Privacy & Cookie Policy

FOR GLOBAL BOILER AALBORG A/S

Last updated: 24.06.2024

Data Controller

We are responsible for the processing of personal data regarding our customers and partners. Our contact information is as follows:

Company Name: Global Boiler Aalborg A/S

Address: Lejrevej 7, 9230 Svenstrup J

CVR No.: 33503849

Contact Email: service@globalboiler.com

Contact Person: Dann Hove Andersen

Website Visits

When you visit our website, we use cookies to ensure that the website functions correctly. You can find more details about our cookie policy in our cookie policy.

Communication with Potential Customers

When you contact us via contact form, email, or phone to get information about our services, we process the personal data you provide us so that we can respond to your inquiries and provide you with relevant information about our services. We typically process the following ordinary data: name, email, and phone number.

We have a legal basis for processing these data under GDPR Article 6(1)(f). We delete your communication with us as soon as it is clear whether you want our services or not. In special cases where storage is necessary, we will indicate the reason for this.

Customers

To ensure the proper delivery of our services, we communicate with our customers and process information about them, such as name, address, services, special agreements, and payment information. The legal basis for processing these data is GDPR Article 6(1)(b). When the service is delivered and any outstanding issues are resolved, we promptly delete the personal data.

Accounting

We are obliged to keep accounting documents according to the Accounting Act. This includes storing invoices and similar documents, which may contain ordinary personal data such as name, address, and description of services. The legal basis for processing personal data for accounting purposes is GDPR Article 6(1)(c).

We store these data for at least 5 years after the end of the relevant financial year.

Job Applications

We receive and evaluate job applications for employment in our company. The legal basis for processing personal data in connection with job applications is GDPR Article 6(1)(f).

If you send an unsolicited application, we will evaluate the application and delete your data if there is no match. If you apply for an advertised job, your application will be deleted after the right candidate is hired.

If you participate in a recruitment process or are hired, you will receive separate information on how we process your personal data in this context.

Data Processors

We cooperate with external suppliers and data processors, including system providers, consultants, IT hosting, and marketing services. Data processors must comply with our standards for data protection and security to protect your personal data.

Disclosure of Personal Data

We do not disclose your personal data to third parties.

Profiling and Automated Decisions

We do not engage in profiling or use automated decisions.

Transfers to Third Countries

We primarily use data processors within the EU/EEA or outside the EU/EEA that can offer appropriate protection of your personal data. We always ensure that appropriate measures are in place to protect your personal data when transferred to third countries.

Processing Security

We implement appropriate technical and organizational measures to protect the processing of personal data. This includes risk assessments and continuous updates of our procedures and staff training on GDPR.

Rights of Data Subjects

You have certain rights under GDPR concerning the processing of your personal data. If you wish to exercise your rights, please contact us.

Right of Access: You have the right to access the data we process about you and additional information about the processing.

Right to Rectification: You have the right to have incorrect data about you corrected.

Right to Erasure: Under certain circumstances, you have the right to have your data deleted before our regular deletion time.

Right to Restriction of Processing: Under certain circumstances, you have the right to restrict the processing of your personal data.

Right to Object: Under certain circumstances, you have the right to object to our otherwise lawful processing of your personal data, including direct marketing.

Right to Data Portability: Under certain circumstances, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer this data from one data controller to another without hindrance.

You can read more about your rights in the Danish Data Protection Agency’s guidance on data subjects’ rights, which you can find on the Data Protection Agency’s website.

Withdrawal of Consent

If our processing of your personal data is based on your consent, you have the right to withdraw your consent.

Complaint to the Data Protection Agency

If you are dissatisfied with our processing of your personal data, you have the right to file a complaint with the Data Protection Agency. You can find the Data Protection Agency’s contact information on their website.

We encourage you to familiarize yourself with GDPR to stay updated on the rules. This privacy policy is part of our efforts to protect your personal data and ensure compliance with applicable data protection legislation.

Security Breaches

To strengthen our commitment to data protection and comply with GDPR requirements, we have implemented clear security breach procedures. These steps are designed to handle situations where our data security may have been compromised.

A security breach can range from the loss of a laptop to unauthorized access to our data systems. It is important to understand that any loss, alteration, unauthorized access, or leakage of personal data is considered a security breach.

Steps for Reporting Security Breaches:

Detection: Identifying a potential security breach.

Reporting: Immediate reporting to the data protection officer.

Investigation: Conducting a thorough investigation of the security breach.

Confirmation: Confirming whether it is a security breach.

Notification: If it is a serious breach, the affected parties and relevant authorities will be notified within 72 hours.

Role Distribution:

Data Protection Officer: Responsible for coordinating response and notification.

IT Security Officer: Leading technical investigations and corrective actions.

Management Level: Decision-making regarding response and resources.

Contingency Plans: Post-breach evaluation and updating of contingency plans.

Improvements: Implementing improvements to prevent recurrence.

Changes to the Privacy Policy

We reserve the right to update this privacy policy from time to time to reflect changes in our practices or legal requirements. Changes will be published on our website along with the date of the last update.