Aleta - Privacy Policy

Privacy Policy for Clients of Aleta

This policy applies to Aleta A/S, (CVR) no. 43 67 16 85 (”Aleta”, ”we”, ”our” or ”us”).

At Aleta, confidentiality and data protection are high priorities. This privacy policy (“Privacy Policy”) explains how we process (“Process/Processing/Processed”) your personal data (“Personal Data”) as a client (“Client”) of Aleta.

Changes may occur to this Privacy Policy from time to time. You can always reach out to a representative of Aleta to obtain the latest version of this Privacy Policy.

1. Processing of your Personal Data by Aleta in general

We will be Processing non-sensitive Personal Data pursuant to article 6(1)(b) of the General Data Protection Regulation (“GDPR”) with the purpose of providing the services to you pur-suant to the relevant Service Agreements.

1.1. Processing of your Personal Data based on your consent

As part of Aleta’s provision of services to you as our Client, we have to obtain your consent for the Processing of your Personal Data. You have given this consent when accepting an Order Confirmation (In Danish: Ordrebekræftelse) from Aleta.

2. Storage and deletion

Your Personal Data is deleted when the Process thereof is no longer required for the purposes set out above or if you withdraw your consent. However, the Personal Data may be Processed and stored for a longer period in anonymized form.

Relevant and Non-Sensitive Personal Data related to you as a Client of Aleta is, as a general rule, stored in the duration of the contractual relationship and subsequently in a period of five years in accordance with the requirements of the Danish Bookkeeping Act (in Danish: bogføringsloven).

Notwithstanding the above, Aleta may Process and store your Personal Data for a longer period than stated above in anonymized form, meaning that we are no longer able to refer the Personal Data back to you.

3. Recipients of Personal Data

In general, your Personal Data is not disclosed to any third party without your permission. However, under certain circumstances and in accordance with applicable law, we may need to disclose your Personal Data to public authorities, including the Danish Financial Supervisory Authority (FSA) and the Public Prosecutor for Serious Economic Crime.

If Aleta requires legal or other counselling, we may also transfer your Personal Data to external legal advisers or accountants, including for the establishment, exercise or defense of legal claims in accordance with Article 6(1)(f) of the GDPR.

We may transfer your Personal Data to third parties who, on the basis of a contractual rela-tionship (i.e. a Data Processor Agreement) with Aleta, provide relevant services, e.g. providers of hosting and cloud solutions, providers of IT solutions, investment managers etc. Such service providers will only Process Personal Data in accordance with Aleta’s instructions in order to ensure confidentiality and compliance with the Data Protection legislation.

4. Transfer to third countries

If your Personal Data is transferred to Data Controllers or Data Processors established in countries outside the EU/EEA that do not have an adequate level of protection, such transfer will be based on the EU Commission’s standard contracts.

5. Security

We have implemented security measures ensuring that our internal procedures live up to our high standards. We are determined to protect the integrity and accessibility of your Personal Data as well as we possibly can. This includes the use of encryption and pseudonymization when possible as well as access limitation.

6. Data Controllers

For Clients of Aleta, Aleta is data controller with respect to the Processing of your Personal Data as stipulated in section 1 above.

The contact information of Aleta is stated below:

Aleta A/S

Danish business registration (CVR) no. 43 67 16 85

Ingerslevs Boulevard 3

8000 Aarhus C

Denmark

7. Your rights

You have the right to:

a) access the Personal Data we Process about you with a few statutory exemptions;

b) object to our collection and further Processing of your Personal Data;

c) request us to restrict the Processing of Your Personal Data if it is necessary;

d) have your Personal Data deleted in certain cases;

e) request to receive a copy of your Personal Data; and

f) have your Personal Data transferred to another data controller.

Your consent to our Processing of your Personal Data is (and should be) provided voluntarily, and you may at any time refuse to provide your consent without facing negative consequences.

You may at any time withdraw your consent.

If you withdraw your consent, we will no longer Process your Personal Data. Depending on the given circumstances, withdrawing your consent may, however, entail that we are no longer able to provide one or more of the services comprised by the Service Agreement.

If you:

a) wish to exercise one or more of the above rights;

b) have an any questions related to the Processing of your Personal Data; or

c) wish to make a complaint relating to the Processing of your Personal Data,

you may contact Aleta by sending an email to hello@aleta.io.

You are also entitled to file a complaint with the Danish Data Protection Agency (in Danish: Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, email: dt@datatilsynet.dk.

Privacy Policy for Employees of Aleta

This policy applies to Aleta A/S, (CVR) no. 43 67 16 85 (”Aleta”, ”we”, ”our” or ”us”).

Changes may occur to this Privacy Policy from time to time. You can always reach out to a representative of Aleta to obtain the latest version of this Privacy Policy.

1. Collection of Personal Data

At Aleta, we Process Employee Personal Data about you and other of our Employees for Em-ployee administration purposes in accordance with this Privacy Policy.

The following Employee Personal Data may be Processed for such purpose:

a) Name, address, phone number, email address, etc.

b) Details of employment such as employee ID, date of employment, CV, place of work, work email address(es), work related phone number(s), title, position, information as to whether the employment is full time/part time, information on promotions, etc.

c) Financial information such as information regarding salary/other compensation, bonuses, tax information, bank accounts, and other employment benefits, etc.

d) Work-time records.

e) Information regarding absence due to illness (for statistical purposes).

f) Information regarding absence due to maternity leave or other leave, etc.

g) Information regarding education and specialization.

h) Performance reviews.

i) Photo(s).

j) Reimbursement(s).

k) Information collected in connection with access control (access to buildings, IT systems, etc.).

l) Passwords and usernames.

m) Information necessary to administer health care plans, pension schemes and other employee benefits.

Aleta only Processes Employee Personal Data to the extent necessary and/or required by law.

The legal basis for the Processing, with respect to the majority of the Employee Personal Data that is being/will be Processed by Aleta, is the employment contracts entered into between Aleta and its employees in accordance with Article 6(1)(b) of the General Data Protection Regulation (”GDPR”), or Sections 12(1) and (2) of the Danish Data Protection Act (in Danish: databeskyttelsesloven) (the “Data Protection Act”) if the obligation has its source in another law or as part of our legitimate interest.

In accordance with Section 11(2)(1) of the Data Protection Act Aleta will Process the social security numbers of its employees (in Danish “CPR no.”) to the extent required, including in connection with the payment of taxes as part of salary administration.

Aleta may also Process contact information related to its employees’ family, friends, and/or other relatives. The Processing is based on Aleta’s legitimate interest in being able to contact such family, friends and/or other relatives in the event that its employees become ill or another emergency in accordance with Section 6(1)(f) of the GDPR.

Under certain circumstances Aleta may ask for a copy of its employees’ criminal records. The Processing will be based (as a legal basis) on its employees’ consent in accordance with Section 8(3) of the Data Protection Act. In other situations, Aleta can also Process information on other criminal offences if this is necessary for the purpose of pursuing another legitimate interest and this interest clearly overrides the interests of the employees as Data Subjects in accordance with Section 8(3), second sentence of the Data Protection Act. Whether Aleta relies on the consent or its own legitimate interest as a legal basis for such Processing depends on the situation in question, however, we will in all cases obtain your consent prior to the Processing of Personal Data contained in your criminal records.

Further, in some cases we may be required to collect and Process special categories of Per-sonal Data, such as health data. Such Processing is only carried out if necessary for complying with the labour law obligations of Aleta, including, but not limited to, the Danish Sickness Benefits Act (in Danish: Sygedagpengeloven) or the Danish Health Information Act (in Danish: Helbredsoplysningsloven) or if necessary, for the purpose of pursuing a legitimate interest in accordance with Sections 12(1) and (2) of the Data Protection Act.

Certain Processing activities require the employees’ prior consent, e.g., the use of photos of the employees of Aleta for marketing purposes.

Employee Personal Data may also be Processed in order to comply with legal requirements or to establish or defend legal claims.

2. Processing of Employee Personal Data

Aleta may Process Employee Personal Data for the following purposes:

a) Employee administration, management and administration of compensation (salary, bonuses, benefits, etc.), training and other HR related Processing related to your employment with Aleta.

b) Planning and administration.

c) Appointments, promotions and demotions.

d) Personal development records, performance management etc.

e) Analysis and management of employee works skills, certifications, licenses and competencies.

f) Completion of employee satisfaction surveys.

g) Administration of employee expenses.

h) Facility management, work environment and related security.

i) Provision and support of IT systems, user profiles, investigations, etc.

j) Handling of claims and disputes.

k) Compliance with legal, regulatory and other obligations.

l) Other legitimate purposes.

3. Transfer of Employee Personal Data

Employee Personal Data may be made available to third parties for such third parties’ provision of services to Aleta pursuant to a separate contract. Such services may be, but are not limited to, administration of salary, expenses and other compensation, IT hosting and IT maintenance etc.

The transfer of Employee Data will always be subject to the following conditions:

a) third parties will only Process Employee Personal Data on the basis of a data processing agreement; and

b) such Processing will only take place in accordance with Aleta’s instructions.

Certain Employee Personal Data will be reported to government authorities where required by law, e.g., for tax reporting or to private organizations, e.g., pension or insurance providers, travel agencies, airline companies, leasing bureaus and financial institutions. The legal basis for such disclosure is Article 6(1)(b) and (c) of the GDPR and Sections 12(1) and (2) of the Data Protection Act. Employee Personal Data Processed as part of the employment with Aleta may be disclosed to third parties as required by law or if the Employees provide their consent to the disclosure of their Employee Personal Data.

Aleta may disclose Employee Personal Data to external lawyers, accountants etc., if the Processing is necessary for the establishment, exercise or defense of legal claims in accordance with Article 6(1)(f) and Article 9(2)(f) of the GDPR.

4. Transfer of Employee Data to third countries

To the extent Employee Personal Data is transferred to data controllers or data processors in countries outside the EU/EEA, including group entities, that do not ensure an adequate level of data protection, such transfer will be based on the EU Commission’s standard contractual clauses.

5. Retention of Employee Personal Data

As a general rule, Employee Personal Data will be kept for a period of five years following the termination of the relevant employee to which such Employee Personal Data relates, unless Aleta is required to store such Employee Personal Data for a longer period due to legal requirements or, if necessary, for the purpose of defending a specific legal claim or dispute.

Bookkeeping material (including Employee Personal Data such as salary information) must be retained for five years following the end of the financial year that the data relates to in accordance with the Danish Bookkeeping Act (in Danish: bogføringsloven).

Aleta may Process and store Employee Personal Data for a longer period than set out above in an anonymized form which means that Aleta will no longer be able to refer the Employee Personal Data back to the individual employee.

6. Security

We have implemented security measures to protect your Personal Data in the best possible way. This includes the use of encryption and pseudonymization (where possible), access restriction, etc.

7. Rights of employees as data subjects

Subject to certain statutory exceptions, employees have the right to access their Employee Personal Data that is being Processed and stored about them by Aleta, Furthermore, each individual employee has the right to object to the Processing (and request the restriction of) the Processing of their Employee Personal Data. In addition, each individual employee also has the right to request rectification (including completion or deletion) of their Employee Personal Data to the extent it is incomplete or incorrect.

Under certain circumstances, the employees of Aleta may also request that Aleta provides them with a copy of their Employee Personal Data in a structured, commonly used, and machine-readable format and request Aleta to transfer such Employee Personal Data to another data controller.

8. Data controller, contact and complaints

For Employees employed with Aleta, Aleta is data controller and responsible for the Pro-cessing of the Employees’ Personal Data.

The contact information of Aleta is stated below:

Aleta A/S

Danish business registration (CVR) no. 43 67 16 85

Ingerslevs Boulevard 3

8000 Aarhus C

Denmark

If you wish to exercise any of your rights, if you have any questions regarding this Privacy Policy or the Processing of your Personal Data or wish to make a complaint you can contact hello@aleta.io. You are also entitled to file a complaint with the Danish Data Protection Agency (in Danish: Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, telephone number +45 33 19 32 00, email dt@datatilsynet.dk.

Privacy Policy for Job Applicants of Aleta

This policy applies to Aleta A/S, (CVR) no. 43 67 16 85 (”Aleta”, ”we”, ”our” or ”us”).

As part of our recruitment process, we will Process your Personal Data as further described in this Privacy Policy.

Changes may occur to this Privacy Policy from time to time. You can always reach out to a representative of Aleta to obtain the latest version of this Privacy Policy.

1. Processing of non-sensitive Personal Data

In order to evaluate your application (including your formal, written job application and exhibits, your “Application”), we will:

c) Process the Personal Data, which you have disclosed in your Application; and

d) evaluate your performance and competencies during interviews; and

e) Process relevant and available Personal Data about you that we find on the Internet, including content from social media (we will typically search for information regarding your previous jobs, activities, competencies, performance, etc).

The legal basis for our Processing of your Personal Data is your submission of your Application, cf. Article 6(1)(b) of the General Data Protection Regulation (“GDPR”).

If the job position requires you to complete one or more personality tests, you will be in-formed hereof when we have processed your Application. The results of such tests will be treated confidentially but will be included in our evaluation of your Application. Our legal basis for such Processing is Article 6(1)(b) of the GDPR.

We may also request that you provide us with a copy of your criminal record (in Danish: straffeattest) if this is necessary for evaluating your suitability for the position in question. Your criminal record (and the Personal Data included therein) will be treated confidentially and will be deleted immediately after presentation. You will be asked to obtain the criminal record yourself, and your submission of your criminal record will thus constitute our legal basis for the Processing of the Personal Data identified therein, cf. Section 8(3) of the Danish Data Protection Act (in Danish: persondataloven) (the “Data Protection Act”).

As part of our evaluation of you as an Applicant (including the evaluation of your Application), we may wish to speak to your previous and/or current employers. We will, however, only reach out to the persons you have explicitly stated as references in your Application or dur-ing interviews. Our legal basis for the Processing of Personal Data about you as part of reaching out to such references is Article 6(1)(f) of the GDPR (and/ or if you have provided your explicit consent, such consent in accordance with Article 6(1)(a) of the GDPR).

2. Processing of sensitive Personal Data

We recommend that you do not disclose sensitive Personal Data, such as information reveal-ing racial or ethnic origin, religion, trade union membership, sexual orientation, health, etc. in your Application. In the unlikely event that a certain health condition is required for the ability to perform the duties related to the position in question, we might – based on an individual assessment – request health information from you. In such case, we will ask for your consent for the Processing of such Personal Data, which will form the legal basis for such Processing, cf. Article 9(2)(a) of the GDPR.

3. Retention of Personal Data

If you are offered a position at Aleta, your Application and other relevant Personal Data ob-tained during the recruitment procedure will be stored in your employee file.

If you are not offered a position, we will store your Application and any additional Personal Data obtained during the recruitment procedure for a period of six months following our re-jection of your Application, unless you have provided your consent to storing such Personal Data for a longer period than six months.

4. Transfer of Employee Personal Data to third countries

To the extent your Personal Data is transferred to data controllers or data processors in countries outside the EU/EEA, including group entities, that do not ensure an adequate level of data protection, such transfer will be based on the EU Commission’s standard contractual clauses.

5. Your rights

Subject to certain statutory exceptions you have the right to access the Personal Data Pro-cessed about you. Furthermore, you have the right to object to the Processing and request restriction of the Processing of your Personal Data. In addition, you also have the right to re-quest rectification, including completion, or request deletion of your Personal Data to the ex-tent it is incomplete or incorrect, subject to certain exceptions.

In certain situations, you can also request that we provide you with a copy of your Personal Data in a structured, commonly used and machine-readable format and request us to trans-fer such Personal Data to another Data Controller.

If you want to exercise any of your rights, if you have any questions regarding this Privacy Policy or the Processing of your Personal Data, please contact us at hello@aleta.io.

6. Data controller, contact and complaints

If you apply for a job at Aleta, Aleta is data controller and responsible for the Processing of your Personal Data as part of the recruitment/Application procedure.

The contact information of Aleta is stated below:

Aleta A/S

Danish business registration (CVR) no. 43 67 16 85

Ingerslevs Boulevard 3

8000 Aarhus C

Denmark

If you have any complaints regarding the Processing of your Personal Data, please contact us at hello@aleta.io. You are also entitled to file a complaint with the Danish Data Protection Agency (in Danish: Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, e-mail dt@datatilsynet.dk.

Privacy Policy for Clients of Aleta

Privacy Policy for Employees of Aleta

Privacy Policy for Job Applicants of Aleta

Start looking beyond the bottom line today.