Privacy policy for the ELF Group

General principles for the protection of personal data

The ELF Group (ELF) recognises and respects the rights of the individual to protection of personal data in pursuance of national and European Union law. The ELF Group will ensure that any processing of personal data by companies in the Group or on their behalf complies with the fundamental processing principles for the protection of the personal data of natural persons.

Lawfulness, fairness

ELF will process personal data in a lawful and fair manner and in compliance with the rights of the data subjects under the legislation in force from time to time.

Transparency

When collecting personal data from persons or other sources, ELF will ensure that the data subject is appropriately informed in accordance with applicable legislation: A data subject is entitled to be informed at any time of the personal data being processed about him or her.

Purpose limitation

ELF will only process personal data for explicit and legitimate purposes. Personal data will only be used for the purposes for which they were initially collected.

Data minimisation

ELF will ensure that only personal data that are adequate, relevant and strictly necessary for the specific purpose are processed.

Accuracy

ELF will ensure that personal data processed by ELF are at all times accurate and up-to-date, and any inaccurate personal data will be rectified or deleted where possible.

Storage limitation

ELF will ensure that personal data are not stored or otherwise processed for longer than is necessary for the specific purpose, unless otherwise provided by other legislation.

Integrity and confidentiality

ELF will take appropriate organisational and technical measures to ensure that any risk of loss, leakage, damage to and/or disappearance of personal data is minimised to the greatest extent possible.

Responsibility for personal data

Who we are

The ELF Group is a real estate group engaging in project development and the sale and letting of residential and non-residential properties. You may contact any of the Group’s companies by using the contact details below.

In the course of the Group’s business, we collect and process information about natural persons (personal data). We collect and process data to be able to provide the best possible service and the best possible solutions for the clients, buyers, tenants, business partners, etc. of the group companies, to comply with legal requirements and to meet the contractual obligations of the group companies.

Data controller

Each company of the ELF Group is the data controller in respect of the personal data collected and processed by the relevant company in connection with the use by private individuals of the services offered by the companies. The collection and processing of personal data is necessary for us to be able to offer these services to users.

Purpose of and legal basis for the processing of personal data

Purpose

We register and process data about you to be able to offer you the best possible service in connection with your business with the ELF Group, to perform our agreements with you and to comply with any statutory requirements applying toindividual group companies in the course of their day-to-day operations.

This means that we will register and process your personal data in theevent of thefollowing:

Where you sign up for a service providing general information about the Group’s business such as a newsletter, a reservation list, etc.

Where you make or consider making an agreement with us concerning a service.
Where you make or consider making an agreement with us concerning a service.
Where you have purchased or sold a residential or a non-residential property from or to a company in the ELF Group.
Where you have rented a residential or a non-residential property from a company in the ELF Group.
Where we are legally bound to collect and process your personal data.
Where you have given us separate consent to process your personal data for a specific purpose.
Where it is necessary for purposes of pursuing the ELF Group’s legitimate interests, for instance to prevent abuse or financial loss, to strengthen IT security, etc.

Legal basis

The ELF Group processes personal data to meet each individual group company’s contractual obligations to customers, buyers, tenants, business partners, etc., see Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Furthermore, ELF processes personal data in cases where ELFisunder an obligation to do so pursuant to applicable legislation, see Article 6(1)(c) of the General Data Protection Regulation (GDPR).

In some circumstances, we process personal data for purposes of pursuing the legitimate interests of a group company. Where the processing is based on this principle of balancing of interests, see GDPR Article 6(1)(f), we believe our interests in the Group providing optimal services –for instance in addition to the Group’s primary services –and IT security override the interests of the person(s) whose personal data are being processed.

Moreover, we process personal data based on the data subject’s clear and unambiguous consent, see section 11(2)(2) in the Danish Data Protection Act and GDPR Article 6(1)(a)and 9(2)(a), with consent being obtained prior to the specific processing activity.

The right to withdraw consent

Consent given for the processing of personal data may be withdrawn at any time. Withdrawal of consent is effective for future personal data processing operations. If consent is withdrawn, it will therefore not affect the lawfulness of any processing based on the consent prior to its withdrawal, or where there is an alternative legal basis for the processing operation in question.

Personal data processed by the ELF Group

The companies in the ELF Group register and use different categories of personal data depending on the services provided by the company in question or its contractual obligations, including:

Basic personal data such as name and contact details
Civil registration number
Financial information such as credit rating information obtained in connection with the renting of a residential unit
Information about your family and household
Proof of identity such as photocopies of health insurance cards and photo ID

Sensitive personal data

ELF only processes sensitive personal dataunder certain strict circumstancesand only to the extent necessary for the provision of appropriate services. Prior to processing sensitive personal data, ELFwill obtain explicit consent for a specified processing operation in respect of the data concerned, unless the right to register sensitive personal data is authorised by law.

ELF registers sensitive personal data such as information about your health, for instance whether you are a wheelchair user, where this is relevant in thecontext of your housing needswhen renting out a residential apartment.

When and how personal data are processed

Companies in the ELF Group process personal data in connection with the provision of services and transactions with clients, buyers, tenants, etc., including in connection with:

Negotiation of contracts, preparation of contracts of sale and lease agreements and the completion and execution thereof;
Registration in reservation lists, lists of prospective buyers and tenants, etc.and showings and open house viewings;
Release of newslettersandongoing campaigns, competitions, etc.;

Companies in the ELF Group also process personal data in connection with other activities related to certain services, including:

Customer service and administration;
Development and administration of services and the ELF Group’s business;
Marketing of services and products;
To protect the ELF Group and its business against fraud; and
To meet statutory requirements.

We collect personal data in the following circumstances:

Where you fill in forms on websites owned by companies in the ELF Group; and
Where we receive personal data in writing, over the phone or otherwise directly from a data subject on or without request.

ELF collects personal data in the following situations:

Where you fill in forms on websites owned by companies in the ELF Group; and
When receiving personal data in writing, over the phone or otherwise directly from a data subject on or without request.

Third parties and the processing of personal data

Personal data collected from third parties

The ELF Group registers and processes personal data collected from third parties, including from:

Public registers such as the Public Information Server(OIS), the land registry and other publicly available sources. ELFregistersand usesthis information, e.g. for preparing and checking standard materialincluded in contracts concerning the purchase, sale or leaseof real property;

Credit rating agencies. We register and process relevant financial information in connection with the conclusion of agreements concerning the lease of residential properties;

Real estate agents in connection with the conclusion of agreements onthe purchase or sale of real property or the registration of indications of interest andreservations in relation to the purchase or sale of real property;

Real estate agents and administration companies in connection with the conclusion of agreements concerning leaseof residential and/or non-residential premises; and

advisers and other representatives in connection with the conclusion of contracts within the Group’s business area.

Disclosure of personal data to third parties

The ELF Group will in certain circumstances share personal data with certain third parties in and outside the Group, including in the following situations:

In connection with an agreement onthe purchase of additional serviceswhen purchasing aresidence, your personal data will be disclosed to relevant third parties for purposes of performing the purchase of additionalservices.

Personal data will be disclosed to utility companies in connection with the sale or letting of real property.

In connection with the completion of a purchase or sale of real property, including registration of the conveyance document and other documents, the ELF Group will disclose your civil registration number to the Danish Land Registration Court.

Personal data will be disclosed to public authorities and third parties where the companies in the Group are under an obligation to do so pursuant to applicable legislation or to protect vital interests.

Personal data will be disclosed within the Group and to external business partners (including advisers and banks) to the extent there are legitimate grounds for the processing, such as consent, a legal obligation or the like.

Personal data will be disclosed to the Group’s IT business partners and suppliers in connection with IT support, hosting, operation and maintenance of IT solutions, etc. Where the Group uses data processors, such use will be based on a contract that ensures compliance with applicable data protection rules (data processor agreement).

Personal data will be disclosed to third parties in connection with the sale of real property, either by way of a direct sale or as partof the transfer of a business, where the personal data concern the tenants of the relevant property.

The rights of the data subject

Where a company in the ELF Group processes personal data about you, you may at any time exercise the following rights by contacting the company:

Right to access personal data (right of access)

You have the right to obtain access to the data ELFprocessesabout you as well as other information, such as the sources of the data and the purposes for which the data isused. You can request information about the length of time for which your datais stored and information onwho receives data about you, to the extent that ELF(lawfully) disclosespersonal data to third parties.

Right to rectification [correction]

You have the right to have any inaccurate or incomplete data about you rectified.

Right to deletion (“right to be forgotten”)

Under certain circumstances, you have the right to have personal data about you deletedbefore our usual time limit for deletion. The right to deletionmust be assessed consideringany restrictions under applicable legislation or any rights of the company to process data.

Right to restriction of processing

In certain situations, you have the right to restriction of the processing of your personal data.If you are entitled to restriction of processing, we may going forwardonly process your personal data –with the exception of storage –with your consent, or for purposes of establishing, exercising or defending legal claims or protecting a person or important public interests.

Right to transmit data (data portability)

In certain situations, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those data transmitted from one data controllerto another without hindrance.

Right to object

In certain situations, you have the right to object to our lawful processing of your personal data. You may also object to the processing of your data for direct marketing purposes.

Storage period

The companies in the ELF Group will only keep personal data for as long as is permitted under the data protection legislation in force from time to timei.e. as long as is necessary to achieve the purpose for which the data hasbeen collected. At the end of this period, the data will be deleted as a matter of course.

As the storage period depends on the specific circumstances of each processing operation, it is not possible to state a general storage period. For processing operations involving a potential liability for the data subject or a company in the ELF Group as the data controller, the storage period will be consistent with the rules of the Danish Limitation Act.

Where continuing contracts are concerned, including contracts concerning the leasing of real property, personal data are stored for the term of the contract plus ten years.

Applications for vacant positions will be stored for a maximum of six months.

Right to complain

If you are dissatisfied with ELF’sregistration and use of your personal data, you can lodge a complaint with the Danish Data Protection Agency as the supervisory authority: The Data Protection Agency, Borgergade 28, 5thfloor, DK-1300 Copenhagen K, Denmark, e-mail: dt@datatilsynet.dk.

Other terms

Amendments to the privacy policy

This data protection and privacy policy may be amended in response to new legal requirements, new data protection practices or changes to the services offered by the companies in the ELF Group. In case of material changes, you will be notified through our services or in a similar efficient way to allow you, as a data subject, to review the changes before they become effective.

Security measures

As part of the ELF Group’s general data protection efforts, the Group’s IT security is monitored and updated on an ongoing basis in order to identify potential vulnerabilities and attacks tominimise the risk of security breaches to the greatest extent possible.

The ELF Group regularly updates and implements technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss or change. These security measures also serve to protect personal data against unauthorised sharing, leakage, abuse and any other processing in violation ofapplicable data protection legislation.

Contact

If you have any questions regarding your rights and how your personal data are processed by the companies in the Group, please do not hesitate to contact ELF. You can contact any company in the ELF Group via ELF Development A/S, Strandvejen 70, 1stfloor, DK-2900 Hellerup,Denmark, tel.: (+45) 39 200 250, e-mail: info@elfdevelopment.dk.

ELF Development A/S

Privacy policy for the ELF Group

General principles for the protection of personal data

Responsibility for personal data

Purpose of and legal basis for the processing of personal data

Personal data processed by the ELF Group

When and how personal data are processed

Third parties and the processing of personal data

The rights of the data subject

Storage period

Right to complain

Other terms