Version: October 2023
In connection with the use of our websites (disabroad.org, dis.dk, and dis-sthlm.se) and the purchase of merchandise for sale on these websites, Fonden DIS and DIS Stockholm AB will, as the joint data controllers, collect and process personal data about Website Visitors globally.
-
Categories of personal of data and purposes
DIS collects and processes the following types of personal data about those who use the DIS websites: Cookies for those who consent to their use, including IP address, session ID, time spent on website, webpages viewed, geographic location, device type, advertising tags, and source origin.
Those who purchase merchandise through the DIS websites will also have the following personal data collected and processed: Name, Email, delivery and billing address, phone number, cookie information, and order details.
Those who consent to receiving marketing newsletters or other email communications through the DIS websites may have tracking pixels used in connection with their name and email.
Further personal data is collected if you apply or request information through audience-specific forms on the DIS websites. An overview of these privacy notices can be found online. The relevant privacy policy for your data subject type is made available by direct link on all forms and applications at the time when personal data is obtained, to fulfil GDPR art. 13(1).
DIS processes the personal data for the following purposes:
- To fulfil merchandise purchases
- To market products and programming to relevant audiences
- To optimize website content and improve campaign efficacy
- To recruit students, host families, residents, and employee applicants
- To collaborate with partners locally and globally
- For statistical and research purposes
- To comply with applicable personal data protection regulation and other legitimate interests, e.g.
- Documentation requirements
- Compliance with basic principles and legal grounds for processing personal data
- Putting in place, maintaining and testing technical and organisational security measures
- Investigating and reporting suspected personal data breaches, if any
- Handling requests and complaints from data subjects and others, if any
- Handling inspections and queries by supervisory authorities, if any
- Handling disputes with data subjects and third parties, if any
2. Sources
The personal data for Website visitors is collected either directly from the website visitor when purchasing merchandise or requesting further communication, or through third-party tracking via cookies, when consent has been provided.
3. The legal basis for the collection and processing of the personal data
The legal basis for collection and processing of name, email, delivery and billing address, phone number, and order details is the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
When DIS collects personal data directly from you for the purpose of fulfilling merchandise purchases, you provide the personal data in order to be able to conclude a contract with us. You are obliged to provide this information otherwise the purchase can not be fulfilled.
The legal basis for collection of cookie information, and processing of name, email and phone number for marketing is the following:
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
DIS collects cookie information in order to improve its website and services, in order to collaborate better with local and global partners. DIS processes emails and phone numbers for marketing in order to apprise Website Visitors of merchandising offers. This collection and processing is only done with Website Visitors’ active consent, and there are no consequences to not consenting to cookie tracking, or SMS or email marketing. You have the right to withdraw your consent at any time. If you withdraw the consent, this will not affect the lawfulness of the disclosure prior to the withdrawal. Consent can be withdrawn using the same banner on which consent was given, or by “changing your consent” on the Cookie Policy Consent page: https://disabroad.org/privacy-policy/cookie-policy-consent/
The legal basis for the use of tracking pixels in newsletters or email communications is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
DIS has a legitimate interest to improve its marketing and recruitment campaign and communication efficacy through the use of tracking pixels. Website visitors consent to receiving marketing newsletters or other email communications through the DIS websites are obliged to allow the use of tracking pixels in these communications, but Website visitors have the right to object to any further processing on the basis that their interests outweigh the legitimate interests of DIS as an organization. To exercise this claim, Website visitors can choose to opt-out of all further tracking pixel processing by clicking unsubscribe in any marketing email or newsletter, or by contacting the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest they are objecting, and why their interests outweigh those of DIS in the specific instance.
4. Disclosure of the personal data to other controllers
The name, email, delivery and billing address, phone number, and order details will be disclosed to and shared with the following recipients:
- Turtle (DK)
The legal basis for this disclosure is the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
For those who consent to the use of cookies, cookie information, including IP address, session ID, time spent on website, webpages viewed, geographic location, device type, advertising tags, and source origin will be disclosed and shared with the following recipients:
- Social media companies
The legal basis for this disclosure is the following
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
5. Transfer of personal data to data processors
DIS transfers the personal data about cookies, et al.to Google Analytics, tracking pixel data to Mailchimp, and other personal data to Element 451 and Zapier, all of which process and/or store the personal data on our behalf.
6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA
DIS transfers the personal data to the following recipients located in countries outside the EU/EEA:
| Transfers of personal data to a third country or an international organization | |
| Transfer basis | |
| Category of recipient:
CRM – Element 451; Zapier; Mailchimp; Google Analytics
Country: United States |
☒ EU Standard Contractual Clauses – to processors
☒ Adequacy decision (Data Privacy Framework) |
EU Standard Contractual Clauses as a transfer basis, means that DIS and the other organization(s) have agreed to additional contractual language from the EU, which protects the legal rights Housing Partners have as a data subject, even though Website Visitors personal data is shared outside of the EU. Website Visitors the right to obtain a copy of these clauses, which can be exercised by contacting dataprotectionofficer@dis.dk.
An adequacy decision as a transfer basis, means that the EU has determined that data protection laws in a given country, are similar enough to the EU data protection laws, so that personal data can be transferred there without further transfer basis such as the contractual language referred to above.
7. Retention period
DIS stores the personal data of Website Visitors for as long as necessary to fulfil the purposes above, however there are different criteria for different categories of personal data. Personal data covered by the Bookkeeping Act in Denmark will be stored for 5 years based on legal obligation.
The specific expiration dates for cookie information, et al. can be found, on the Cookie Policy Consent page
Website visitors who have a pre-existing relationship with DIS (i.e.. students), will have their non-financial data anonymized based on the data subject-specific periods found online. Other Website Visitors will have their personal data anonymized based on the expiration of their marketing consents for those who provide consent, or after a one-year period on an annual basis for those who did not provide any marketing consents.
8. Your rights
Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:
- The right to request access to the personal data
- The right to rectification of the personal data
- The right to erasure of the personal data
- The right to restriction of processing
- The right to data portability
You also have the right to lodge a complaint with the competent supervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.imy.se respectively.
9. Contact
Website Visitors should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.
Contact details of the controller(s):
Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44
DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13
Contact details of the data protection officer:
E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36