Via Ritzau

GDPR overview

Implementation is concrete and documented. The cookie and privacy policy, version 1 dated 23 October 2025, is written under the GDPR (EU) 2016/679 and the Danish Data Protection Act (lov nr. 502 of 23 May 2018), and the product page claims the platform is 100% GDPR compliant. Rights are listed in full: access, rectification, erasure, restriction, objection to legitimate-interest processing, withdrawal of consent and portability, with gdpr@ritzau.dk as the contact point and Datatilsynet named as the supervisory authority for complaints. Transfers outside the EU/EEA are covered by the European Commission's standard contractual clauses, an adequacy decision or Article 49(1), and a data processing agreement is concluded wherever the law requires one. As the controller is established in Denmark, no Article 27 representative applies. One gap: the policy lists five covered Ritzau sites and does not name via.ritzau.dk.

Who owns the data?

The terms put content squarely on the customer: you carry full responsibility for the release you submit, including that all information is correct and rights to text, images and other material are cleared. Ritzau disclaims liability for errors, omissions and legal consequences of what it distributes, and the public portal states permanently that releases are relayed for third parties, who should be contacted about their content. The media contact database works the other way round: it stays Ritzau's property, usable only to select recipients — copying information out of it can bring exclusion, damages and legal action. Ritzau acts sometimes as controller, sometimes as processor when it makes its platforms available to customers.

Reuse rights

Reuse is asymmetric. You may use the media database to pick recipients, but you may not copy information out of it, so those contacts cannot be reused elsewhere without permission. On its own side, Ritzau states that it processes names, phone numbers, email and postal addresses, job titles and employers, unique identifiers and device data, IP addresses, browsing history and documents uploaded with a job application. The declared purposes are account and subscription management, communication with partners and suppliers, customer service, recruitment, optimisation of its sites and platforms, developing the customer relationship, statistics and analysis, satisfaction surveys, newsletters and marketing on consent, distributing content on social media and complying with the law. The legal bases cited are GDPR Article 6(1)(b), (c), (f) and (a). Sensitive data is not processed in principle, unless a user supplies it themselves. Cookies fall into necessary, statistical, preference and marketing categories, the last only on explicit consent, and Ritzau states that marketing cookies serve neither the resale of data nor the building of individual cross-platform profiles. IT subprocessors are used for operation and support but none is named. Nowhere on the site is there any statement about customer content being used to train AI models, and no opt-out is documented.

Data retention & training

Hosting summary

No hosting jurisdiction is declared. Neither the privacy policy, nor the terms of business, nor any product page states in which country or region customer data is stored. The nearest statement is that transfers outside the EU/EEA may occur when third-party services are used, framed by the European Commission's standard contractual clauses, an adequacy decision or Article 49(1); the policy also notes that subprocessors may provide support from outside the EU even when the data itself stays inside it. No named list of subprocessors is published, and no security certification — ISO 27001, SOC 2 or ISAE — is claimed anywhere. One technical observation, not a publisher statement: the via.ritzau.dk site resolves to 52.222.136.88, an Amazon address (AS16509) geolocated in Ashburn, United States. That is where the public portal is served from and says nothing about where customer data or press release content is stored. Anyone with hosting requirements should ask Ritzau directly and have the answer written into the data processing agreement.