Data controller	Technical University of Denmark (DTU)
WAsP support	The WAsP Team can be contacted using the WAsP Contact Form at wasp.dtu.dk/support or by email to wasp-software-support@dtu.dk. You may also send a letter to: DTU Wind and Energy Systems, Risø Campus, Frederiksborgvej 399, 4000 Roskilde, Denmark, Att.: WAsP Team
Data Protection Officer	You may contact the Data Protection Officer (DPO) if you have any questions to our handling of your personal data. Send an email to dpo@dtu.dk or call the DPO at + 45 45252525. You may also send a letter to: DTU, Anker Engelunds Vej 1, Building 101A, 2800 Kongens Lyngby, Denmark, Att.: Data Protection Officer (DPO)
Privacy notice	wasp.dtu.dk/download/wasp-software-privacy-notice

2. Our handling of your personal data

This notice explains how DTU processes personal data in connection with the WAsP Software and related services, in accordance with Article 13 of the General Data Protection Regulation (GDPR).

It covers personal data processed when you download files from our distribution server, when you use the WAsP Software, when you use the associated online services provided by DTU, and when you communicate with us in connection with sales, licensing, or support.

It does not cover data processed by third-party software, which you may use in conjunction with WAsP (such as windPRO, WindFarmer, or WindFarmer: Analyst).

Visits to DTU websites (including wasp.dtu.dk) are subject to DTU's privacy statement at dtu.dk.

3. Infrastructure and Hosting

All personal data described in this notice are processed and stored on systems operated by DTU or by trusted service providers acting on DTU's behalf (including Microsoft services).

DTU aims to use services hosted within the European Economic Area (EEA). Where personal data are processed outside the EEA, DTU ensures that appropriate safeguards are in place in accordance with GDPR, such as standard contractual clauses or other approved mechanisms.

4. IP Address Logging

All connections to DTU servers — whether from the WAsP Software or when downloading from wasp.dtu.dk — result in your IP address being recorded in standard server logs. Where IP addresses are also recorded in application databases, this is noted (in sections 6 and 8.3).

Purpose	To monitor system usage, ensure network and information security, detect and prevent misuse, and support troubleshooting
Legal basis	Legitimate interests (Art. 6(1)(f) GDPR) – network security monitoring and abuse prevention
Retention	180 days (all server logs)
Access	WAsP technical staff only

5. File Downloads

When you download files (such as the WAsP Suite installer) from our distribution server, the following data are recorded regardless of how the download link was obtained:

• Date and time of the download
• The download link identifier
• Whether the download was granted

Download links are either publicly available on wasp.dtu.dk or distributed directly to specific individuals or groups. In the latter case, DTU can determine whether and when the link has been used. Recipients of directly distributed links are informed of this in the accompanying communication.

Purpose	To manage software distribution, verify download activity, ensure service availability, and prevent misuse of download links
Legal basis	Legitimate interests (Art. 6(1)(f) GDPR) – monitoring download availability and preventing abuse
Application database	Link identifier, timestamp, IP address, granted/denied
Retention	2 years
Access	WAsP technical staff only

6. Licence Verification

When you register and activate a licence, and periodically thereafter, the software contacts DTU's licence server to verify your licence. The following data are transmitted and logged:

• Your licensed username
• Your machine name or network identifier (note: this may contain personal data, for example if your computer is named after you)
• Your IP address
• Software major version
• Timestamp

DTU's retention policy for these data is 4 years after licence expiry. The licence server database currently contains records predating this privacy notice; this will be addressed at the next system migration.

Purpose	To verify licence validity, enforce licensing terms, and ensure that access to the software is limited to authorised users
Legal basis	Contract performance (Art. 6(1)(b) GDPR) – licence verification is necessary to deliver the licensed service
Application database	Username, machine name, IP address, major version, timestamp
Retention	4 years after licence expiry
Access (server)	Restricted group, DTU Wind and Energy Systems
Access (data)	WAsP technical staff only

7. Software Update Checks

WAsP Software periodically checks whether a newer version is available. The following data are transmitted to DTU's update server:

• Your licensed username
• Your currently installed software version

Purpose	To determine whether software updates are available and to inform users about relevant updates, including security and functionality improvements
Legal basis	Legitimate interests (Art. 6(1)(f) GDPR) – enabling users to benefit from security, and feature updates
Application database	Username, version, timestamp
Retention	1 year
Access	WAsP technical staff only

8. Online Services

The following online services can be accessed from within the WAsP Software. They are optional and are only used when you explicitly initiate the relevant function within the software.

8.1 Data and maps

When you import wind data (Generalised Wind Climate files), vector maps (orography, roughness and displacement height data layers), or other input data through the WAsP Software's online data services, the following data are transmitted to DTU's data server and recorded in a usage log:

• Your licensed username
• Timestamp
• The requested geographic location

Purpose	To deliver requested data services, monitor service usage, and support capacity planning and service improvement
Legal basis	Legitimate interests (Art. 6(1)(f) GDPR) - service monitoring and capacity planning
Application log	Location, timestamp and licenced username
Retention	1 year
Access	WAsP technical staff only

8.2 Spectral Correction Method calculations (WAsP Engineering)

When you use the Spectral Correction Method service, the following data are transmitted to DTU's SCM server and recorded:

• Your licensed username
• Your IP address
• Calculation input data (location and local spectra), stored in encrypted form that cannot be decrypted without your consent

Purpose	To process and deliver requested calculation services and maintain operational records of service usage.
Legal basis	Contract performance (Art. 6(1)(b) GDPR) – necessary to deliver the requested calculation service
Application database	Username, IP address, timestamp, calculation status
Retention	1 year
Access	WAsP technical staff only

8.3 CFD calculations (WAsP CFD)

When you request a CFD calculation, the calculation request — including your licensed username and the map data needed for the calculation — is transmitted to a calculation server operated by EMD International A/S.

DTU does not control EMD's server infrastructure or logging practices. For information about how EMD processes your data, please refer to EMD's privacy notice at emd-international.com.

Purpose	To process and deliver requested CFD calculation services through an external provider
Legal basis	Contract performance (Art. 6(1)(b) GDPR) – necessary to deliver the requested calculation service
Systems	Calculation requests are transmitted to EMD International A/S, which acts as an independent data controller for the processing performed on its systems
Data categories	Licensed username and calculation input data (including map data required for the calculation)
Retention	DTU does not control retention on EMD’s systems; users are referred to EMD’s privacy notice for further information
Access	Access to submitted data is determined by EMD International A/S in accordance with their own policies

9. Sales, Licensing, Invoices and Customer Management

When you contact DTU for help with sales, licensing, or invoices, the following data may be collected and stored:

• Name and email address
• Company and job-related information
• Licence numbers and licence details (including creation and expiry dates)
• Records of communication (including email correspondence)
• Notes and internal comments related to customer interactions
• Files and documents (e.g. licence copies, quotations, submitted forms, screenshots)
• Records of licence creation, modification, trial licences, and renewals

Personal data processed by DTU may also include unstructured information contained in free-text communications (such as emails) and attachments submitted by users. Such data are processed only where necessary for the relevant purpose.

These data are collected directly from individuals (for example via email, website forms, and support requests), from organisational representatives acting on behalf of customers, and through website orders and internal administrative processes related to licensing and sales.

The purposes of this processing include managing customer relationships and licence ownership, processing orders and issuing software licences, communicating with customers and responding to enquiries, and providing licence administration such as updates, corrections, renewals, and licence-related support actions. Personal data are also used for sending invoices and managing payments, maintaining records of quotations, agreements, and transactions, and supporting evaluation activities such as trial licences and academic requests.

Purpose	Customer relationship management, licence administration, order processing, communication, invoicing, and record-keeping
Legal basis	Legal obligation (Art. 6(1)(c) GDPR) - necessary for compliance with bookkeeping and other legal requirements Contract performance (Art. 6(1)(b) GDPR) - necessary to provide licences, fulfil orders, and deliver related services Legitimate interests (Art. 6(1)(f) GDPR) - customer management, communication, administrative record-keeping, and service improvement
Systems	Microsoft Dynamics 365 CRM; internal licensing systems; Microsoft Outlook email; spreadsheets and shared folders; website order system (Umbraco)
Data categories	Contact details; company information; licence data; communication records; documents and attachments; internal notes
Retention	Retained as long as necessary for customer relationship management, contractual obligations, and legal requirements
Access	Restricted to relevant DTU staff on a need-to-know basis

10. Support

When you contact DTU for technical support, the following data are collected and stored in our support system:

• Your name and email address
• The content of your support case
• Any licence or details you provide
• Ongoing email correspondence and communication history
• Any files, screenshots, or attachments you provide
• Any notes related to your support case

Support is provided by email and is not initiated automatically by the WAsP Software. Support interactions may include additional personal data provided by the user, for example in email messages or attached files. DTU does not require such data but may process it where necessary to resolve the support case.

DTU’s retention policy for support data is 3 years after case closure. The support system currently contains records predating this privacy notice; this will be addressed at the next system migration.

Purpose	To provide support, resolve user issues, and maintain a record of support interactions
Legal basis	Legitimate interests (Art. 6(1)(f) GDPR) – providing support and maintaining support history
Systems	Microsoft Dynamics 365 CRM; FogBugz; Microsoft Outlook email
Data categories	Name, email, content, licence, details, email correspondence and communication history, files, screenshots, attachments, and notes
Retention	3 years after case closure
Access	WAsP technical staff only

11. Your Rights

Under GDPR you have the following rights in relation to the personal data DTU holds about you:

• Right of access - you can request a copy of the data we hold about you
• Right to rectification - you can ask us to correct inaccurate data
• Right to erasure - you can ask us to delete your data in certain circumstances
• Right to restriction - you can ask us to limit how we use your data
• Right to object - you can object to processing based on legitimate interests
• Right to data portability - you can ask for your data in a portable format

To exercise any of these rights, contact DTU using the details given in section 1 (“Who we are”).

You also have the right to lodge a complaint with the Danish data protection supervisory authority:

Authority	Datatilsynet
Website	datatilsynet.dk
Email	dt@datatilsynet.dk

12. Changes to This Notice

DTU may update this privacy notice from time to time. The current version is always available at wasp.dtu.dk/download/wasp-software-privacy-notice. The date at the top of this notice indicates when it was last updated.

Significant changes will be communicated to users through wasp.dtu.dk or through the WAsP Software itself.