B2B website visitor identification in Denmark

Datatilsynet, the Danish Data Protection Agency, is the supervisory authority for processing under the GDPR and the Databeskyttelsesloven. It investigates complaints, publishes detailed guidance and issues public criticism, but it does not itself impose administrative fines — those are pursued through the ordinary courts via the police and the public prosecutor. That architecture means Datatilsynet's published guidance carries unusual weight in commercial reviews: buyers routinely quote it directly, and a vendor that can point to the same guidance and show how its product fits within it will move through a Danish review much faster than one that simply asserts compliance.

The Databeskyttelsesloven is a supplementary act, not a separate regime: it fills the gaps the GDPR deliberately leaves to member states, covering processing of national CPR identification numbers, processing in an employment context, journalistic and research exemptions, and the digital age of consent, which Denmark set at 13 rather than the default 16. For company-level website visitor identification none of those national additions actually change the operative requirements — the governing rules remain the GDPR's own: a documented lawful basis, transparent information to visitors, and a written data processing agreement with any processor, lead.box included.

The Danish cookie order — the executive order on information and consent for storing and accessing information on end-user terminal equipment — implements the ePrivacy rule and requires clear information plus prior consent before anything is stored on or read from a visitor's device, unless it is strictly necessary to deliver a service the visitor requested. lead.box identifies the visiting company from network-level information rather than by placing an identifier on the device, so it sits outside the scope of that consent requirement. Assessing the rest of your site's cookies and scripts, and documenting the consents your banner collects, remains a task for you as the site operator, not for lead.box.

In ISO-certified EU data centres, with no transfer outside the EU/EEA as part of the standard setup. Datatilsynet has been unusually vocal about processing location, particularly around the use of non-EU cloud infrastructure in the Danish public sector, and that scrutiny has raised the bar for what Danish B2B buyers expect a vendor to be able to document. The data processing agreement and a versioned list of sub-processors are published so your reviewer can check exactly where data flows before anyone signs anything, rather than taking a verbal assurance on trust.

Every active Danish company is registered with a CVR number in the Central Business Register (Det Centrale Virksomhedsregister), and that register is what makes company-level identification genuinely useful in Denmark: a resolved visitor can be matched against public CVR data to confirm the legal entity, industry code and address behind a domain before a rep ever picks up the phone. It also matters on the receiving end — when your own company appears in someone else's identification data, the same CVR-linked registry is how a Danish counterpart would be able to describe your organisation accurately, so accuracy at that level is treated as a baseline expectation, not a nice-to-have.

Company-level website visitor identification does not process personal data about employees and is not employee monitoring, so it does not, on its own, trigger the information and consultation duties that apply under the Danish cooperation agreement (samarbejdsaftalen) between DA and LO or an individual samarbejdsudvalg. Where it can become relevant is if a Danish organisation later links identified companies to individual contact enrichment or feeds outbound activity into performance tracking for sales staff — those downstream uses are workplace-monitoring questions the customer needs to assess internally, separately from the identification service itself, and lead.box's role stops at company-level data.

Danish B2B procurement is pragmatic: a short vendor questionnaire, a look at the data processing agreement and sub-processor list, and a check of where the answers to Datatilsynet's own guidance points land — done in days rather than weeks for a tool at this scale. On the tooling side, Danish sales teams commonly run HubSpot, Pipedrive or Microsoft Dynamics 365, and identified companies need to reach whichever of those is already in daily use rather than sit in a separate dashboard nobody opens. A webhook or native CRM handover that pushes named companies straight into the pipeline your team already works from is what actually gets adopted.

You add one JavaScript snippet to your site, and identified companies typically start appearing within the first day of traffic — no server changes, no cooperation from IT beyond a tag-manager or code edit. From there you can route matches to CRM via webhook, export lists as CSV, Excel or JSON for a sales or marketing run, and add teammates as seats as adoption grows. If the tool does not earn its place, cancellation is self-service from account settings with no retention call or contract negotiation required, which matches how Danish buyers expect to be able to leave a subscription as easily as they entered it.