Newsec Property Asset Management believes strongly in responsible and effective processing of personal data, and we have therefore drawn up this policy that tells you how we process personal data for and on our customers.

You can also contact Newsec Property Asset Management concerning our gathering and processing of personal data by writing to persondata@newsec.dk.

Processing personal data for our customers In connection with administration of property, associations and companies, property projects etc., for our customers, we focus strongly on our services including gathering and processing data on identified or identifiable data subjects, i.e. personal data. We look at such aspects as the character and scope of personal data, categories of data subjects, the actual processing of personal data and the purpose of doing so, and how the Act on Processing of Personal Data should be complied with.

If our services include gathering and processing of personal data on behalf of the Customer, we will enter into a written Data Processing Agreement as a supplement to our Main Agreement with the Customer, which will fulfil the requirements of the Act on Processing of Personal Data, and which govern the object, duration and character of the processing and its purpose, types of personal data (including whether there is sensitive personal data), the categories of data subjects and the rights and duties of the Customer. The Customer will be the Data Controller for personal data concerning the Customer's tenants, property administrators and other employees.

Our gathering and processing of personal data on behalf of the Customer will be restricted to that agreed with the Customer, and that is necessary to fulfil any legal obligations we are subject to in accordance with Danish law. If we want to use the personal data for any other purpose than that they were originally gathered for, we will inform the Customer and obtain its consent in advance. However, by 'anonymising' personal data, so that data objects are no longer identified or identifiable, we can use the data for other purposes without having to provide notification.

As part of our gathering and processing of personal data on behalf of the Customer, we ensure full accordance with the Act on Processing of Personal Data and that we work on a legal, informed, transparent and documentable basis.

As far as the Customer's fulfilment of the rights of data subjects and its duty to check our processing and to work with the supervising authorities in accordance with the Act on Processing of Personal Data, we can provide assistance to ensure fulfilment in a reasonable and effective manner.

Processing personal data on our customers Newsec Property Asset Management can also gather the following personal data on our customers or their physical representatives if a legal entity:

• name
• address
• telephone number
• e-mail address
• photo ID (for the Customer's actual owners and agents only, in accordance with the Act on Measures to Prevent Money Laundering and Financing of Terrorism)
• business
• job title
• authorities held
• power to bind a company by signature
• board memberships/posts
• ownership of property covered by the contract
• ownership of companies covered by the contract
• insurance policies covered by the contract
• bank details covered by the contract
• accounting and tax details covered by the contract

Such data are necessary for us to be able to unambiguously identify and communicate with the Customer, administer the contractual relationship and fulfil the legal obligations we are subject to in accordance with Danish law, including the Act on Measures to Prevent Money Laundering and Financing of Terrorism. We can also use personal data for marketing other relevant services to the Customer, but the Customer can always opt out of such use. Because administration of the contract is thus dependent on personal data being correct and up to date, the Customer is asked to inform us of any changes.

In connection with administration of the contract, we may also need to gather and process supplementary personal data related to e.g. the authorities. In such instances, the Customer will be informed unless already aware of how we gather and process, or the Customer's interests in being informed are subjugated by overwhelming public or private interests or the enforcement of civil rights etc.

Dansk

We will be the Data Controller for the processing of the Customer's personal data.

The Customer's personal data will be shared with the public authorities to the extent we are obliged to do so in accordance with Danish law.

We store personal data until such time as any requirement related to the contract is obsolete, whereupon they will be deleted. However, some personal data can be stored for varying periods of time if not relevant to any subsequent requirement, if necessary to fulfil legal obligations arising from Danish law, or if a legal requirement comes into effect, is applied or defended. Personal data received in accordance with the Act on Measures to Prevent Money Laundering and Financing of Terrorism will thus be deleted 5 years after the end of the contract. We can also include personal data in our standard backup-procedure.

General

In connection with the processing of personal data, Newsec Property Asset Management will always comply with Danish data protection law.
Our processing and sharing of personal data will be limited to the purposes referred to, or to fulfil any legal obligations in accordance with Danish law. If we want to use the personal data for any other purpose than that they were originally gathered for, we will provide details and obtain consent in advance. However, by 'anonymising' personal data, so that data objects are no longer identified or identifiable, we can use the data for other purposes without having to provide notification.

We have implemented technical and organisational measures concerning confidentiality and data security that protect personal data against destruction, loss, modification, unauthorised publication and unauthorised access or disclosure. As part of the protection of personal data, we have to have written processes for processing it, and access to it shall be physically and systematically restricted to the personnel who need access to them in the course of their work, and who have received training and instruction in processing of personal data. Personal data in physical format or on portable data media shall be kept locked up when not in use, whilst personal data in digital format shall be protected by access control, personal access codes, backup-system, updated firewalls and anti virus software. In the event of a breach of security concerning personal data that can result in a risk of discrimination, identity theft, financial loss, loss of reputation or other significant inconvenience, we will provide details of the breach as quickly as possible.

We can share personal data with our associates working on our behalf for the purposes described, and member companies of the Newsec group, which Newsec Property Asset Management is a part of. In such instances, those companies shall observe our privacy policies and security requirements, and cannot use the personal data they receive from us for any other purpose. We can also share personal data as part of a mutual transaction, such as a merger or sale of assets.
We do not transfer personal data for processing outside the EU and EEA or to an international organisation, unless there are legal grounds for doing so, and in such instances details will be provided in advance.

Our products and services are only intended for persons over the age of 18, and if we become aware that personal data concerns an identified or identifiable person under 18, the data in question will be deleted.

The rapid development of the use of personal data means that changes in our processing of personal data can become necessary. We therefore reserve the right to revise this policy.

Rights

As part of our gathering and processing of personal data, the data subjects have a number of rights, such as the right to information on the processing of your personal data and the right to have your personal data deleted. However, such rights can be limited in certain situations or subject to certain conditions.
For more details on data subject rights, including requesting them to be exercised, please refer to:

Newsec Property Asset Management’s policy concerning the rights of registered data subjects