Privacy Policy for customers and cooperation partners

Processing of personal data on customers, cooperation partners, and others

 

Revised on August 14, 2023

 

1. Introduction

In the course of our day-to-day operations, Nordjyllands Beredskab collects and stores a number of personal data on customers, cooperation partners, and others; both in connection with Nordjyllands Beredskab’s sale and supply of services to customers and in connection with our purchase of goods and services for our business.

Nordjyllands Beredskab is strictly aware of processing all personal data in a confidential and secure manner. In this policy, you can read more about the guidelines for our processing of the personal data collected by us when you contact us or enter into agreements with us. 

Our processing of your personal data complies with the current requirements, including the protective provisions, applying pursuant to the data protection legislation in force from time to time.

Under the current data protection legislation, Nordjyllands Beredskab is considered the data controller in respect of the personal data submitted by you to us. Below, you will find all contact information required:

Nordjyllands Beredskab
Thomas Boss Gade 6
DK-9000 Aalborg
CVR reg.no. (DK) 37084166

The contact person responsible for inquiries concerning Nordjyllands Beredskab’s processing of personal data is our chief of staff, whom you can contact on email dpo@nobr.dk  

Nordjyllands Beredskab has made an agreement with the Law Office of HjulmandKaptain, represented by Assistant Attorney Lóa Skau Björnsson, concerning the function as data protection officer (DPO).

You may contact our data protection officer on email: lbj@70151000.dk

2. Processing of personal data

Nordjyllands Beredskab uses cookies on our website to obtain information about your conduct on and use of the website. Our cookie policy specifies what information we collect by means of cookies and how we handle such information. You can always find our cookie policy, which is freely available on our website, by clicking on details.

When you contact us, we will process the personal data specified in your inquiry. Consequently, we recommend that you only submit the personal information required for our processing of your inquiry.

For the purpose of our agreement with you, we need to process your contact information, including your name, address, email address, telephone number, and delivery address.

Sensitive personal data on customers, e.g. information on race, religion, political affiliations, union memberships, health status data, etc., are never registered. 

If the customer is a company, we only process personal data on the contact person associated with the company, viz. the contact’s name, direct email and telephone number.

We collect the above information directly from you in connection with our conclusion of an agreement. However, if you are a former customer of us, and you order a new service, we use the information already registered on you, provided this has not been deleted. The accuracy of the information will, however, always be verified.

The purpose of processing the above personal information is to enable us to administer and invoice for the agreement made, to document the performance of the work, and to handle the warranty obligation resting with Nordjyllands Beredskab under the terms and conditions agreed with the individual customer. 

Phone calls for the emergency operations centre

All phone calls for the emergency operations centre are recorded and saved, see the rules of the Danish Data Protection Agency.

As soon as the call is put through to a local number or mobile, the conversation will no longer be recorded.

The call is automatically deleted after 30 days.

Live video recordings from the site of injury

The emergency operations centre may evaluate that live video is useful for making the best decisions about an operation. As agreed with the notifier, an SMS is sent to the notifier’s mobile, and the notifier may click on the link sent and accept the terms. When the connection is turned off, Nordjyllands Beredskab has no access to the notifier’s mobile camera.

All recordings are stored with Nordjyllands Beredskab’s data processor, Incendium, and deleted automatically after 30 days. The system is controlled in reference to the individual employee’s access for the purpose of ensuring that only employees with a work-related requirement has access to the information.

Course participants

In reference to course activities, Nordjyllands Beredskab registers and processes personal information by way of the participant’s name, civil registration number, email, and telephone number for the purpose of registering the participant enrolled on the team, preparing diplomas, etc.

Such information is stored only in a secured place on a computer with restricted access and in a network with secured access and firewalls. An automatic deletion period of 6 years is set up from the individual end date of all kinds of courses, which therefore complies with the current rules on the area in reference to storing.

On commencement of the course, all participants will receive our ”Privacy policy for customers and cooperation partners”.

Participants in first aid courses

As a participant in a first aid course, your name, civil registration number, and email address will be registered in the diploma system of Dansk Førstehjælpsråd (the Danish First Aid Council) in order for the diplomas to be printed by the end of the course.

The participants may either enter their own data in the Council’s diploma system or request Nordjyllands Beredskab to do so. Nordjyllands Beredskab deletes the information after entry and has subsequently no access to it. If the participants enter their own data in the system, Nordjyllands Beredskab has no access to it.

When the participants log in the diploma system for the first time, they are introduced to the rules applying to the processing of personal data, and the participants are then free to decide whether they will accept these rules. Dansk Førstehjælpsråd is the data controller in respect of the information in the diploma system.

A diploma for attending and completing a course is valid for 24 months. If the participants update their diplomas, the period will be extended.

When the deadline approaches, the participant will receive an email drawing the participant’s attention to the approaching expiry of the diploma and the deletion thereof in the system.

All data on the participant will be deleted after 36 months, counting from the date of the participant’s first log-in – if the participant does not actively participate in any maintenance courses.

Participants in GWO courses

If you participate in a GWO course, your personal data will be registered in the diploma system, WINDA, which is managed by Global Wind Organisation.

As the data controller, Global Wind Organisation deletes and stores itself all personal data submitted.

The participants create their own profile in WINDA, entering their personal data such as their names, addresses, emails, and telephone numbers. On creation, participants must accept the current GDPR rules applying to the system.

Each participant receives from the system a personal WINDA number, which is submitted to Nordjyllands Beredskab’s instructor on commencement of the course for the purpose of registration of the individual participant on the right team. In this way, Nordjyllands Beredskab becomes the data processor on behalf of WINDA, this function being subject to regular audits. Nordjyllands Beredskab has only such rights enabling us to enter participants in the system.

Further, the participants’ health status data are required to be stored for 36 months.

Nordjyllands Beredskab scans and registers information on the participants’ health status data in a secured ESDH system supplied with rights management. The information is discarded according to the current rules on the area, and the ESDH system is set up to delete such information after 36 months.

Handling of injury lists

Nordjyllands Beredskab has associated volunteers, who are subject to duties of confidentiality etc. according to contracts entered into with Nordjyllands Beredskab.

Volunteers with updated first aid competences may act as first aiders in events tendered for by Nordjyllands Beredskab. In connection with such events, citizens may be injured. Based on the incident, a list of the injury may be prepared. Such lists are subsequently registered in Nordjyllands Beredskab’s ESDH system, where the documents are deleted automatically according to the rules applying to the requirements of limitation. On disclosure requests, the proper list may be sent to the citizen, e.g. in connection with an injury claim.

Environmental accounts

Nordjyllands Beredskab discloses information on the tortfeasor to one of our owner municipalities and to the Danish Road Directorate in case of an environmental accident on the national roads. In connection with such environmental accidents on the roads, Nordjyllands Beredskab stores personal data by way of name, address, and registration number when issuing an invoice to the polluter in cooperation with the municipality/the Road Directorate.

Similar personal data are stored when Nordjyllands Beredskab invoices directly to the tortfeasor.

Nordjyllands Beredskab has evaluated that photos of a car’s registration number is only taken for professional purposes when required in a specific situation. Such photo is taken with the team leader’s mobile and is subsequently transferred to the emergency report (”ODIN”), which is a closed system with restricted user access, and is then deleted from the mobile.

Data in invoices are stored for 5 years on a share with restricted access, see the Danish Bookkeeping Act. Only Nordjyllands Beredskab’s staff has access to this share.

Storage period

Nordjyllands Beredskab stores only personal data as long as required and to comply with the purpose for which they are collected.

Personal data on customers, cooperation partners, and suppliers are stored as long as there is still a customer relationship/cooperation.

After the end of the customer relationship or the cooperation, the personal data are stored as long as required to document the agreement and the correspondence concerning the subject-matter for the purpose of fulfilling the warranty obligation resting with Nordjyllands Beredskab.

Further, all bookkeeping records are always stored for 5 years after the end of the financial year in which the bookkeeping was performed to comply with the Bookkeeping Act.

3. Disclosure

Nordjyllands Beredskab does not disclose your personal data, unless we are required by law. Nordjyllands Beredskab may disclose your personal data to our auditors and lawyers in case of a requirement for audit or legal assistance to solve specific tasks or disputes, where it is relevant to include the personal data concerned.

Apart from this, Nordjyllands Beredskab does not disclose any personal data on customers, cooperation partners, or suppliers.

4. Safeguards

Nordjyllands Beredskab treats all personal data as confidential, and Nordjyllands Beredskab has taken a number of technical and organisational safeguards to protect personal data against accidental or illegal destruction, forfeiture, or deterioration and to prevent them from coming to the knowledge of unauthorized persons or from being misused or otherwise processed contrary to the data protection legislation.

We save your personal data on computers with restricted access located in controlled facilities, and our safeguards are controlled regularly. In addition, we take regular backups of all our electronic data, and we have protected ourselves by having installed e.g. antivirus software and firewalls.

5. Data subjects' rights

In the above, we describe the personal data processed by Nordjyllands Beredskab on customers, cooperation partners, and others, because we are obligated to give you such information.

If you are of the opinion that we process inaccurate or misleading data about you, you are entitled to request rectification thereof. Upon receipt of a subject access request, we will consider whether to rectify the data.

In some situations, Nordjyllands Beredskab is obligated to delete your personal data. This applies e.g. if we have no longer any purpose of processing the personal data, or if you withdraw your consent, and we have no other basis for processing your personal data. Therefore, if you wish to request us to delete your personal data or withdraw your consent to us, you only need to contact us.

Further, you are always entitled to object against our processing of your personal data. If we receive any such objection, we will evaluate if we must restrict the processing of your personal data while evaluating the objection. In addition, you are in some situations entitled to request delivery of your personal data in a machine-readable format (data portability).

If you wish to exercise your rights, please send us a subject access request. You will find our contact information on our website.

In addition to this, you may also complain to the Danish Data Protection Agency about the processing of your personal data.