Privacy policy

Last updated: 30 October 2026

1. Who we are

The data controller is Oakbridge Consulting & Media ApS, CVR 46273095, Margretheholmsvej 62, 5. th, 1432 København K, Denmark. We run www.theuph.com ("UPH"), the UPH/BookTalk newsletter and the BookTalk YouTube channel.

Contact for privacy questions: support@theuph.com. You can also write to us at the address above.

We have not appointed a data protection officer. We are not required to: we are not a public authority, and our core activities involve neither large-scale regular and systematic monitoring nor large-scale processing of special categories of data (GDPR Art. 37(1)).

What Why Legal basis How long
Visiting the website: your IP address, browser and device information (user agent), the page or file requested and the time of the request. Your browser sends these automatically to the servers that deliver our pages, images and website code: Ghost, which hosts our site, and the jsDelivr CDN, which delivers the code for the sign-up/sign-in pop-up and the site search (see §6) To show you the website and keep it working and secure Legitimate interest (Art. 6(1)(f)): delivering a working, secure website We do not run visitor statistics and do not keep these logs ourselves. Ghost keeps technical logs as our processor. jsDelivr keeps them under its own privacy policy: it says it keeps individual request data only until it has been analysed (for example to detect abuse) and then deletes it, and keeps only statistics that do not identify you
Newsletter subscription: your email address, optional name, date and time of signup and of confirmation (double opt-in), the page/form and the wording you agreed to, and a label showing where you signed up (for example the bookstore page) To send you the newsletter on the 1st and 15th of each month: book recommendations, new BookTalk videos, and news from the UPH bookstore (downloads, audiobooks and books to buy). If you signed up on the bookstore page, we also tell you when the bookstore opens Your consent (GDPR Art. 6(1)(a); markedsføringsloven § 10) Until you unsubscribe. After that we keep only the record of your consent (email, time, wording) for 2 years, so we can prove we had consent. Then we delete it
Email delivery data: whether each email was delivered, bounced or marked as spam To keep the list working and stop sending to addresses that bounce or complain Legitimate interest (Art. 6(1)(f)): reliable, lawful email delivery As long as you are subscribed, then as for the consent record
How we measure the newsletter: we do not track whether you open our emails or which links you click (open and click tracking are switched off). Links to our own pages carry a campaign tag (for example utm_campaign=newsletter_2026-12-01), and links to Kobo and Saxo carry a sub-tag for that issue. Both tags are the same for every reader of that issue. We then see only totals, for example sales per issue in our affiliate partners' reports Learning which issues and recommendations are useful No personal data processed by us: the tags do not identify you –
Member account (created automatically when you subscribe): email, optional name, login sessions, member status, newsletter choices, labels, and which member-only posts you open while logged in To give you access to member content and manage your account Contract (Art. 6(1)(b)) While your account exists. If you are not subscribed to any newsletter and have not signed in for 24 months, we delete the account. You can also delete your account at any time or ask us to; we then delete it within 30 days
Paid membership: payments and billing: your name, email address, billing country, the plan you chose, and transaction data (amounts, dates, payment status, receipts, invoices and refunds). You enter your card details on Stripe's secure payment page. Your card details are handled by Stripe, not by us: we never see or store your full card number, only the card type and the last four digits To take payment for your membership and renew it, send you receipts, handle cancellations, withdrawals and refunds, and keep our accounts Contract (Art. 6(1)(b)). For our accounting records: legal obligation (Art. 6(1)(c); bogføringsloven) 5 years from the end of the financial year in which the payment was made (bogføringsloven § 12). Stripe keeps the data it processes as an independent controller under its own privacy policy (see §6)
Withdrawal requests (the "Withdraw from contract here" form): your name, the email address you used for your membership, your plan (monthly or annual), the date of purchase and any message, if you choose to give them, and the date and time you sent the form To process your withdrawal, send you a receipt, refund you, and document that we did so in time Legal obligation (Art. 6(1)(c); forbrugeraftaleloven § 20 a and bogføringsloven). Ending your membership and refunding you: contract (Art. 6(1)(b)) 5 years from the end of the financial year in which you withdrew, because the request is part of our accounting record for the refund (bogføringsloven § 12)
Emails you send us: the content and your contact details To answer you Legitimate interest (Art. 6(1)(f)): replying to people who contact us 12 months after the conversation ends, unless the email is an accounting record or relates to a claim
YouTube: comments and messages on the BookTalk channel To run the channel and talk with our community Legitimate interest (Art. 6(1)(f)): running a public channel While visible on YouTube. YouTube (Google) is an independent controller
Business contacts and suppliers: names and details on invoices and contracts Bookkeeping and tax Legal obligation (Art. 6(1)(c); bogføringsloven) 5 years from the end of the financial year (bogføringsloven § 12)

Our legitimate interests (Art. 13(1)(d)) are as follows:

  • to deliver our website, and the code for its sign-up pop-up and search, reliably and securely;
  • to answer messages sent to us;
  • to run the YouTube channel;
  • to keep email delivery working.

In each case the processing is limited and is what you would expect.

Do you have to give us your data? (Art. 13(2)(e)) You are not required by law to give us anything.

  • Without an email address and confirmed consent we cannot send you the newsletter.
  • To buy a paid membership you must give us your email address and pay through Stripe. Without this we cannot enter into the membership contract.
  • You can read everything on the site that does not require signing in without giving us any personal data. Your browser does send technical data (such as your IP address) to the servers that deliver the pages; without it, the website cannot be shown.

No automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22).

No selling or sharing of lists. We do not sell your data. We do not share our newsletter or member list with any other company, including our parent company Triwoods Holding ApS.

3. Where the data comes from

Mostly from you: our signup forms, your emails to us, and your comments and messages on our YouTube channel. Technical data comes from your browser when you visit the site. If you buy a paid membership, Stripe sends us the payment details listed in §2. YouTube gives us channel statistics that do not identify you. Google Search Console gives us totals of how our pages appear in Google Search (for example searches and clicks per page); these do not identify you.

Some pages and newsletters may contain affiliate links to bookshops. These are labelled "Advertisement" (in English) or "Reklame" (in Danish). If you buy something after clicking one, we may earn a commission at no extra cost to you. The programmes are:

  • Amazon Associates. Amazon links appear only on our website, not in our emails. As an Amazon Associate I earn from qualifying purchases.
  • Rakuten Advertising, for links to Kobo.
  • Partner-ads, for links to Saxo.

How these links work:

  • We do not send your personal data to these shops or networks. The link contains our partner ID (and, in emails, a tag for the issue), not anything about you.
  • A Kobo or Saxo link first passes through the affiliate network's own redirect page and then opens the shop. The network and the shop can then set their own cookies on their own websites to credit us for a sale. They do this as independent controllers under their own privacy and cookie policies. We have no control over that.
  • From the networks we receive only aggregated reports (for example, number of clicks and sales and the commission earned). These do not identify you.

5. Cookies and similar technologies

See our Cookie notice (/cookies/). In short: an ordinary visit to our site sets no cookies and stores nothing in your browser. Only when you sign in as a member does our site set two login cookies, which are strictly necessary to keep you signed in. We do not use advertising cookies, third-party cookies or tracking. We link to YouTube rather than embedding videos, so nothing loads from YouTube unless you click a link to it.

6. Who receives your data

Recipient Role Where / transfer safeguard
Ghost Foundation Ltd (Ghost(Pro)): website, newsletter and membership platform. Our pages and files are delivered from Ghost's servers at www.theuph.com, storage.ghost.io (images) and united-publishing-houses.ghost.io (our Ghost account's address, which the sign-up pop-up reads its settings from) Data processor under Ghost's Data Processing Agreement Data stored in the EU (servers in Amsterdam, Netherlands). Ghost may access data from outside the EU for support and maintenance. Such transfers are covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914)
Ghost's sub-processors: its CDN/security provider (Fastly) and its email-delivery provider Sub-processors engaged by Ghost Covered by Ghost's DPA and the EU Standard Contractual Clauses
jsDelivr (cdn.jsdelivr.net), operated by Volentio JSD Limited, England and Wales: a public content delivery network that Ghost uses to deliver the code for our sign-up/sign-in pop-up and site search. When a page loads, your browser requests this code from jsDelivr, which receives your IP address, browser information, the file requested and the referring domain. jsDelivr sets no cookies. It serves its traffic through the CDN providers Cloudflare, Fastly and Gcore Independent controller, under its own privacy policy (jsdelivr.com/terms/privacy-policy-jsdelivr-net). jsDelivr says it uses this data to run the service, for security and to publish download statistics that do not identify anyone United Kingdom: covered by an EU adequacy decision (renewed December 2025). jsDelivr's CDN providers may handle requests outside the UK and EU/EEA; jsDelivr states that it takes steps to make such transfers comply with data protection law
Hostinger International Ltd (Cyprus): hosting of our support mailbox Processor EU. Any transfer outside the EU/EEA is covered by the Standard Contractual Clauses in Hostinger's DPA
Cloudflare, Inc.: forwards email sent to support@theuph.com to our mailbox Processor USA: EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback, under Cloudflare's DPA
Stripe Payments Europe, Limited (Ireland): payment processing for paid memberships, through Stripe's payment page and billing page. You enter your card details directly with Stripe; we do not receive your full card number Data processor when it processes payments for us, under Stripe's Data Processing Agreement. Independent controller for its own purposes, such as preventing and detecting fraud and financial loss and complying with the law (for example anti-money-laundering rules), under its own privacy policy (stripe.com/privacy) EU (Ireland). Stripe transfers data to Stripe, LLC in the USA: EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback, under Stripe's Data Transfers Addendum
Jotform Ltd (United Kingdom), part of the Jotform group with Jotform Inc. (USA): runs our "Withdraw from contract here" form and emails you the receipt Processor, under Jotform's Data Processing Addendum Form data stored in the EU (Jotform's servers in Frankfurt, Germany). United Kingdom: covered by an EU adequacy decision. Any access from the USA (for example by Jotform Inc. for support) is covered by the EU-US Data Privacy Framework and the Standard Contractual Clauses in Jotform's DPA
YouTube / Google Independent controller for YouTube and Google Search See Google's privacy policy
Affiliate networks and shops: Amazon, Rakuten Advertising (Kobo), Partner-ads (Saxo) Independent controllers once you click through to their sites See their privacy policies
Our external accountant Receives accounting records Denmark
Public authorities (e.g. Skattestyrelsen) Only where the law requires it Denmark/EU

You can ask us for a copy of the transfer safeguards (for example the Standard Contractual Clauses) using the contact details in §1.

7. Your rights

You have the right to:

  • access your data (Art. 15);
  • rectification (Art. 16);
  • erasure (Art. 17);
  • restriction (Art. 18);
  • data portability (Art. 20), for data you gave us under consent or contract;
  • withdraw your consent at any time, as easily as you gave it (Art. 7(3)). Use the unsubscribe link in every newsletter, your account settings, or email us. Withdrawal does not affect processing that took place before it.
Your right to object (Art. 21). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (see §2). We will then stop unless we have compelling legitimate grounds or need the data for a legal claim. You can always object to direct marketing; we will then stop sending you the newsletter. Write to support@theuph.com.

We answer within one month. This can be extended by two further months for complex requests; if so, we tell you within the first month (Art. 12(3)).

Some data we must keep even if you ask for deletion, such as accounting records for the period in bogføringsloven § 12 (GDPR Art. 17(3)(b)). We then use it only for that purpose.

8. Complaints

If you think we process your data unlawfully, please contact us first so we can try to fix it. You also have the right to complain to a supervisory authority (Art. 77). In Denmark this is:

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark · tel. +45 33 19 32 00 · dt@datatilsynet.dk · www.datatilsynet.dk

If you live in another EU/EEA country, you can also complain to the authority there.

9. Changes

If we change how we use your data, we will update this page and the date at the top. If the change is significant (for example, a new purpose that needs your consent), we will tell subscribers by email and ask for consent again where required.

Privatlivspolitik – kort version på dansk

Senest opdateret: 30. oktober 2026

Dataansvarlig: Oakbridge Consulting & Media ApS, CVR 46273095, Margretheholmsvej 62, 5. th, 1432 København K. Kontakt: support@theuph.com.

  • Besøg på hjemmesiden:
    • Din browser sender automatisk din IP-adresse og tekniske oplysninger til de servere, der leverer siderne: Ghost (vores platform) og jsDelivr (leverer koden til tilmeldings-/login-vinduet og søgningen). Det sker på grundlag af vores legitime interesse i en sikker og velfungerende hjemmeside.
    • Vi fører ikke besøgsstatistik.
  • Nyhedsbrev:
    • Vi bruger din e-mail (og evt. navn) til at sende nyhedsbrevet den 1. og 15. i måneden. Det sker på grundlag af dit samtykke (databeskyttelsesforordningens art. 6, stk. 1, litra a, og markedsføringslovens § 10).
    • Vi måler ikke, om du åbner e-mailen, og vi registrerer ikke, hvilke links du klikker på. Links kan have et kampagne-mærke, som er ens for alle læsere, så vi kun ser samlede tal.
    • Du kan altid afmelde dig med ét klik i hver e-mail. Efter afmelding gemmer vi dokumentationen for dit samtykke i 2 år.
  • Medlemskonto:
    • Når du bekræfter din tilmelding, oprettes en medlemskonto, så du kan læse indhold for medlemmer (aftale).
    • Din konto består, selv om du afmelder nyhedsbrevet.
    • Inaktive konti uden nyhedsbrev slettes efter 24 måneder. Beder du om at få din konto slettet, sletter vi den inden for 30 dage.
  • Betalt medlemskab:
    • Betaling sker via Stripe. Vi får dit navn, din e-mail, dit land og oplysninger om betalingen. Dine kortoplysninger håndteres af Stripe, ikke af os (aftale; bogføringsloven).
    • Fortryder du via formularen "Withdraw from contract here" (Jotform), behandler vi dit navn, din e-mail, dit abonnement, evt. købsdato og besked samt tidspunktet for din fortrydelse (retlig forpligtelse; forbrugeraftalelovens § 20 a).
    • Betalings- og fortrydelsesoplysninger gemmer vi i 5 år fra udgangen af regnskabsåret (bogføringslovens § 12).
  • E-mails til os gemmer vi i 12 måneder efter, at samtalen er afsluttet, medmindre de er regnskabsmateriale eller vedrører et krav.
  • Cookies: Et almindeligt besøg sætter ingen cookies. Kun når du logger ind som medlem, sættes to strengt nødvendige login-cookies. Se vores cookievejledning.
  • Modtagere:
    • Ghost (vores platform; data opbevares i EU), jsDelivr (Volentio JSD Limited, Storbritannien; selvstændig dataansvarlig; omfattet af EU's afgørelse om tilstrækkeligt beskyttelsesniveau), Hostinger (e-mail), Cloudflare (videresendelse af e-mail), Stripe (betalinger; Stripe Payments Europe, Irland; databehandler og for bl.a. svindelforebyggelse selvstændig dataansvarlig), Jotform (fortrydelsesformular; data opbevares i EU) og vores revisor.
    • Vi sælger ikke dine oplysninger og deler ikke vores lister med andre virksomheder.
  • Reklamelinks:
    • Nogle links til boghandlere kan være affiliate-links og er mærket "Reklame": Amazon (kun på hjemmesiden), Kobo via Rakuten Advertising og Saxo via Partner-ads.
    • Vi sender ikke dine oplysninger til butikkerne. Netværket og butikken kan sætte egne cookies på deres egne sider.
  • Dine rettigheder: Du har ret til indsigt, berigtigelse, sletning, begrænsning og dataportabilitet, og du kan trække dit samtykke tilbage.
  • Ret til indsigelse: Du kan til enhver tid gøre indsigelse mod behandling, der sker på grundlag af vores legitime interesser, og mod direkte markedsføring.
  • Klage: Du kan klage til Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, tlf. 33 19 32 00, dt@datatilsynet.dk.
  • Den fulde engelske version ovenfor gælder.