Privacy Policy App & Website
Privacy Notice
Applicable to: applicants for private and commercial tenancies regardless of legal form (“tenancy applicants”), tenants in private tenancies (“private tenants”), tenants in commercial tenancies where the business is personally owned (“commercial tenants – personally owned”), and contact persons at commercial tenants incorporated as companies, including e.g. A/S or ApS (“contact persons at commercial tenants”) with:
- Komvi ApS
- Companies and properties owned or managed by Komvi ApS
As the data controller, we work actively to protect the personal data we handle. With this policy, we inform you how we process personal data about tenants and applicants for our rental properties.
1. Who we are and how you can contact us
Name: Komvi ApS
Address: Sankt Annæ Plads 28, 1050 Copenhagen K
CVR (company registration) number: 45923509
Contact details for all companies:
E-mail: info@komvi.dk
2. Contact regarding data protection
If you have any questions about our processing of your personal data, you are always welcome to contact us as follows:
By e-mail: info@komvi.dk
Please note that ordinary e-mail is not a secure means of communication. You should therefore not include your CPR number (civil registration number), health information, information about criminal convictions and offences, or other confidential information that can be linked to an identifiable individual.
By letter to the postal address stated above.
3. Purposes and legal bases
Our data processing serves the following purposes:
- To register your interest in our available rental properties and to communicate with you about them.
- To assess your suitability for the available rental property, including by checking RKI.
- To enter into rental agreements for commercial premises, parking spaces or residential properties. The information is used to prepare the rental agreement, register with utility providers, and for the subsequent administration of the tenancy.
- If we consider you a candidate for an available rental property, we will store your personal data for any future administration of the tenancy.
We depend on your personal data being correct and up to date, and we therefore ask you to inform us of any changes to your personal data.
The legal bases for our processing of personal data are:
- If you are an applicant, Komvi processes your personal data on the basis of Article 6(1)(f) of the GDPR, as our legitimate interest is to be able to administer and carry out the necessary correspondence with an applicant for a rental property.
- If you are a tenant, Komvi processes your personal data on the basis of Article 6(1)(b) of the GDPR when it is necessary in order to enter into the rental agreement with you or with the company you represent, issue payment requests, maintain the condition of the property, and similar activities.
- Komvi also processes personal data in relation to the tenancy on the basis of Article 6(1)(c) of the GDPR when this is necessary for compliance with a legal obligation, for example to make mandatory statutory reports.
- In cases where Komvi needs to process special categories of personal data (sensitive data) about you, this is done on the basis of Article 9(2)(f) of the GDPR and Article 6(1)(f) of the GDPR, when necessary for Komvi to establish, exercise or defend a legal claim, and to pursue the legitimate interest associated with that purpose.
- In cases where Komvi needs to process information about criminal convictions and offences, this is done on the basis of Section 8(3) of the Danish Data Protection Act.
- If you are a private tenant, we disclose your CPR number to a utility provider in order to ensure unique identification when registering for the relevant utility, in accordance with Section 11(2)(2) of the Danish Data Protection Act (consent).
- If you are a private tenant or a tenant in a commercial tenancy where the business is personally owned, we process your CPR number in order to check whether you are registered in RKI as a bad payer. Our legal basis for this is Section 11(2)(2) of the Danish Data Protection Act (consent).
- If you are a private tenant or a tenant in a commercial tenancy where the business is personally owned, we process your CPR number in order to check whether you are registered in RKI as a bad payer. Our legal basis for this is Section 11(2)(2) of the Danish Data Protection Act (consent).
4. Categories of recipients
We disclose or transfer personal data about our tenants and applicants for tenancies to the following categories of recipients:
Data controllers
- Our property administrator, DEAS, to whom all information, correspondence, etc. is sent, processed and stored
- Credit information agency Experian, in connection with RKI checks prior to entering into a rental agreement
- Utility companies
- Property investors in connection with the sale of properties
- Our legal counsel in connection with court cases/disputes
Data processors
- Provider of the tenancy administration system “UnikBolig”: Unik System Design A/S
- Provider of e-mail and document management system: Microsoft Ireland Operations Ltd.
5. Retention and deletion5. Retention and deletion
We delete your personal data when it is no longer necessary for the purposes for which it was collected.
Personal data provided in connection with an application for a tenancy is stored until 1 month after the time when the relevant tenant has been allocated a tenancy.
Personal data provided in connection with the conclusion of the tenancy and its administration is stored for as long as you are a tenant with Komvi. Komvi stores the information for 3 years and 30 days from your move-out date. Personal data that falls within the definition of accounting material in the Danish Bookkeeping Act is stored for 5 years from the end of the financial year to which the material relates. Personal data that must be stored for specific, exceptional reasons may be retained for up to 10 years after the existence and amount of the dispute have been acknowledged.
If you have interacted with Komvi on our social media platforms, for example in connection with a targeted marketing campaign, the data will be deleted 1 year after the specific processing activity has been completed. Certain information may be stored for up to 2 years after the specific campaign has ended if this is necessary for documentation purposes.
Personal data that the police have or may need in connection with a criminal investigation is stored for as long as the criminal case is pending and for up to 1 year after a final judgment has been handed down, provided that it is assessed in the specific case to be necessary.
If you are involved in an insurance case, personal data will be stored for as long as the case has not been finally concluded (for example, settled or decided by a court and the appeal deadline has expired). If you have been involved in a personal injury case, the personal data will be stored for a longer period, but for no more than 30 years after the cessation of the injurious act.
6. Your rights
Under applicable law, you have a number of rights in relation to our processing of personal data about you.
You can exercise these rights by contacting us. Our contact details can be found at the top of this policy.
Once you have requested (i) access to data about you, (ii) rectification or deletion of such data, or (iii) raised an objection to our data processing, we will assess whether we can accommodate your request. We will respond to your enquiry as soon as possible and no later than one month after we have received it.
Right of access
- You have the right to obtain access to the personal data we process about you, as well as certain additional information.
- Right to rectification
- If you believe that the personal data we process about you is inaccurate, you have the right to have it corrected. You must contact us and explain what the inaccuracies are and how they can be corrected. In all cases, we must assess whether we consider your request justified. When you contact us with a request to have your personal data rectified or deleted, we will assess whether the conditions are met and, if so, carry out the rectification or deletion as soon as possible.
- Right to erasure (“right to be forgotten”)
- As a general rule, we delete personal data when it is no longer necessary. In special cases, you have the right to have specific information about you deleted before the time of our general routine deletion. This applies, for example, if you withdraw your consent and we do not have another legal basis for processing the data. If you believe that your data is no longer necessary for the purposes for which we collected it, you can request that it be deleted. You can also contact us if you believe that your personal data is being processed in violation of the law or other legal obligations.
- Right to restriction of processing
- If you contest the accuracy of data that we have registered or otherwise process, you can request that we restrict the processing of the data until we have had the opportunity to determine whether the data is correct.
- You can also request restriction instead of deletion if you believe that our processing of the data is unlawful, if you believe that we no longer need the data, or if you believe that your legitimate interests override the data controller’s legitimate interests.
- If you are granted restriction of processing, we may in future only process the data with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of a person or important public interests.
- Right to data portability
- You have the right to receive the personal data that you have provided to us, as well as data that we have collected about you from other parties on the basis of your consent. If we process data about you as part of a contract to which you are a party, you can also receive this data.
- You also have the right to transfer this personal data to another service provider. You can also ask us to send the data directly from the data controller to another authority or company.
- If you wish to exercise your right to data portability, you will receive your personal data from us in a commonly used and machine-readable format.
- Right to object
- You have the right to object to our processing of your personal data. You can also object to our disclosure of your data for marketing purposes. You can use the contact details at the top of this policy to submit an objection. If your objection is justified, we will ensure that we stop processing the data.
- Right to be informed of new purposes
- If we wish to use your personal data for a purpose other than those for which we have already informed you, for example in this privacy policy, you have the right to be informed of this before we further process the data for the new purpose.
- Right to withdraw your consent
- If our processing of your personal data is based on your consent, you can withdraw your consent at any time. If you withdraw your consent, we may no longer process the data in question going forward. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If we have another lawful basis for processing with an independent purpose – for example storing data to comply with bookkeeping rules – such processing may continue.
7. Complaint to the Danish Data Protection Agency
If you are not satisfied with our response, you may lodge a complaint with the Danish Data Protection Agency (Datatilsynet). More generally, if you are dissatisfied with the way your personal data has been processed, you can complain to the Danish Data Protection Agency, which will then investigate the matter and make a decision.
You can find the contact details of the Danish Data Protection Agency at www.datatilsynet.dk.
Please note: You can write to the Danish Data Protection Agency via Digital Post on Borger.dk,
where your message is transmitted securely (encrypted). We recommend that you use Digital Post
if your message contains confidential or sensitive personal data.