Privacy Notice for Housing Residents

Version: August 2019

In connection with leasing housing to Danish or Swedish residents, Fonden DIS, DIS Stockholm AB, and DIS Properties APS (DIS) will, as the joint data controller, collect, and process personal data about local housing residents in Denmark/Sweden.

1. Categories of personal data and purposes

We collect and process the following types of personal data:

Non-sensitive categories of personal data: name, gender, birth date, nationality, local address, phone number, educational status, past international travel, application essay details, application date, and security footage. When applicable, internal case note details may also be processed.

As relevant to the housing allocation process, personal data regarding serious allergies or dietary restrictions may be processed based on consent from the data subject. Sweden only: National ID numbers are processed on the basis of a legal obligation.

We process the personal data for the following purposes:

  • In pursuit of the DIS Mission, including the DIS commitment to its values and to diversity and respect
  • To facilitate the best possible relationships for DIS students and the housing residents who live with them
  • For statistical and research purposes
  • To comply with applicable personal data protection regulation and other legitimate interests, e.g.
    • Documentation requirements
    • Compliance with basic principles and legal grounds for processing personal data
    • Putting in place, maintaining and testing technical and organisational security measures
    • Investigating and reporting suspected personal data breaches, if any
    • Handling requests and complaints from data subjects and others, if any
    • Handling inspections and queries by supervisory authorities, if any
    • Handling disputes with data subjects and third parties, if any

2. Sources

The personal data are collected from housing residents in nearly all cases detailed in this privacy notice. The exception are internal case notes details when relevant, which may come directly from the housing resident but also may come from employees or agents of DIS. The legal basis for this processing is the legitimate interest of DIS based on GDPR article 6(1)(f). The legitimate interests of DIS are to keep an internal record when needed to maintain quality and consistency of service and to best pursue fulfillment of the agreement with the housing residents, and to the DIS students with whom they live. Building security footage at DIS is also processed based on the legitimate interest of safety and security. When relevant, the legal bases for this processing may also be based on GDPR article 9(1)(f), the establishment, exercise, or defense of legal claims. In emergency situations, personal data may be collected and processed from employees or agents of DIS or third parties based on GDPR article 6(1)(d), processing which is necessary in order to protect the vital interests of the data subject or of another natural person.

3. The legal basis for the collection and processing of the personal data

The legal basis for collection and processing of housing residents’ name, email, local address, phone number, educational status, and birthdate is the following:

  • Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a con-tract

When DIS collects personal data directly from housing residents in order to be able to conclude a contract, housing residents are obliged to provide the information. DIS and housing residents would be unable to conclude an agreement without this information.

The legal basis for collection and processing of housing residents’ phone number, gender, , nationality, past international travel, application essay details, application date, building surveillance footage, email (during application phase), survey responses, and internal case details when relevant is the following:

  • Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.

When DIS collects personal data directly from housing residents for the legitimate purposes of providing a safe and secure living environment and making the best possible housing allocations regarding housing residents and DIS students. Housing residents provide the personal data in order to meet this legitimate interest. When potential housing residents partially complete an application, DIS processes their email address and possibly survey responses for the legitimate purposes of reminding about relevant application deadlines and improving the data collection process for future housing residents. Housing residents are obliged to provide this information to DIS, but housing residents have the right to object that their legitimate interests as an individual out-weigh the legitimate interests of DIS as an organization. To exercise this claim housing residents need to contact the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest processing they’re objecting, and why their interests outweigh those of DIS in the specific in-stances.

The legal basis for collection and processing of housing residents’ serious allergies and dietary restrictions is:

  • Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.

When DIS collects this personal data directly from housing residents, it is provided voluntarily. They are not obliged to provide this information to DIS. This sensitive personal data is only processed when housing residents share this.

(Sweden only:) The legal basis for collection and processing of housing residents’ national ID numbers is:

  • GDPR art. 6(1)(f), processing which is necessary for compliance with a legal obligation to which the controller is subject.

Housing residents are obliged to provide this information to DIS because of this legal requirement. Failure to do so would prevent DIS and the housing resident from entering into an agreement.

4. Disclosure of the personal data to other controllers

Relevant personal data will be disclosed to and shared with the following recipients:

  • Cleaning and maintenance companies for DIS housing
  • Local Kommune, at their request
  • Other Housing Residents

The legal basis for the disclosure of housing residents’ name, email, room number,  home address, phone number to cleaning and maintenance companies, as well as information relating to room availability to other housing residents, is the following:

  • Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.

The legal basis for the disclosure of residents’ name, room number, and home address to local Kommune is the following:

  • Based on GDPR art. 6(1)(c), processing which is necessary for compliance with a legal obligation to which the controller is subject

5. Transfer of personal data to data processors

DIS transfers the personal data to IT providers and the DIS North American Office (part of the University of Minnesota) which processes and/or stores the personal data on behalf of DIS.

6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA

We transfer the personal data to the following recipients located in countries out-side the EU/EEA:

Transfers of personal data to a third country or an international organisation
Category of recipient:
IT Providers
Including Vultr, Sendgrid, Paper-trail, Parchment, Zendesk
(sub-processor categorization for following IT providers is on-going and will be up-dated as such)Country:
United States
☒ EU Standard Contractual Clauses – to processors (in de-velopment)
☒ EU-U.S. Privacy Shield (only the U.S.) (in development)
Category of recipient:
DIS North American Office (University of Minnesota)
Sub-processor Google Suite and Google CloudCountry:
United States
☒ EU Standard Contractual Clauses – to processors (in development)
☒ EU-U.S. Privacy Shield (only the U.S.) (for sub-processor)
☒ Conclusion or performance of a contract between the individual and the data controller
☒ Vital interests of the data subject or other persons, where the data subject is incapable of giving consent
☒ Establishment, exercise or defense of legal claims

7. Retention period

DIS stores personal data for as long as necessary to fulfill the purposes above. DIS psuedonymizes personal data on an annual basis within two years of the conclusion of housing residents’ tenancy, at which time all qualitative personal data (i.e. application essays) are deleted. Personal data on those who partially complete applications is deleted after six months of submission. Basic contact information is kept on file up to seven years to cover relevant statutes of limitation. Any security footage from DIS buildings is deleted at the latest within 30 days of recording. Quantitative data is kept for statistical and research purposes in a psuedonymized format.

8. Housing residents’ rights

Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:

  • The right to request access to the personal data
  • The right to rectification of the personal data
  • The right to erasure of the personal data
  • The right to restriction of processing
  • The right to data portability
  • The right to objection to the processing of the personal data

Housing residents also have the right to lodge a complaint with the competent su-pervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.datainspektionen.se respectively.

9. Contact

Housing residents should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.

Contact details of the controller(s):

Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44

DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13

DIS Properties APS
Vestergade 5
DK-1456 København K
Business registration no. in Denmark: 37511404

Contact details of the data protection officer:
E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36