Privacy Policy
Here, you can read how DTU Science Park A/S handles personal data.
How DTU Science Park processes your data
As a data controller, DTU Science Park processes information about customers, employees, partners, job applicants, former customers, event participants, and individuals who subscribe to DTU Science Park’s newsletters.
DTU Science Park’s privacy policy is prepared in accordance with the requirements of the European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).
The legal entity responsible for processing your data is:
DTU Science Park A/S
Agern Alle 5A
2970 Hørsholm
Phone: 45 86 41 00
Email: [email protected]
Types of information
The information DTU Science Park processes about you depends on your specific connection to DTU Science Park.
If you are a (former) customer, partner, event, case, or program participant, or subscriber to DTU Science Park’s newsletters.
DTU Science Park will typically process information such as your name, address, email address, telephone number, occupation, company name (your employer/sole proprietorship), and account and payment details if you are making a purchase.
If you are an event, case, or program participant, we may also process photographs or videos taken during the event in which you appear.
If you are an employee or job applicant
In addition to the above information, DTU Science Park will typically process details about your professional qualifications and personal competencies, diplomas, previous employment, photo, date of birth, your next of kin, CPR number (Danish personal identification number), salary, absence records, and in certain cases, health information.
Sources of your data
We receive most of the information directly from you, but we may also collect data from publicly available sources, your previous employers (if you have given consent), our partners, and public authorities, including the Danish Tax Agency (SKAT).
Purpose and retention period
Depending on your connection to DTU Science Park, we process your information for various purposes.
If you are a (former or potential) customer, partner, or event, case, or programme participant
We process your and your company’s information to fulfil our contractual obligations (cf. GDPR Article 6(1)(b)), including communication, service delivery, and event management, or to pursue our or third parties’ legitimate interests, such as negotiating and entering into contracts and marketing events (cf. GDPR Article 6(1)(f)).
If you are a case participant, we obtain your consent to process your data (cf. GDPR Article 6(1)(a)).
We process and store your data until the contractual relationship has ended and then for three years to ensure appropriate documentation.
We store your data in photos, videos, and audio for events, cases, and programmes as long as necessary to achieve the purpose. In this context, we consider whether continued storage accurately represents DTU Science Park’s events, cases, and programmes and whether newer material can replace it.
If you subscribe to DTU Science Park’s newsletters
With your prior consent, we process your data to send you newsletters (cf. GDPR Article 6(1)(a)).
We process and store your data until you withdraw your consent, for example, by unsubscribing from the newsletter.
If you are a job applicant
As a job applicant, we process your information to assess your suitability for a position at DTU Science Park and to enter into an employment contract with you (cf. GDPR Article 6(1)(b) and (f)).
If we wish to obtain references from your current or previous employers or retain your application for a potential future position, we will obtain your consent (cf. GDPR Article 6(1)(a)).
We process and store your data until the recruitment process is completed, and we have finally assessed your application. In some instances, we may retain your data to ensure appropriate recruitment process documentation.
If you are an employee
We process your information to manage your employment with DTU Science Park, including ensuring appropriate development, salary payments, workplace safety, etc. (cf. GDPR Article 6(1)(b) and (f)).
If we wish to place photos or videos of you on our website, or if we need to obtain your criminal record, we will request your consent (cf. GDPR Article 6(1)(a)).
Additionally, we may process your information, including salary details and CPR number, to comply with our legal obligations under tax legislation (cf. GDPR Article 6(1)(c) and the Danish Data Protection Act §11(2), no. 1).
In some instances, we may also process health information about you, such as medical certificates and other necessary information, to fulfil our obligations as an employer (cf. GDPR Article 9(2)(b) and the Danish Data Protection Act §12).
We process and store your personal data for as long as you are employed at DTU Science Park and for up to 5 years after your employment ends.
Disclosure of your data
We may disclose your information to partners, including advisors and auditors, and when using external data processors, such as IT and cloud providers, payroll administrators, and marketing solution providers, including press and media agencies. If photos or videos of you are included in our marketing materials, we may make these available to the public, for example, on our website or posters, or by uploading them to social media platforms, notably Meta’s platforms (e.g., Facebook and/or Instagram), Google’s platforms, and LinkedIn.
We will also disclose your information to the Danish Tax Agency (SKAT) if you are an employee.
DTU Science Park will only disclose your information if we are obligated to do so by law or to perform a task in the public interest.
Your rights
If DTU Science Park processes information about you, you have several rights as a data subject:
- You can request access to, rectify or delete your data.
- You also have the right to object to the processing of your data and, in some instances, to request the restriction of processing.
- You have an unconditional right to object to processing your personal data for direct marketing purposes.
- If the processing is based on your consent, you can withdraw your consent at any time. Your withdrawal will not affect the lawfulness of processing before the withdrawal.
- You have the right to receive the personal data you have provided in a structured, commonly used, and machine-readable format (data portability).
- You can always complain to a data protection supervisory authority like the Danish Data Protection Agency.
This privacy policy was last updated on 23 September 2024.