Legal Changelog

Our address on the withdrawal form was wrong. The model withdrawal form, and the confirmation email we send to consumers who buy a paid plan, gave our address as Carl Jacobsens Vej 35, 2500 Valby. That is the address of Datatilsynet (the Danish Data Protection Authority), not ours. Our registered address is Banevænget 5C, 5270 Odense N, Denmark, as stated in the Impressum. The form and the email now give that address. You can still withdraw by email to support@pennasystems.com; that address was always correct. Your right of withdrawal has not changed.

Documents updated:

• Model withdrawal form · Standardfortrydelsesformular (version 1.8)

The automatic language cookie no longer lasts a year. When you open a Danish page, our server sets the penna-locale cookie so that the next pages stay in Danish. That cookie used to last 1 year. It is now a session cookie, and our server sets it only if your browser has no language cookie yet, so it never replaces a language you chose. The 1-year cookie is now set only when you choose a language yourself: with the language switch, or by saving a language in your settings.

Your saved language comes first. A language you save in your account settings now always takes precedence over the cookie in the app. Saving a language in your settings also sets the cookie in that browser, so our public pages follow your choice there too. No cookie was added or removed.

Documents updated:

• Cookie Policy (version 1.5) · Cookiepolitik (version 1.4)

Income records described as they actually work. Privacy Policy §3 said we keep “income records derived from Stripe webhooks when your clients pay you”. That was wrong. Your clients pay you directly, using the payment details on your invoice; their payments never pass through accounts controlled by PennaSystems, and we receive no payment data from them. §3 now says what we do record: the amount, currency, exchange rate and a short description when you mark an invoice or a deposit as paid, and a record of your own subscription payments for our bookkeeping. §4 now names those subscription-payment records as the ones we keep for 5 years under the Danish Bookkeeping Act. This corrects the description; how we process your data has not changed.

Current domains named. Our marketing site moved from pennapay.com to pennasystems.com on 30 August 2026, and pennapay.com now only redirects there. The Privacy Policy, Cookie Policy, Impressum and Subprocessors pages still named pennapay.com as a site we operate. They now name pennasystems.com and app.pennasystems.com and say that pennapay.com redirects.

Language cookie described accurately. The Cookie Policy said the penna-locale cookie is set only when you click the language toggle. Our server also sets it when you open a Danish page, so that the app opens in the language you chose. Both cookie policies now say so and give its domain as .pennasystems.com. The Danish Cookiepolitik also misspelled the cookie’s name (penna_locale); that is fixed. No cookie was added or removed.

Documents updated:

• Privacy Policy · Privatlivspolitik (§2, §3, §4, §9; version 1.9)
• Cookie Policy (version 1.4) · Cookiepolitik (version 1.3)
• Impressum · Juridisk information (version 2.1)
• Subprocessors · Underdatabehandlere (version 1.8)

Contact addresses moved to @pennasystems.com; the old @pennapay.com addresses keep forwarding. Our public contact addresses (hello@pennasystems.com, support@pennasystems.com, privacy@pennasystems.com, billing@pennasystems.com) now end in @pennasystems.com instead of @pennapay.com, and the legal documents below name the new addresses. The old @pennapay.com addresses still reach us: mail sent to them, for example from an older invoice or PDF, keeps being forwarded to the same inbox. This is an address change only: it does not change the service, the terms of these documents, or how we collect, use or store your data.

Documents updated:

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular
• Cookie Policy · Cookiepolitik
• Impressum · Juridisk information
• Subprocessors · Underdatabehandlere
• Data Processing Agreement · Databehandleraftale

No AI features; Anthropic is now a former subprocessor. PennaSystems switched off all of its AI-assisted features on 2 October 2026, and no feature of the service now sends your data or your clients' data to an AI provider. Anthropic, which provided those features, has moved from the current subprocessor list to "Former subprocessors". Privacy Policy §5.1 now says this, explains how content sent while the features were available was handled under Anthropic's Commercial Terms, and states that our operator uses AI tools, including Anthropic's Claude, to help write and maintain the software without giving them personal data. Wording about AI opt-in switches and per-client AI settings has been removed throughout the Privacy Policy. Our own audit records of past AI-feature use are still deleted no later than 12 months after each use.

Bookkeeping integrations disclosed. If you connect your own Billy, Dinero or e-conomic account, we send the invoice and client data you choose to that account on your instruction. These providers are services you choose and contract with directly, not PennaSystems subprocessors. They are now described under "Optional third-party integrations" on the Subprocessors page and in Privacy Policy §5. Privacy Policy §3 now lists the few things we receive back from a connected bookkeeping system.

Audit right on the Data Processing Agreement page aligned with the Terms. §5 of the Data Processing Agreement page said audits were "primarily fulfilled by providing documentation", with the scope and costs of a physical audit agreed in advance. It now quotes the binding text in Terms of Service §7.1 word for word: a written compliance statement once a year at our expense, and physical inspections on 14 days' written notice at your expense.

Encryption in transit described accurately. Privacy Policy §10 said "TLS 1.3". Current browsers do connect with TLS 1.3, but older TLS versions are still accepted, so it now says that. The Subprocessors page's Railway row no longer states a minimum TLS version.

Documents updated:

• Privacy Policy · Privatlivspolitik (§3, §4, §5, §5.1, §6, §7, §8, §10; version 1.8)
• Subprocessors · Underdatabehandlere (version 1.7)
• Data Processing Agreement · Databehandleraftale (§5; version 1.3)

Breach-notification deadline made consistent, with a firm upper limit. The Data Processing Agreement in Terms of Service §7.1 promised to notify you of a personal data breach "without undue delay and, where feasible, no later than 36 hours", while the standalone Data Processing Agreement page said "no later than 48 hours". Both now say the same thing: without undue delay, where feasible within 36 hours, and in any event no later than 48 hours after we become aware of the breach. This adds a firm limit to the Terms and keeps the 36-hour target on the Data Processing Agreement page; neither document's protection was reduced.

Encryption at rest described as it actually works. §2 of the Data Processing Agreement page said all data was protected with "AES-256 encryption at rest", naming one cipher for everything. It now says what each part uses: the database is encrypted at rest by our hosting provider; uploaded files and off-site backups sit in object storage encrypted with AES-256, and backups are also encrypted before they leave our servers; access tokens for third-party services you connect, such as bookkeeping systems and messaging channels, are additionally encrypted by the application. On the Subprocessors page, the Railway row's unqualified "AES-256" label was replaced with what Railway itself commits to in its Data Processing Agreement: the database is encrypted at rest. No security measure was removed.

Privacy Policy §7 now discloses backup retention. We keep encrypted off-site backups of the platform database for about five years, the retention period the Danish Bookkeeping Act sets for bookkeeping records. §7 previously described when data is erased from the live service but did not mention that erased data can remain inside older encrypted backups until they expire. It now says so, and states how the backups are protected and what they are used for. This describes an existing practice; how we process your data has not changed.

Danish Privacy Policy brought into line with the English version. The Danish Privatlivspolitik had fallen behind: it had no scope section (§2) and no cookies section (§9), did not list all of the platform's modules, and numbered its sections differently from the English Privacy Policy. It is now a translation of the English Privacy Policy, section for section, and carries the same version number (1.7). The English Privacy Policy is unchanged apart from §7 above.

Documents updated:

• Terms of Service · Vilkår for brug (§7.1)
• Data Processing Agreement · Databehandleraftale (Version 1.2)
• Privacy Policy (§7, Version 1.7) · Privatlivspolitik (version 1.7)
• Subprocessors · Underdatabehandlere (Version 1.6)

Danish Terms of Service rewritten to structural parity with English. The Danish Vilkår for brug previously diverged from the English Terms in ways that mattered: it carried no GDPR Article 28 Data Processing Agreement clause at all, and no auto-renewal clause. Both are now present in Danish — §7/§7.1 (Data ownership and DPA) and §5 (Payment, billing and refunds) — and Danish section numbering is aligned to the English document throughout.

Plan-switch proration and the Free Tier client limit, both languages. §5 gained a clause describing how switching a Paid Plan between monthly and annual billing is prorated against the current billing period, and now discloses that Free Tier accounts may save one client record at a time (Paid Plans have no limit). Neither disclosure existed in either language before this version.

EU Online Dispute Resolution platform removed; replaced with the current Danish consumer complaint route. The European Commission's ODR platform was discontinued on 20 July 2025 under Regulation (EU) 2024/3228 and no longer resolves anything. §10 (Terms of Service) and the equivalent clause on the Impressum pages now instead direct consumers to the Danish consumer complaint system: a complaint starts with the Mediation Team for Consumer Complaints (Mæglingsteamet for Forbrugerklager) and, if unresolved, may proceed to the Consumer Complaints Board (Forbrugerklagenævnet); both are administered by Nævnenes Hus. General consumer guidance from the Danish Competition and Consumer Authority (forbrug.dk) remains linked.

Also corrected: stale pennapay.com references in the Terms were updated to pennasystems.com following the 2026-08-30 domain consolidation, and "PennaOrders" was added to the §6 trademark list alongside the platform's other module names.

Documents updated:

• Terms of Service · Vilkår for brug
• Impressum · Juridisk information

Marketing website domain consolidation. Our marketing website — the pages you are reading now, our free invoice builder, template pages, pricing and this legal information — is moving from pennapay.com to pennasystems.com, at the same page paths. Links to the previous pennapay.com address redirect permanently (HTTP 301) to the equivalent page on pennasystems.com, and will continue to do so. This is a hosting/domain change only: it does not change the service we provide, does not change these legal documents' terms, and does not change how we collect, use or store your data. Our email addresses (hello@pennapay.com, support@pennapay.com) are unchanged and continue to work as before.

No documents in this changelog's scope were revised by this notice.

New consent category: advertising measurement (Google Ads). We have added a Google Ads conversion tag, which — when you permit it — tells us whether someone who clicked one of our advertisements went on to create an account. It is the only advertising technology on the site. It is declined by default, and it is additionally gated by a server setting, so that your consent alone does not load it; while that setting is off, no Google host is permitted by our Content Security Policy and no request reaches Google from any visitor. We will announce the activation of that server setting here, at least 14 days before it takes effect, as required by section 10 of the Cookie Policy. This changelog is the authoritative record of whether we are advertising.

New cookie banner: Accept all / Reject all. The banner now offers Accept all, which grants both optional categories (analytics and advertising measurement) and names both before you press it, and an equally prominent Reject all, which grants neither. Manage preferences still offers a separate on/off control per category, nothing is pre-ticked, and closing or ignoring the banner grants nothing. Consent choices already recorded are carried forward unchanged and you are not asked again; a record made before the advertising category existed is read as declining it.

Cookie Policy rewritten around this. The cookie table now lists the _gcl_* / _gac_* conversion cookies with their purpose and lifetime, marked as requiring consent — they are created only if you switch the permission on. Section 6 sets out what does and does not happen in each state: Google's basic consent mode, so nothing is requested before consent (not even the cookieless "consent signal" that Google's advanced mode permits); no ad personalisation, no remarketing, no advertising audiences; no Enhanced Conversions and no email address, hashed or otherwise, sent to Google; Google acting as an independent controller for what the tag sends it; and immediate deletion of those cookies when the permission is withdrawn. Sections 2, 7, 8 and 9 (including the Do Not Track statement) were reworded so that each remains accurate whether or not the tag is active. Nothing was weakened: the commitments not to track you across other sites, not to build advertising profiles and not to sell data are unchanged.

Privacy Policy §9 gained a matching paragraph naming Google, its controller relationship and the cookies involved, and describing the Accept all / Reject all banner. The Danish Cookie Policy also gained a "Administrer Deres cookieindstillinger" button it previously lacked.

Documents updated:

• Cookie Policy · Cookiepolitik
• Privacy Policy (§9)

Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish): the parenthetical citation of Forbrugeraftaleloven §13 stk. 3 was removed from the no-return-costs provision following verification against the statute; §13 stk. 3 concerns the express request to begin the service before the withdrawal period expires and does not govern return costs. The substantive statement — that a consumer bears no return or restitution costs on withdrawal, as no goods are involved — is unchanged. The same correction was applied to the model withdrawal form.

Correction note (2026-07-05): the statutory citation for the five-year bookkeeping retention in §7.1 and §9 was updated from §10 to §12 of the Danish Bookkeeping Act (Act 700/2022). The obligation described is unchanged; only the section number was corrected.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular

Two statutory consumer disclosures added to Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish) and to the model withdrawal form: on withdrawal, the refund of the remaining balance is made to the original payment method without undue delay and at the latest 14 days after receipt of the withdrawal notice (Forbrugeraftaleloven §22 stk. 1); and the consumer bears no return or restitution costs, as the service involves no goods to return.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular

Terms of Service updated to cover consumers alongside businesses. The previous strictly business-to-business account clause was replaced: a natural person who signs up without a business identifier is treated as a consumer (Forbrugeraftaleloven §2 stk. 2), and a new clause — Terms of Service §3.1 (English) / Vilkår for brug §9.1 (Danish) — sets out the consumer's 14-day right of withdrawal, the express request for immediate provision given at checkout, and the proportionate-payment rule on withdrawal after an express request (Forbrugeraftaleloven §25). The VAT clause now states that prices shown to consumers are inclusive of VAT (Markedsføringsloven §6). The governing-law section adds the EU Online Dispute Resolution platform (Regulation (EU) No 524/2013), a dispute-correspondence email address and Center for Klageløsning. A standard model withdrawal form (Forbrugeraftaleloven §19 / Consumer Rights Directive Annex I(B)) was published as a new page.

Documents updated:

• Terms of Service · Vilkår for brug
• Model withdrawal form · Standardfortrydelsesformular (new)

Terms of Service §9 (Termination consequences, English) updated to reflect that automated final erasure of deleted accounts is active: after the 30-day grace period the account is permanently erased — the data created on the platform is deleted and the user record is reduced to an anonymous tombstone — automatically and irreversibly. The Danish Vilkår for brug already referred to the Privacy Policy without the superseded suspension wording and was not changed. This change was made together with the Privacy Policy §7 update recorded as Version 1.2 below.

Documents updated:

• Terms of Service (English)

The operator identification in the Terms of Service was updated: PennaSystems is operated as a personally owned small business (PMV) registered under CVR 46522036, replacing the previously stated CVR 46426061. A PMV registration is tied to its owner's civil registration number and cannot be transferred; the operating business was accordingly re-established under a new owner with a new CVR number. No other provisions were changed.

Documents updated:

• Terms of Service · Vilkår for brug

Terms of Service cancellation clause (English and Danish) clarified: the general rule that no refunds are issued for partial periods on a voluntary cancellation does not affect the pro-rata refund of the unused portion of a prepaid annual plan owed on discontinuation of a feature or on material changes to the Terms. A new paragraph documents switching between monthly and annual billing: the change is prorated, the difference is settled on the next invoice, and a net credit is applied to the account toward future charges rather than refunded.

Documents updated:

• Terms of Service · Vilkår for brug

Privacy Policy §7 (Data retention) and Terms of Service §9 (Termination consequences) updated to reflect that automated final erasure of deleted accounts is now active. Previously the documents disclosed that automated erasure after the 30-day grace period was suspended; the account-deletion lifecycle now permanently erases the data you created on the platform and reduces your user record to an anonymous tombstone once the grace period passes.

Documents updated:

• Privacy Policy · Privatlivspolitik
• Terms of Service (English)

Incremental update incorporating findings from Pass 4 adversarial review (Gemini) and publishing the Data Processing Agreement as a public-facing legal document. All documents updated to reflect clarifications on soft-delete practices, legitimate interest processing, account lifecycle, liability, data portability, IP indemnity, EU residency commitment and audit cost allocation.

Documents updated (English and Danish):

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Data Processing Agreement · Databehandleraftale (new)

Initial publication of the PennaSystems legal documents for our Danish market launch. Drafted through a multi-pass self-drafted review protocol covering: structure, GDPR compliance, Datatilsynet alignment, two rounds of adversarial AI review (Gemini), plain-language rewrites, production cookie audit, Danish localization and operator-identity finalization.

Documents published (English and Danish):

• Privacy Policy · Privatlivspolitik
• Terms of Service · Vilkår for brug
• Cookie Policy · Cookiepolitik
• Impressum · Juridisk information
• Subprocessors · Underdatabehandlere