbrugeraftaleloven §22 stk. 1); and the consumer bears no return or restitution costs, as the service involves no goods to return.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular

Terms of Service updated to cover consumers alongside businesses. The previous strictly business-to-business account clause was replaced: a natural person who signs up without a business identifier is treated as a consumer (Forbrugeraftaleloven §2 stk. 2), and a new clause — Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish) — sets out the consumer's 14-day right of withdrawal, the express request for immediate provision given at checkout, and the proportionate-payment rule on withdrawal after an express request (Forbrugeraftaleloven §25). The VAT clause now states that prices shown to consumers are inclusive of VAT (Markedsføringsloven §6). The governing-law section adds the EU Online Dispute Resolution platform (Regulation (EU) No 524/2013), a dispute-correspondence email address and Center for Klageløsning. A standard model withdrawal form (Forbrugeraftaleloven §19 / Consumer Rights Directive Annex I(B)) was published as a new page.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular (new)

Terms of Service §9 (Termination consequences, English) updated to reflect that automated final erasure of deleted accounts is active: after the 30-day grace period the account is permanently erased — the data created on the platform is deleted and the user record is reduced to an anonymous tombstone — automatically and irreversibly. The Danish Vilkår for brug already referred to the Privacy Policy without the superseded suspension wording and was not changed. This change was made together with the Privacy Policy §7 update recorded as Version 1.2 below.

Documents updated:

• Terms of Service (English)

The operator identification in the Terms of Service was updated: PennaSystems is operated as a personally owned small business (PMV) registered under CVR 46522036, replacing the previously stated CVR 46426061. A PMV registration is tied to its owner's civil registration number and cannot be transferred; the operating business was accordingly re-established under a new owner with a new CVR number. No other provisions were changed.

Documents updated:

• Terms of Service · Vilkår for brug

Terms of Service cancellation clause (English and Danish) clarified: the general rule that no refunds are issued for partial periods on a voluntary cancellation does not affect the pro-rata refund of the unused portion of a prepaid annual plan owed on discontinuation of a feature or on material changes to the Terms. A new paragraph documents switching between monthly and annual billing: the change is prorated, the difference is settled on the next invoice, and a net credit is applied to the account toward future charges rather than refunded.

Documents updated:

• Terms of Service · Vilkår for brug

Privacy Policy §7 (Data retention) and Terms of Service §9 (Termination consequences) updated to reflect that automated final erasure of deleted accounts is now active. Previously the documents disclosed that automated erasure after the 30-day grace period was suspended; the account-deletion lifecycle now permanently erases the data you created on the platform and reduces your user record to an anonymous tombstone once the grace period passes.

Documents updated:

• Privacy Policy · Privatlivspolitik
• Terms of Service (English)

Incremental update incorporating findings from Pass 4 adversarial review (Gemini) and publishing the Data Processing Agreement as a public-facing legal document. All documents updated to reflect clarifications on soft-delete practices, legitimate interest processing, account lifecycle, liability, data portability, IP indemnity, EU residency commitment and audit cost allocation.

Documents updated (English and Danish):

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Data Processing Agreement · Databehandleraftale (new)

Initial publication of the PennaSystems legal documents for our Danish market launch. Drafted through a multi-pass self-drafted review protocol covering: structure, GDPR compliance, Datatilsynet alignment, two rounds of adversarial AI review (Gemini), plain-language rewrites, production cookie audit, Danish localization and operator-identity finalization.

Documents published (English and Danish):

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Cookie Policy · Cookiepolitik
• Impressum · Juridisk information
• Subprocessors · Underdatabehandlere