Processing of data about you as part of your employment with DTU

As part of your employment with DTU, DTU will process a range of data relating to you. Under Articles 13 and 14 of the General Data Protection Regulation,[1] DTU must provide you with certain information when DTU receives data about you—from you or from anyone else.

DTU only processes data that is relevant to your employment. DTU’s legal basis for processing information about you is Article 6(1)(b) and (e) of the General Data Protection Regulation, and section 12 of the Act on the Processing of Personal Data. DTU will only rarely base the processing of data on your consent.

DTU treats your data as confidential. Everyone who has access to your personal data is bound by confidentiality. Most of the data that DTU processes about you is mandatory, as it is needed in relation to your employment and DTU’s operations.

Types of data and purposes

DTU will primarily process personal data relating to you for the purpose of managing your employment, including your salary, your terms of employment, your holidays and special holidays, professional development, HR tasks, leaving, and other matters arising in the course of your employment and/or DTU’s obligations pursuant to labour legislation. Another purpose is to ensure the proper fulfilment of DTU’s obligations in relation to you as an employee, as well as the fulfilment of obligations in accordance with legislation and applicable collective agreements. In addition, there are necessary records in DTU’s systems, etc., that you use in carrying out your tasks.

The personal data that DTU typically processes about you is your name, address, telephone number, photo, date of birth, next of kin, civil registration (CPR) number, salary, bank details, absence due to sickness and other absence, medical information, such as medical certificates, professional qualifications, and personal competences. Furthermore, this may include your diplomas and exam certificates or other data concerning your academic degrees, publications, and previous employment. It may also be data concerning sickness, minutes from employee development interviews (MUS), your performance, and further details about your work. If you have received any reprimands or warnings, DTU will also process data about this.

DTU processes information about your use of IT, the Internet, and emails to ensure that DTU fulfils its obligations for processing security and can handle other legitimate interests under Article 6(1)(b), (c), and (e) of the General Data Protection Regulation. Finally, DTU processes other relevant data linked to your employment with DTU.

Accordingly, DTU will collect, register, keep, and use data about you. This may be data that you gave to DTU in connection with your appointment or during your employment. However, it may also be data that DTU receives or obtains from other parties—including public authorities—when this is necessary or relevant for your employment with DTU.

DTU will also process data concerning your purchases and your travel for DTU. Such data will primarily be used in connection with DTU handling your purchases and travel activities. In some cases, the data will also be used to review purchase history and travel history.

Your data may also be included in statistical material in anonymized form and in such a way that data concerning individuals cannot be isolated and connected with named persons.

Disclosure of your data

Generally, data relating to you will not be disclosed to any third party. DTU will, however, disclose data about you to the extent that DTU is obliged to do so. This may, for example, be in the context of access to documents in personnel matters and employee data in accordance with applicable rules. It may also be the disclosure of data to other public authorities where DTU has a duty to do so, including the Danish Tax Agency, the Danish Labour Market Supplementary Pension Scheme (ATP), the police, the Labour Market Holiday Fund and Holiday Account, Statistics Denmark, the Danish Agency for Governmental Management’s Nemkonto, the National Board of Industrial Injuries, etc.

In addition, data may also be disclosed to banks and pension companies. There may also be disclosure of data in connection with audits, etc., including the external audit of DTU. Finally, data may be disclosed to DTU’s partners in connection with conducting satisfaction surveys and other similar surveys.

Your rights

The General Data Protection Regulation gives you a number of rights in relation to our processing of data about you. Please contact us if you wish to exercise these rights.

Right of access

You have a right of access to the data that DTU processes about you. If DTU has registered incorrect data, you also have the right to have the data rectified. In addition, you have the right to object to the processing, and in certain cases you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transfer that personal data from one data controller to another without hindrance.

In exceptional cases where DTU processes information about you based on your consent, you have the right to withdraw your consent.

Right to erasure

In certain cases, you may have the right to have data about you erased prior to the date of DTU’s normal general erasure. Data relating to you will be erased or archived when there is no longer a legitimate and work-related need for keeping it with a view to complying with the above-mentioned obligations or duties, or when DTU otherwise no longer has the authority to keep the data. Data is transferred continuously to the Danish National Archives in accordance with the rules of the Archives Act and the provisions of the State Archives.

Data controller

DTU has and retains responsibility as a ‘data controller’, and DTU is therefore responsible for complying with the Danish Act on Processing of Personal Data (Persondataloven) and the General Data Protection Regulation. The controller is thus Technical University of Denmark, Anker Engelunds Vej 1, DK-2800 Kgs. Lyngby, Denmark.

Contact

DTU has appointed a data protection officer who can be contacted at dpo@dtu.dk.

Complaints

You have the right to file a complaint with the Danish Data Protection Agency, which is the regulator.


[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Article 14(1) states that the (data) controller must provide the data subject with certain information where personal data is not collected from the data subject.