Version: October 2023
In connection with leasing housing to Danish or Swedish residents, Fonden DIS and DIS Stockholm AB (DIS) will, as the joint data controller, collect, and process personal data about local housing residents in Denmark/Sweden.
1. Categories of personal data and purposes
We collect and process the following types of personal data:
Non-sensitive categories of personal data: contact & ID information, application information and essays, educational information, financial information, housing preferences and details, and internal case and bias reporting details, only if applicable.
As relevant to the housing allocation process, personal data regarding serious allergies or dietary restrictions may be processed based on consent from the data subject. (Sweden only) National ID numbers are processed on the basis of a legal obligation.
We process the personal data for the following purposes:
- In pursuit of the DIS Mission, including the DIS commitment to its values and to diversity and respect
- To facilitate the best possible relationships for DIS students and Housing Residents
- To fulfil the agreement between DIS and Housing Residents
- For statistical and research purposes
- To comply with applicable personal data protection regulation and other legitimate interests, e.g.
- Documentation requirements
- Compliance with basic principles and legal grounds for processing personal data
- Putting in place, maintaining and testing technical and organizational security measures
- Investigating and reporting suspected personal data breaches, if any
- Handling requests and complaints from data subjects and others, if any
- Handling inspections and queries by supervisory authorities, if any
- Handling disputes with data subjects and third parties, if any
2. Sources
The personal data are collected from Housing Residents in nearly all instances detailed in this privacy notice. The exception are internal case and bias reporting details when relevant, which may come directly from the Housing Resident but also may come from other Housing Residents, DIS students, or representatives of DIS.
3. The legal basis for the collection and processing of the personal data
The legal basis for collection and processing of Housing Residents contact and ID information financial information, and educational information is the following:
- Based on GDPR art. 6(1)(b), processing which is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
When DIS collects personal data directly from Housing Residents in order to be able to conclude a contract, Housing Residents are obliged to provide the information. DIS and Housing Residents would be unable to conclude an agreement without this information.
The legal basis for collection and processing of Housing Residents’ contract information, application information and essays, and housing preferences and details, and internal case or bias reporting details are:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
When DIS collects personal data directly from Housing Residents for the legitimate purposes of recruitment of Housing residents through newsletters, providing a safe and secure living environment, making the best possible housing allocations regarding Housing Residents and DIS students, and fulfilling service requests. Housing Residents provide the personal data in order to meet this legitimate interest. Housing Residents are obliged to provide this information to DIS, but Housing Residents have the right to object that their legitimate interests as an individual outweigh the legitimate interests of DIS as an organization. Housing residents have the same obligations and rights regarding internal case and bias reporting details, if applicable. In such instances, DIS pursues its legitimate interests to keep an internal record when needed to maintain quality and consistency of service and to best pursue fulfilment of the agreement with the Housing Residents, and to the DIS students with whom they live, and the DIS mission in all its parts.
To exercise this claim on any legitimate interest based processing, Housing Residents need to contact the DIS Data Protection Officer (dataprotectionofficer@dis.dk) detailing to which legitimate interest processing they’re objecting, and why their interests outweigh those of DIS in the specific instances. Housing residents are able to directly object to newsletter processing by clicking unsubscribe.
The legal basis for collection and processing of Housing Residents’ serious allergies and dietary restrictions is:
- Based on GDPR art. 6(1)(a), processing which the data subject has given consent to of his or her personal data for one or more specific purposes.
When DIS collects this personal data directly from Housing Residents, it is provided voluntarily. They are not obliged to provide this information to DIS. This sensitive personal data is only processed when Housing Residents share this.
(Sweden only) The legal basis for collection and processing of Housing Residents’ national ID numbers is:
- GDPR art. 6(1)(f), processing which is necessary for compliance with a legal obligation to which the controller is subject.
Housing residents are obliged to provide this information to DIS because of this legal requirement. Failure to do so would prevent DIS and the Housing Resident from entering into an agreement.
4. Disclosure of the personal data to other controllers
Relevant personal data may be disclosed to and shared with the following recipients:
- Cleaning and maintenance companies for DIS housing
- Local Kommune, at their request
- Other Housing Residents
The legal basis for the disclosure of Housing Residents’ contact information to cleaning and maintenance companies, as well as information relating to room availability to other Housing Residents, is the following:
- Based on GDPR art. 6(1)(f), processing which is necessary for the purposes of the legitimate interests pursued by the controller.
The legal basis for the disclosure of residents’ contact information to local Kommune is the following:
- Based on GDPR art. 6(1)(c), processing which is necessary for compliance with a legal obligation to which the controller is subject
5. Transfer of personal data to data processors
DIS transfers the personal data to IT providers and the DIS North American Office (part of the University of Minnesota) which processes and/or stores the personal data on behalf of DIS.
DIS transfers contact, ID, and financial information to a housing administration company which processes rent payments and other administrative tasks on behalf of DIS.
DIS transfers contact and ID information to the DIS app, which Housing Residents record their own interactions on.
6. International transfers of personal data to recipients (both controllers and processors) in countries outside the EU/EEA
We transfer the personal data to the following recipients located in countries out-side the EU/EEA:
| Transfers of personal data to a third country or an international organisation | |
| Category of recipient: IT Providers including Mailchimp, Sendgrid, Papertrail, Freshservice
Country: United States |
☒ EU Standard Contractual Clauses – to processors |
| Category of recipient: DIS North American Office (University of Minnesota) Country: United States |
☒ EU Standard Contractual Clauses – to processors |
EU Standard Contractual Clauses as a transfer basis, means that DIS and the other organization(s) have agreed to additional contractual language from the EU, which protects the legal rights Housing Residents have as a data subject, even though Housing Resident personal data is shared outside of the EU. Housing Residents have the right to obtain a copy of these clauses, which can be exercised by contacting dataprotectionofficer@dis.dk.
7. Retention period
DIS stores personal data for as long as necessary to fulfil the purposes above. Personal data about applicants who do not become residents is deleted annually. Applicants on the waitlist are contacted several times a year for consent to continued retention, and all personal data about them is deleted if not annually. Financial information is retained for the obligatory period based on relevant legislation, and all personal data on Housing Residents is deleted during the following year after moving out of DIS residences.
8. Housing residents’ rights
Subject to the conditions set out in the applicable data protection legislation, you enjoy the following certain rights:
- The right to request access to the personal data
- The right to rectification of the personal data
- The right to erasure of the personal data
- The right to restriction of processing
- The right to data portability
- The right to objection to the processing of the personal data
Housing residents also have the right to lodge a complaint with the competent su-pervisory authority, such as the Danish Data Protection Agency or the Swedish Data Protection Agency as relevant. Please consult their website for how to submit a complaint at www.datatilsynet.dk or www.imy.se respectively.
9. Contact
Housing residents should contact DIS if they have any questions in regards to the protection of their personal data or if they wish to exercise their legal rights.
Contact details of the controller(s):
Fonden DIS – Danish Institute for Study Abroad
Vestergade 7
DK-1456 København K
Business registration no. in Denmark: DK13058946
Tel no: +45 33 11 01 44
DIS Stockholm AB
Melodislingan 21
115 51 Stockholm
Business registration no. in Sweden: 559021-1206
Tel no: +46 (0)10 175 13 13
Contact details of the data protection officer:
E-mail address: dataprotectionofficer@dis.dk
Tel no: +45 33 76 54 36