Privacy policy for the ALFA Group

ALFA will only process personal data for explicit and legitimate purposes. Personal data will only be used for the purposes for which they were initially collected.

Data minimisation
ALFA will ensure that only personal data that are adequate, relevant and strictly necessary for the specific purpose are processed.

Accuracy
ALFA will ensure that personal data processed by ALFA are accurate and up-to-date at all times, and any inaccurate personal data will be rectified or deleted where possible.

Storage limitation
ALFA will ensure that personal data are not stored or otherwise processed for longer than is necessary for the specific purpose, unless otherwise provided by other legislation.

Integrity and confidentiality
ALFA will take appropriate organisational and technical measures to ensure that any risk of loss, leakage, damage to and/or disappearance of personal data is minimised to the greatest extent possible.

Purpose
We register and process data about you to be able to offer you the best possible service in connection with your business with ALFA, to perform our agreements with you and to comply with any statutory requirements applying to individual group companies in the course of their day-to-day operations. This means that we register and process your personal data in the event of the following:
- Where you sign up for a service providing general information about the Group's business such as a newsletter, a reservation list, etc.
- Where you make or consider making an agreement with us concerning a service.
- Where you have purchased or sold a residential or a non-residential property from or to a company in the ALFA Group.
- Where you have rented a residential or a non-residential property from a company in the ALFA Group.
- Where we are legally bound to collect and process your personal data.
- Where you have given us separate consent to process your personal data for a specific purpose.
- Where it is necessary for purposes of pursuing ALFA's legitimate interests, for instance to prevent abuse or financial loss, to strengthen IT security, etc.

Legal basis
ALFA processes personal data to meet each individual group company's contractual obligations to customers, buyers, tenants, business partners, etc., see Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Moreover, ALFA processes personal data in cases where ALFA is obligated to do so pursuant to applicable legislation, see Article 6(1)(c) of the General Data Protection Regulation (GDPR).

In some instances, we process personal data for the purpose of pursuing the legitimate interests of a group company. Where the processing is based on this principle of the balancing of interests, cf. GDPR Article 6(1)(f), it is due to the fact that we assess our interests in the Group providing optimal services – for instance in addition to the Group's primary services – and IT security override the interests of the person(s) whose personal data are being processed.

Moreover, we process personal data based on the data subject's clear and unambiguous consent, cf. section 11(2)(2) in the Danish Data Protection Act and GDPR Article 6(1)(a) and 9(2)(a) with consent being obtained prior to the specific processing activity.

The right to withdraw consent
Consent given for the processing of personal data may be withdrawn at any time. Withdrawal of consent is effective for future personal data processing operations. If consent is withdrawn, it will therefore not affect the lawfulness of any processing based on the consent prior to its withdrawal, or where there is an alternative legal basis for the processing operation in question.

ALFA processes personal data collected from third parties, including from:
- Public registers such as the Public Information Server (OIS), the land registry and other publicly available sources. ALFA registers and uses this information, e.g. for preparing and checking standard material included in contracts concerning the purchase, sale or lease of real property;
- Credit rating agencies. We register and process relevant financial information in connection with the conclusion of agreements concerning the lease of residential properties;
- Real estate agents in connection with the conclusion of agreements on the purchase or sale of real property or the registration of indications of interest and reservations in relation to the purchase or sale of real property;
- Real estate agents and administration companies in connection with the conclusion of agreements concerning lease of residential and/or non-residential premises; and
- advisers and other representatives in connection with the conclusion of contracts within the Group's business area.

Disclosure of personal data to third parties
ALFA will in certain circumstances share personal data with certain third parties in and outside the Group, including in the following situations:
- In connection with an agreement on the purchase of additional services when purchasing a residence, your personal data will be disclosed to relevant third parties for purposes of performing the purchase of additional services.
- Personal data will be disclosed to utility companies and property administrators in connection with the sale or letting of real property.
- In connection with the completion of a purchase or sale of real property, including registration of the conveyance document and other documents, ALFA will disclose your civil registration number to the Danish Land Registration Court.
- Personal data will be disclosed to public authorities and third parties where the companies in the Group are under an obligation to do so pursuant to applicable legislation or to protect vital interests.
- Personal data will be disclosed within the Group and to external business partners (including advisers and banks) to the extent there are legitimate grounds for the processing, such as consent, a legal obligation or the like.
- Personal data will be disclosed to the Group's IT business partners and suppliers in connection with IT support, hosting, operation and maintenance of IT solutions, etc. Where the Group uses data processors, such use will be based on a contract that ensures compliance with applicable data protection rules (data processor agreement).
- Personal data will be disclosed to third parties in connection with the sale of real property, either by way of a direct sale or as part of the transfer of a business, where the personal data concern the tenants of the relevant property.

Right to access personal data (right of access)
You have the right to obtain access to the data ALFA processes about you as well as other information, such as the sources of the data and the purposes for which the data is used. You can request information about the length of time for which your data is stored and information on who receives data about you, to the extent that ALFA (lawfully) discloses personal data to third parties.

Right to rectification (correction)
You have the right to have any inaccurate or incomplete data about you rectified.

Right to deletion ("right to be forgotten")
Under certain circumstances, you have the right to have personal data about you deleted before our usual time limit for deletion. The right to deletion must be assessed considering any restrictions under applicable legislation or any rights of the company to process data.

Right to restriction of processing
In certain situations, you have the right to restriction of the processing of your personal data. If you are entitled to restriction of processing, we may only process your personal data going forward - except for storage - with your consent, or for purposes of establishing, exercising or defending legal claims or protecting a person or important public interests.

Right to transmit data (data portability)
In certain situations, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those data transmitted from one data controller to another without hindrance.

Right to object
In certain situations, you have the right to object to our lawful processing of your personal data. You may also object to the processing of your data for direct marketing purposes.

Where continuing contracts are concerned, including contracts concerning the leasing of real property, personal data are stored for the term of the contract plus ten years.

Applications for vacant positions will be stored for a maximum of six months.

Amendments to the privacy policy
This data protection and privacy policy may be amended in response to new legal requirements, new data protection practices or changes to the services offered by ALFA. In case of material changes, you will be notified through our services or in a similar efficient way to allow you, as a data subject, to review the changes before they become effective.

Security measures
As part of ALFA's general data protection efforts, the Group's IT security is monitored and updated on an ongoing basis in order to identify potential vulnerabilities and attacks to minimise the risk of security breaches to the greatest extent possible.

ALFA regularly updates and implements technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, or change. These security measures also serve to protect personal data against unauthorised sharing, leakage, abuse and any other processing in violation of applicable data protection legislation.

Contact
If you have any questions regarding your rights and how your personal data are processed by the companies in the group, please do not hesitate to contact ALFA. You can contact any company in the ALFA Group via ALFA Development A/S, Knud Højgaards Vej 2, 3rd floor, DK-2860 Søborg, Denmark, tel.: (+45) 39 200 250, e-mail: info@alfadev.dk.

- ALFA Development A/S