Website, customers and business partners
1.1 Helm is the trading name of BullWall Group A/S, CVR no. 37800171, and the group companies listed in section 2 (together "Helm", "we", "us" or "our"). These terms do not mean that the group constitutes a single legal entity or a single data controller. The relevant controller depends on the processing activity, as described in section 2. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Danish Data Protection Act and, for individuals in the United Kingdom, the UK GDPR.
1.2 Your data security is important to us, and we therefore emphasise that your personal data is handled in a responsible manner. Below you can read how we process personal data about you when we act as data controller. You can also read about your rights in connection with our processing.
2.1 In connection with the operation of our business, we process a range of personal data. We do this in order to provide you with the best possible service. We mainly collect and process general (non-sensitive) personal data.
2.2 BullWall Group A/S develops our software and is the data controller for our websites, marketing, events and social media. Where another group company has a contract with you or your organisation, for example a licence agreement, that company is data controller for the processing linked to that contract.
2.3 The group companies are:
BullWall Group A/S, CVR no. 37800171, Bredgade 33C, 1., 1260 København K, Denmark
BullWall Denmark A/S, CVR no. 38878786, Bredgade 33C, 1., 1260 København K, Denmark
BullWall Limited, company no. 11166803, Salisbury House, 5th Floor, London Wall, London EC2M 5QQ, United Kingdom
BullWall Inc., 251 Little Falls Drive, Wilmington, Delaware 19808, USA
2.4 We are registering the Helm name for each company. Until the registration is complete, the companies keep the legal names above. BullWall Limited is our establishment in the United Kingdom for the purposes of the UK GDPR.
2.5 If you have any questions regarding our processing of your personal data, please contact us here:
BullWall Group A/S (Helm)
CVR: 37800171
Company address: Bredgade 33C, 1., 1260 København K
Contact information:
Email: privacy@helmsecurity.ai
3.1.1 We can process personal data about you in several different situations. Read more about our processing below.
3.2.1 When you visit our website, www.helmsecurity.ai (www.bullwall.com redirects to it), or use our other online services (e.g. Meta, X, LinkedIn and YouTube), we may process information about your IP address as well as information about your computer, device, and browser.
3.2.2 We also process personal data that you provide to us in connection with your use of the website or our online services, for example when you use our contact, demo request or support forms, including your name, business email address and organisation, and other information you provide to us.
3.2.3 We process information about your visit (e.g., information about how you access our websites, how you navigate around them, which pages you visit, content you view, your searches, etc.). Personal data is collected through cookies, log files and other technologies. You can read more about our use of cookies here: www.helmsecurity.ai/cookie-policy
3.2.4 Our website also includes social media plug-ins, including for LinkedIn, X and YouTube, which allow you to share content from our website on those platforms. These plug-ins may place cookies on your device, but only if you actively click on the relevant social media icon. Please refer to our Cookie Policy for further information, including applicable retention periods.
3.2.5 We process your personal data to enable us to make relevant products, deliveries and services ("Services") available to you and to improve your experience of our websites, online services, and the Services we offer. We also use the personal data to show you content on our and other websites based on your activities and preferences and to limit the number of times you see the same content.
3.2.6 Our legal basis for processing is our legitimate interests in making our website (and online services) available to you cf. Article 6(1)(f) of the General Data Protection Regulation. Our basis for processing may also be based on your consent cf. Article 6(1)(a) of the General Data Protection Regulation and Section 3 of the Danish Executive Order on Cookies.
3.2.7 We use Google reCAPTCHA on our forms to protect them against spam and abuse, based on our legitimate interest in securing the website cf. Article 6(1)(f) of the General Data Protection Regulation.
3.2.8 We store personal data collected in connection with your visit to our website for the periods stated for each cookie in our cookie policy. After this, the personal data will be deleted. For information about storage of personal data collected in connection with cookies, please refer to our cookie policy.
3.2.9 We store personal data you give us in a website form for up to twelve (12) months after our last contact with you, unless you have consented to receive our marketing or the data becomes part of a customer or partner relationship described below.
3.3.1 When you are our customer, we process personal data about your name, job title, business email address and telephone number, the organisation you work for, orders, licences, invoicing and payment details, correspondence, information from publicly available sources and other information you provide to us. Section 3.4 explains how we process personal data when our software runs in your IT environment, when we provide support and when we issue licences.
3.3.2 We process personal data for customer administration and contract management purposes, including invoicing, maintaining customer records, quality management, statistics, and providing customer service, marketing, and sales activities.
3.3.3 Our legal basis for processing is the agreement with you cf. Article 6(1)(b) of the General Data Protection Regulation or our legitimate interests in managing your personal data as a customer with us cf. Article 6(1)(f) of the General Data Protection Regulation.
3.3.4 We store personal data about our customers for the duration of the customer relationship. After the end of the customer relationship, personal data is generally stored in accordance with the Danish Bookkeeping Act for a subsequent period of five (5) years from the end of the financial year to which the accounting material relates.
3.4.1 Our software is installed and runs within your own IT environment. We do not host the software and do not have access to your IT environment. We do not access or otherwise process the personal data analysed, monitored or stored by the software as part of its ordinary operation. Accordingly, we do not act as data processor in relation to your use of the software. Any processing of personal data performed through the software is subject to your own privacy notice.
3.4.2 We provide support without accessing your IT environment. If you choose to send us log files or other material in connection with a support case, our agreement with you requires that the material does not contain personal data. If we nevertheless receive personal data in such material, we do not use it for any purpose and delete it without undue delay.
3.4.3 If you believe our software processes personal data about you at work, please contact your employer. If you contact us, we will pass your request to your employer and help it respond.
3.4.4 When you contact our support, we process your name, contact details and the content of your request. To issue and manage licences, we process the name and contact details of the licence administrator, licence keys, the number of licensed units and activation details. Our software verifies its licence automatically against our licence service. This exchange contains only a licence identifier and a server identity token and no personal data. Our software may also send us technical data about its version, configuration, alerts and errors. This technical data does not contain personal data. We use the data to provide support, administer licences, verify usage and handle renewals.
3.4.5 Our legal basis for processing is the agreement with you cf. Article 6(1)(b) of the General Data Protection Regulation and our legitimate interests in providing support and administering licences cf. Article 6(1)(f) of the General Data Protection Regulation.
3.4.6 We store support tickets and licence data for the duration of the customer relationship. After the end of the customer relationship, personal data is generally stored in accordance with the Danish Bookkeeping Act for a subsequent period of five (5) years from the end of the financial year to which the accounting material relates.
3.5.1 When you receive marketing communications, including newsletters, we process personal data about your name, business email address, job title, organisation and country. We also process information about your marketing or communication preferences, your use of the marketing we send to you (including, for example, whether you have opened an email from us, whether the email has been read and which links you have opened), and any other information you provide to us.
3.5.2 We process your personal data for the purpose of marketing our company and Services, and for setting up and managing your marketing subscription. We use the personal data about your preferences and usage to understand the way customers receive our marketing messages and to improve our marketing to you and other customers going forward.
3.5.3 We will only send you marketing material by email, text messages or other electronic means once we have obtained your consent where this is required under the Danish Marketing Practices Act. If you are an existing customer and gave us your email address in connection with a purchase, we may send you marketing by email about our own similar products and services without prior consent. You can unsubscribe free of charge in every email.
3.5.4 Our legal basis for sending newsletters and marketing to you is your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation, which you have consented to under the Danish Marketing Practices Act. For existing customers, our legal basis is our legitimate interest in marketing our similar products and services cf. Article 6(1)(f) of the General Data Protection Regulation and Section 10(2) of the Danish Marketing Practices Act.
3.5.5 We collect your consent when you sign up on our website, at events or through LinkedIn lead forms. We record when and how you gave your consent.
3.5.6 If you withdraw your consent to receive our newsletters and marketing, you will not receive any further marketing from us. We may continue to contact you if we have a legal basis for this in other contexts.
3.5.7 We store personal data about you as recipients of our marketing as long as the contact is active, and you have not withdrawn your consent. If you withdraw your consent, documentation of the original consent will be stored for two years from the date of withdrawal in accordance with the guidelines and requirements of the Danish Consumer Ombudsman. Our legal basis for processing this documentation is our legal obligation under Article 6(1)(c) of the General Data Protection Regulation.
3.6.1 We also use personal data about you to show you content on our and other sites based on your activities and preferences to limit the number of times you see the same content, and to measure the effectiveness of our content and marketing.
3.6.2 Our basis for processing may also be based on your consent cf. Article 6(1)(a) of the General Data Protection Regulation and Section 3 of the Danish Executive Order on Cookies.
3.6.3 We also use information about your use of our news and marketing emails for statistical purposes in anonymized form.
3.7.1 When you visit our social media profiles e.g., X, LinkedIn and YouTube (Google), we may process personal data about you that you have made available on our social media, your reactions to our posts, your sharing thereof and comments to our posts.
3.7.2 We process your personal data for the purposes of making content available on social media, including responding to your inquiries.
3.7.3 When using X, we have entered into a joint data controller agreement that clarifies the roles and responsibilities between the parties. The agreement can be read here.
3.7.4 When using LinkedIn, we have likewise entered into a joint data controller agreement regarding Page Insights that clarifies the roles and responsibilities between the parties. The agreement can be read here.
3.7.5 When using YouTube, we and Google generally act as independent controllers.
3.7.6 Please note that the relevant social media platforms process personal data in accordance with their own privacy policies. We therefore encourage you to review the privacy policies available on the respective platforms for further information about their processing of your personal data.
3.7.7 Our basis for processing is our legitimate interests in making content available and promotion through social media in accordance with Article 6(1)(f) of the General Data Protection Regulation.
3.7.8 We store direct messages you send us via social media only for as long as necessary to respond to your inquiry and delete them no later than three (3) months thereafter.
3.7.9 We do not determine the retention period for posts, comments, and reactions published on our social media pages, as such content is subject to the relevant platform's retention policies.
3.8.1 When you register and participate in events organised by us, we process personal data about your name, email, job title, organisation and country/region.
3.8.2 We process this personal data for the purpose of managing the event, compile participant lists, share materials from events and for security reasons, as well as to be able to send you relevant material.
3.8.3 Our legal basis for processing is our legitimate interests in holding events cf. Article 6(1)(f) of the General Data Protection Regulation or your consent cf. Article 6(1)(a) of the General Data Protection Regulation and Section 10 of the Danish Marketing Practices Act.
3.8.4 We store personal data about participants in events for twelve (12) months after the event, unless you have consented to receive our marketing.
3.9.1 When you are a business partner, supplier, or a contact person of a business partner/supplier, we process personal data about you such as your name, job title, business telephone number and email address as well as publicly available information and other information you provide to us.
3.9.2 We process personal data for the purpose of contract management, partner programme administration and deal registration, receiving goods and services from our suppliers and business partners, and where appropriate to fulfil agreements with our customers.
3.9.3 Our legal basis for processing is the agreement with you cf. Article 6(1)(b) of the General Data Protection Regulation or our legitimate interests in managing the relationship with you/the company you represent as a business partner/supplier cf. Article 6(1)(f) of the General Data Protection Regulation.
3.9.4 We store the personal data about business partners and/or suppliers for as long as it is necessary in accordance with the contract. After the end of the collaboration, the personal data is generally stored in accordance with the Danish Bookkeeping Act for a subsequent period of five (5) years from the end of the financial year to which any accounting material relates.
3.10.1 When participating in online meetings with us, we may process personal data about you, including your name, contact details, image, voice, and any information shared during the meeting. In certain cases, the meeting may be recorded and transcribed using a note-taking tool.
3.10.2 We process personal data for the purpose of documenting discussions, decisions, action points and agreements made during the meeting and to facilitate efficient follow-up on the matters discussed.
3.10.3 Our legal basis for processing is our legitimate interest in documenting and managing our business meetings and related activities cf. Article 6(1)(f) of the General Data Protection Regulation. Where a meeting is recorded, participants will be informed prior to the recording and may object to the recording taking place.
3.10.4 We store recordings and transcripts only for as long as necessary to document the meeting and follow up on the matters discussed but no longer than twelve (12) months, after which they are deleted or anonymised.
3.11.1 We may enrich the personal data described above with information from other sources. This can be publicly available information – including information that we get from commonly available sources.
3.11.2 Personal information that we have collected for the purposes described above may also be processed by us for the purposes of complying with laws and regulations which we are subject to in the course of operating our business or in order to comply with various reporting or disclosure obligations under applicable laws and regulations cf. Article 6(1)(c) of the General Data Protection Regulation.
3.11.3 If we sell all or part of our business or sell or transfer our assets or is otherwise involved in a merger or transfer of all or a substantial part of our business, we may transfer your personal data to the party or parties involved in the transfer as part of the transaction where we are permitted to by law cf. Article 6(1)(c) and 6(1)(f) of the General Data Protection Regulation.
3.11.4 Finally, we may process your personal data to enforce or defend our or third parties' legal rights or legitimate interests, where necessary, objectively, and proportionally cf. Article 6(1)(c) and 6(1)(f) of the General Data Protection Regulation.
4.1 We may disclose your personal data to other suppliers and/or service providers in the ordinary course of our business as well as to our group affiliates.
4.2 We may also disclose your personal data to a public authority and external advisors such as auditors and lawyers in situations where we are specifically obliged to disclose your personal data pursuant to legislation and notification obligations to which we are subject. If there is a need to report a matter to the police, we may disclose your personal data to the police.
4.3 It may for example be necessary to disclose personal data to the following recipients:
Public authorities, including for example the Danish Tax Agency, the Danish Data Protection Agency or the police
Banks and other financial institutions, e.g., in connection with the execution of payments
Insurance companies, e.g., in connection with taking out insurance or handling insurance claims
External advisors, including lawyers, auditors and consultants, in connection with specific advice, disputes or contractual matters
Partners and distributors involved in your organisation's purchase, in connection with orders, licensing and support
4.4 We try to limit the disclosure of personally identifiable information and thus the disclosure of information that can be attributed to you personally.
4.5 We may also disclose your personal data to data processors. Our data processors only process your personal data for our purposes and under our instructions.
4.6 Our main data processors provide office and collaboration software (Microsoft 365), customer relationship management and marketing automation (HubSpot), website analytics (Google Analytics, Microsoft Clarity), website visitor identification (Leadfeeder, ZoomInfo), online advertising (LinkedIn, Google, Microsoft, Meta), meeting recording and transcription (Fireflies.ai), electronic signatures (Docusign), accounting (e-conomic), expense management (Pleo), IT operations (itm8) and website hosting.
5.1.1 In connection with our processing of your personal data, we may transfer your personal data to countries outside the EU/EEA (third countries).
5.1.2 Your personal data may be transferred to countries where the European Commission has determined that the level of data protection is equivalent to that in the EU/EEA (secure third countries).
5.2.1 We may also transfer your personal data to unsecure third countries. The transfer of your personal data to unsecure third countries will be based on the Standard Contractual Clauses (SCC) adopted by the European Commission to ensure an adequate level of protection or, for companies established in the United States, the company's certification under the EU-U.S. Data Privacy Framework (DPF).
5.2.2 We assess the adequacy of the transfer basis and adopt additional measures if they are necessary to ensure an adequate level of protection for the transfer.
5.2.3 Our transfer of personal data may be made to the following categories of recipients:
HubSpot, Inc., USA, for customer relationship management and marketing automation. Our HubSpot account is hosted in the EU, and HubSpot may access data from the USA for support and operations (DPF).
Google LLC, USA, for website analytics, advertising and spam protection (DPF), and LinkedIn Corporation, USA, for advertising and lead forms (DPF).
Microsoft Corporation, USA, for office and collaboration software, website analytics (Clarity) and advertising (Bing) (DPF), and Fireflies.ai Corp., USA, for recording and transcribing online meetings (SCC).
Meta Platforms, Inc., USA, for advertising (DPF), and ZoomInfo Technologies LLC, USA, for website visitor identification (DPF or SCC).
BullWall Inc., USA, our US group company, for sales and support to customers in North America (SCC).
5.2.4 You can read more about the transfer of personal data to countries outside the EU/EEA on the European Commission's website. You can also find an overview of US companies registered with the DPF here: https://www.dataprivacyframework.gov/s/participant-search.
5.2.5 If you would like further information about our transfer of personal data to countries outside the EU/EEA, please contact us.
6.1.1 When your personal data is no longer needed, we will ensure that it is deleted in a secure manner.
6.1.2 It is our policy to protect personal data by taking adequate technical and organisational security measures.
6.1.3 We have implemented security measures to ensure data protection for all personal data that we process. We conduct regular internal follow-ups on the adequacy of and compliance with policies and measures.
7.1.1 As a data subject, you have certain rights under the General Data Protection Regulation. If you want to exercise your rights, please contact us.
7.1.2 You may – unconditionally and at any time – withdraw your consent. You can do so by sending us an email (see email address above). Withdrawal of your consent will not have any negative impact. However, this may mean that we cannot meet specific requests from you in the future. Withdrawal of your consent will not affect the lawfulness of the processing based on consent before it is withdrawn. Furthermore, it will not affect any processing carried out on another lawful basis.
7.1.3 You can also – unconditionally and at any time – object to our processing when it is based on our legitimate interests.
7.1.4 Your rights also include the following:
Right of access: You have the right to access the personal data we process about you.
Right to rectification: You have the right to obtain rectification of any inaccurate and incomplete personal data about you.
Right to erasure (right to be forgotten): In exceptional cases, you have the right to obtain erasure of information about you before the time when we would normally delete your personal data.
Right to restriction of processing: In certain situations, you have the right to restrict the processing of your personal data. If you have the right to restrict the processing of your personal data, we may only process personal data in the future – apart from storage – with your consent, or for the establishment, exercise or defence of legal claims, or to protect an individual or important public interests.
Right to object: In certain situations, you have the right to object to our processing of your personal data, and always if the processing is for direct marketing purposes.
Right to data portability: In certain situations, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have such personal data transferred from one data controller to another.
Right to lodge a complaint: You can lodge a complaint at any time with the Danish Data Protection Authority about our processing of personal data.
Right to complain in the United Kingdom: If you are in the United Kingdom, you can also lodge a complaint with the Information Commissioner's Office (www.ico.org.uk).
7.1.5 See more at www.datatilsynet.dk where you can also find further information on your rights as a data subject.
7.1.6 We respond to your request within one month. If your request is complex or you send many requests, we may extend the deadline by two further months and tell you why.
8.1 From time to time it will be necessary to update this Privacy Policy. We will review our Privacy Policy on a regular basis in order to ensure that it is updated, valid and in accordance with current legislation and the principles for processing of personal data. We will publish new versions of the policy on our website.
8.2 This policy has version no. 2.0 and is valid from 2 November 2026. It replaces the privacy policy previously published under the BullWall name.
