Privacy Policy for Møller & Rothe
– regarding the processing of personal data.

Contents:

• 1. Definitions
• 2. Organization and Responsibility
• 3. Employee Instructions
  • 3.1 Ensuring Legal Basis
  • 3.2 Ensuring Purpose and Data Relevance
  • 3.3 Ensuring Disclosure Obligation
  • 3.4 Ensuring the Right to Access
  • 3.5 Ensuring the Right to Rectification
  • 3.6 Deletion Obligation and Ensuring the Right to Deletion
  • 3.7 Ensuring the Right to Restricted Processing
  • 3.8 Ensuring the Right to Data Portability
  • 3.9 Ensuring the Right to Object
  • 3.10 Data Processing Agreements
  • 3.11 Ensuring Documentation
  • 3.12 Data Security
  • 3.13 Physical Security
  • 3.14 Guests
  • 3.15 Printing and Documents with Personal Data
  • 3.16 Ensuring Employee Awareness
  • 3.17 Notification in Case of Data Security Breach
  • 3.18 Privacy by Design and Privacy by Default
  • 3.19 DPO

Privacy Policy for Møller & Rothe.
This document has two purposes: Firstly, to serve as a practical tool in our work with the protection of personal data, and secondly, as written documentation of our efforts to comply with the General Data Protection Regulation (GDPR). Møller & Rothe’s privacy policy is developed in alignment with our overall strategy, values, and visions and is thus an integral part of how we operate. The policy is approved by the management, and all employees are made aware of it and their responsibilities regarding personal data. If there is any suspicion that personal data is not being handled correctly, the nearest manager must be contacted and informed about the issue. The privacy policy is reviewed and updated every year. Upon hiring, all new employees are made aware of the privacy policy and must confirm their understanding of it by signing their employment contract.

1. Definitions
Møller & Rothe processes personal data in connection with our business operations and customer administration. Below are key terms from the legislation to facilitate the understanding of the privacy policy.

General Data Protection Regulation (GDPR): The legislation that, as of May 25, 2018, regulates the processing of personal data (replacing the Danish Data Protection Act).

Personal Data: Any information about an identified or identifiable natural person, such as name, address, phone number, image, license plate, CPR number, or similar. Information about sole proprietorships is also considered personal data.

Sensitive Personal Data: For example, health information, union membership, race, ethnicity, political views, information about criminal offenses, etc.

Data Subject: All individuals whose data is registered with Møller & Rothe, such as customers, employees, and suppliers.

Data Processing: Everything the company does with data, including storage and deletion.

Data Controller: The entity that decides the purposes, scope, and methods of processing personal data.

Data Processor: The entity that processes data on behalf of the data controller, such as a company handling payroll or a cloud service provider.

2. Organization and Responsibility
This privacy policy applies to Møller & Rothe. The responsibility for ensuring that all employees comply with the privacy policy rests with them and management. Compliance with the policy must be documented in writing and kept by Jan Gelbjerg-Hansen (CEO). If control reveals that the policy has not been adhered to, it is management’s responsibility to address the issue.

3. Employee Instructions
The following are specific rules and guidelines that all employees of Møller & Rothe must follow in relation to the processing of personal data. The instructions are based on the requirements of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act and, together with other documentation and guidelines, ensure compliance with the regulation. Each item in the instructions is divided into purpose (why we do it), procedure (how we do it), and control (did we do it correctly?).

3.1 Ensuring Legal Basis
Purpose: To ensure a legal basis for processing data.
Procedure: Before processing personal data begins, the legal basis for the processing must be clarified. This is done by the process owner. As a general rule, we will use the fulfillment of a contract for customers and suppliers and refer to validly obtained consent, legitimate interest, or legal obligation for our employees.

3.2 Ensuring Purpose and Data Relevance
Purpose: The data collected should be based on a clear purpose and should not exceed what is necessary to fulfill the purpose of the processing.
Procedure: For each processing activity, we define which personal data is relevant for the purpose, and ensure that no more data than necessary is collected to support this purpose.

3.3 Ensuring Disclosure Obligation
Purpose: To ensure transparency in the processing of personal data and the data subjects’ knowledge of their rights.
Procedure: Upon employment, all employees are informed through their employment contract about: who is the data controller and their contact details, the purpose of processing data, the legal basis for processing, and our legitimate interests, any other recipients of the data, including transfers to third countries, the retention period for the data, the data subject’s rights in relation to data (access, correction, deletion, restriction of processing, and data portability), the right to withdraw any given consent, the right to complain to the Danish Data Protection Agency, the obligation to provide data and the consequences of not doing so, where the data was obtained if not from the data subject, the scope of automated decisions, including profiling and the logic behind it.

3.4 Ensuring the Right to Access
Purpose: To ensure that the data subject can access their own information.
Procedure: Upon request, the data subject shall be provided with access to the data registered about them, including the purpose of processing, the categories of data processed, any other recipients of the data, including transfers to third countries, the retention period, and the data subject’s rights (access, correction, deletion, restriction of processing, and data portability).

3.5 Ensuring the Right to Rectification
Purpose: To ensure that the data subject can correct any inaccurate information about them.
Procedure: Upon request from the data subject, we will correct any incorrect or misleading information.

3.6 Deletion Obligation and Ensuring the Right to Deletion
Purpose: Data will be deleted when no longer necessary for the purpose of processing.
Procedure: In the “Record of Processing Activities,” retention periods for each processing activity are defined. Personal data is stored centrally on designated drives and systems to minimize the spread of personal data within the organization and facilitate the deletion process.

3.7 Ensuring the Right to Restricted Processing
Purpose: To restrict the processing of personal data to storage only.
Procedure: When a data subject requests that their data processing be restricted, the data subject’s information will be limited to storage only until the issue causing the restriction is resolved.

3.8 Ensuring the Right to Data Portability
Purpose: To allow personal data processed automatically to be delivered or transferred in a structured, commonly used, and machine-readable format.
Procedure: When a data subject requests their data to be delivered or transferred, the request will be directed to Jan Gelbjerg-Hansen (CEO), who will ensure that the data is provided in the desired format or transferred to a new data controller.

3.9 Ensuring the Right to Object
Purpose: To accommodate the data subject’s right to object to profiling and direct marketing.
Procedure: When a data subject indicates that they do not want their data used for profiling or direct marketing, the processing of their data for such purposes will be immediately stopped.

3.10 Data Processing Agreements
Purpose: To ensure that data processing agreements are in place with those processing personal data on our behalf.
Procedure: Data processing agreements are in place with any parties that process personal data on our behalf. Each new contract with a partner is assessed to determine if it involves processing personal data. If so, a data processing agreement is signed.

3.11 Ensuring Documentation
Purpose: To meet the GDPR’s requirement for a record of processing activities and impact assessment.
Procedure: We have a record of processing activities that can be found with Jan Gelbjerg-Hansen (CEO). The record is updated regularly when there are changes to the company’s processing activities.

3.12 Data Security
Purpose: To establish necessary organizational and technical measures to prevent unauthorized access or loss of personal data.
Procedure: Access to electronic personal data is limited. Only those employees who need access to personal data to perform their duties have access.

3.13 Physical Security
Purpose: To ensure no unauthorized access to areas where personal data is processed.
Procedure: Areas with access to personal data are secured to prevent unauthorized access.

3.14 Guests
Purpose: To ensure guests are managed securely.
Procedure: Guests who need to stay for extended periods or be alone in the premises will be registered, and must not be left alone.

3.15 Printing and Documents with Personal Data
Purpose: To prevent personal data from being left unattended in paper form.
Procedure: Printouts containing personal data should not be left unattended in the printer room. Documents with personal data must be securely disposed of in locked containers.

3.16 Ensuring Employee Awareness
Purpose: To ensure employees are familiar with the rules for handling personal data.
Procedure: All new employees must sign a confidentiality agreement upon hire and be made aware of the rules for processing personal data and IT security.

3.17 Notification in Case of Data Security Breach
Purpose: To notify the Danish Data Protection Agency and, in some cases, the data subject, within 72 hours of detecting a data security breach.
Procedure: A data security breach is defined as an event that likely results in unauthorized access to or loss of personal data.

3.18 Privacy by Design and Privacy by Default
Purpose: To meet the GDPR’s requirement for privacy by design and default.
Procedure: When developing or acquiring new IT systems, we ensure that systems are secure and support the separation of access rights to protect personal data.

3.19 DPO
Purpose: To assess whether the company needs a Data Protection Officer (DPO).
Procedure: It is assessed annually whether the company needs a DPO based on the GDPR’s criteria. Upon the introduction of these guidelines in May 2018, it was determined that Møller & Rothe does not require a DPO.