PRIVACY POLICY FOR THE ALFA GROUP

1. General principles for the protection of personal data

The ALFA Group and its various subsidiaries (ALFA) acknowledge and respect the rights of the individual to protection of personal data in pursuance of national and European Union law. ALFA will ensure that any processing of personal data by companies in the Group or on their behalf complies with the fundamental processing principles for the protection of the personal data of natural persons.

Lawfulness, fairness
ALFA will process personal data in a lawful and fair manner and in compliance with the rights of the data subjects under the legislation in force from time to time.

Transparency
When collecting personal data from persons or other sources, ALFA will ensure that the data subject is appropriately informed in accordance with applicable legislation: A data subject is entitled to be informed at any time of the personal data being processed about him or her.

Purpose limitation
ALFA will only process personal data for explicit and legitimate purposes. Personal data will only be used for the purposes for which they were initially collected.

Data minimisation
ALFA will ensure that only personal data that are adequate, relevant and strictly necessary for the specific purpose are processed.

Accuracy
ALFA will ensure that personal data processed by ALFA are accurate and up-to-date at all times, and any inaccurate personal data will be rectified or deleted where possible.

Storage limitation
ALFA will ensure that personal data are not stored or otherwise processed for longer than is necessary for the specific purpose, unless otherwise provided by other legislation.

Integrity and confidentiality
ALFA will take appropriate organisational and technical measures to ensure that any risk of loss, leakage, damage to and/or disappearance of personal data is minimised to the greatest extent possible.

2. Responsibility for personal data

Who are we ALFA is a real estate group engaging in project development and the sale and letting of residential and non-residential properties. You may contact any of the Group’s companies by using the contact details below.

In the course of ALFA’s business, we collect and process information about natural persons (personal data). We collect and process data to be able to provide the best possible service and the best possible solutions for our clients, buyers, tenants, business partners, etc. of the group companies, to comply with legal requirements and to meet the contractual obligations of the group companies.

Data controller
Each company of the ALFA Group is the data controller in respect of the personal data collected and processed by the relevant company in connection with the use of the services offered by the companies by private individuals. The collection and processing of personal data is necessary for us to be able to offer these services to users.

3. Purpose of and legal basis for the processing of personal data

Purpose
We register and process data about you to be able to offer you the best possible service in connection with your business with ALFA, to perform our agreements with you and to comply with any statutory requirements applying to individual group companies in the course of their day-to-day operations.

This means that we register and process your personal data in the event of the following:

  • Where you sign up for a service providing general information about the Group’s business such as a newsletter, a reservation list, etc.
  • Where you make or consider making an agreement with us concerning a service.
  • Where you have purchased or sold a residential or a non-residential property from or to a company in the ALFA Group.
  • Where you have rented a residential or a non-residential property from a company in the ALFA Group.
  • Where we are legally bound to collect and process your personal data.
  • Where you have given us separate consent to process your personal data for a specific purpose.
  • Where it is necessary for purposes of pursuing ALFA’s legitimate interests, for instance to prevent abuse or financial loss, to strengthen IT security, etc.

Legal basis
ALFA processes personal data to meet each individual group company’s contractual obligations to customers, buyers, tenants, business partners, etc., see Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Moreover, ALFA processes personal data in cases where ALFA is obligated to do so pursuant to applicable legislation, see Article 6(1)(c) of the General Data Protection Regulation (GDPR).

In some instances, we process personal data for the purpose of pursuing the legitimate interests of a group company. Where the processing is based on this principle of the balancing of interests, cf. GDPR Article 6(1)(f), it is due to the fact that we assess our interests in the Group providing optimal services – for instance in addition to the Group’s primary services – and IT security override the interests of the person(s) whose personal data are being processed.

Moreover, we process personal data based on the data subject’s clear and unambiguous consent, cf. section 11(2)(2) in the Danish Data Protection Act and GDPR Article 6(1)(a) and 9(2)(a) with consent being obtained prior to the specific processing activity.

The right to withdraw consent
Consent given for the processing of personal data may be withdrawn at any time. Withdrawal of consent is effective for future personal data processing operations. If consent is withdrawn, it will therefore not affect the lawfulness of any processing based on the consent prior to its withdrawal, or where there is an alternative legal basis for the processing operation in question.

4. Personal data processed by ALFA

The companies in the ALFA Group register and use different categories of personal data depending on the services provided by the company in question or its contractual obligations, including:

  • Basic personal data such as name and contact details
  • Civil registration number
  • Financial information such as credit rating information obtained in connection with the renting of a residential unit
  • Information about your family and household
  • Proof of identity such as photocopies of health insurance cards and photo ID

Sensitive personal data
ALFA only processes sensitive personal data under certain strict circumstances and only if absolutely necessary for providing appropriate services. Prior to processing sensitive personal data, ALFA will obtain explicit consent for a specified processing operation in respect of the data concerned, unless the right to register sensitive personal data is authorised by law.

ALFA registers sensitive personal data such as health information, for instance whether you are a wheelchair user, where this is relevant in the context of your housing needs when selling and/or renting out residential units.

5. When and how personal data are processed

ALFA processes personal data in connection with providing services and commercial relations with clients, buyers, tenants, etc., including in connection with:

  • Negotiation of contracts, preparation of sale- and lease agreements and the completion and execution thereof.
  • Registration in reservation lists, lists of prospective buyers and tenants, etc. and showings and open house viewings.
  • Release of newsletters and ongoing campaigns, competitions, etc.

ALFA also process personal data in connection with other activities related to certain services, including:

  • Customer service and administration.
  • Development and administration of services and ALFA’s business.
  • Marketing of services and products.
  • To protect ALFA and its business against fraud. and
  • To meet statutory requirements.

ALFA collects personal data in the following situations:

  • Where you fill in forms on websites owned by ALFA and
  • When receiving personal data in writing, over the phone or otherwise directly from a data subject on or without request.

6. Third parties and the processing of personal data

Personal data collected from third parties
ALFA processes personal data collected from third parties, including from:

  • Public registers such as the Public Information Server (OIS), the land registry and other publicly available sources. ALFA registers and uses this information, e.g. for preparing and checking standard material included in contracts concerning the purchase, sale or lease of real property;
  • Credit rating agencies. We register and process relevant financial information in connection with the conclusion of agreements concerning the lease of residential properties;
  • Real estate agents in connection with the conclusion of agreements on the purchase or sale of real property or the registration of indications of interest and reservations in relation to the purchase or sale of real property;
  • Real estate agents and administration companies in connection with the conclusion of agreements concerning lease of residential and/or non-residential premises; and
  • advisers and other representatives in connection with the conclusion of contracts within the Group’s business area.

Disclosure of personal data to third parties
ALFA will in certain circumstances share personal data with certain third parties in and outside the Group, including in the following situations:

  • In connection with an agreement on the purchase of additional services when purchasing a residence, your personal data will be disclosed to relevant third parties for purposes of performing the purchase of additional services.
  • Personal data will be disclosed to utility companies and property administrators in connection with the sale or letting of real property.
  • In connection with the completion of a purchase or sale of real property, including registration of the conveyance document and other documents, ALFA will disclose your civil registration number to the Danish Land Registration Court.
  • Personal data will be disclosed to public authorities and third parties where the companies in the Group are under an obligation to do so pursuant to applicable legislation or to protect vital interests.
  • Personal data will be disclosed within the Group and to external business partners (including advisers and banks) to the extent there are legitimate grounds for the processing, such as consent, a legal obligation or the like.
  • Personal data will be disclosed to the Group’s IT business partners and suppliers in connection with IT support, hosting, operation and maintenance of IT solutions, etc. Where the Group uses data processors, such use will be based on a contract that ensures compliance with applicable data protection rules (data processor agreement).
  • Personal data will be disclosed to third parties in connection with the sale of real property, either by way of a direct sale or as part of the transfer of a business, where the personal data concern the tenants of the relevant property.

7. The rights of the data subject

Where ALFA processes personal data about you, you may at any time exercise the following rights by contacting ALFA:

Right to access personal data (right of access)
You have the right to obtain access to the data ALFA processes about you as well as other information, such as the sources of the data and the purposes for which the data is used. You can request information about the length of time for which your data is stored and information on who receives data about you, to the extent that ALFA (lawfully) discloses personal data to third parties.

Right to rectification (correction)
You have the right to have any inaccurate or incomplete data about you rectified.

Right to deletion (“right to be forgotten”)
Under certain circumstances, you have the right to have personal data about you deleted before our usual time limit for deletion. The right to deletion must be assessed considering any restrictions under applicable legislation or any rights of the company to process data.

Right to restriction of processing
In certain situations, you have the right to restriction of the processing of your personal data. If you are entitled to restriction of processing, we may only process your personal data going forward – except for storage – with your consent, or for purposes of establishing, exercising or defending legal claims or protecting a person or important public interests.

Right to transmit data (data portability)
In certain situations, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those data transmitted from one data controller to another without hindrance.

Right to object
In certain situations, you have the right to object to our lawful processing of your personal data. You may also object to the processing of your data for direct marketing purposes.

8. Storage period

ALFA will only keep personal data for as long as is permitted under the data protection legislation in force from time to time i.e. as long as is necessary to achieve the purpose for which the data has been collected. At the end of this period, the data will be deleted as a matter of course.

As the storage period depends on the specific circumstances of each processing operation, it is not possible to state a general storage period. For processing operations involving a potential liability for the data subject or ALFA as the data controller, the storage period will be consistent with the rules of the Danish Limitation Act.

Where continuing contracts are concerned, including contracts concerning the leasing of real property, personal data are stored for the term of the contract plus ten years.

Applications for vacant positions will be stored for a maximum of six months.

9. Right to complain

If you are dissatisfied with ALFA’s registration and use of your personal data, you can lodge a complaint with the Danish Data Protection Agency as the supervisory authority: Datatilsynet, Carl Jacobsens Vej 35, DK-2500 Valby, Denmark, e-mail: dt@datatilsynet.dk.

10. Other terms

Amendments to the privacy policy
This data protection and privacy policy may be amended in response to new legal requirements, new data protection practices or changes to the services offered by ALFA. In case of material changes, you will be notified through our services or in a similar efficient way to allow you, as a data subject, to review the changes before they become effective.

Security measures
As part of ALFA’s general data protection efforts, the Group’s IT security is monitored and updated on an ongoing basis in order to identify potential vulnerabilities and attacks to minimise the risk of security breaches to the greatest extent possible.

ALFA regularly updates and implements technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, or change. These security measures also serve to protect personal data against unauthorised sharing, leakage, abuse and any other processing in violation of applicable data protection legislation.

Contact
If you have any questions regarding your rights and how your personal data are processed by the companies in the group, please do not hesitate to contact ALFA. You can contact any company in the ALFA Group via ALFA Development A/S, Knud Højgaards Vej 2, 3rd floor, DK-2860 Søborg, Denmark, tel.: (+45) 39 200 250, e-mail: info@alfadev.dk.

- ALFA Development A/S