Personal data

Processing of personal data in CEJ

We process personal data on behalf of our clients (property owners, and cooperative-, owners- and landowners associations). The client is the data controller and CEJ is the data processor. CEJ has made agreements about data processing with all our clients. The agreements ensure our clients (data controllers) that CEJ (data processor) is obliged to comply with the conditions in processing of personal data.

Why CEJ processes personal data

We process a variety of personal data to manage and operate the properties and residences in accordance with the management agreement. We do this to comply with the law and our contract with you. We store your contact information so we can communicate with you. Furthermore, we store information about your heating consumption in order to administrate heating expenses for the whole property. We ask you for your Danish civil registration number (CPR) if we e.g. need to pay you a board fee or return a deposit to your Nemkonto.
Regarding employees (property caretakers), we process data to manage the terms of employment, meet legal requirements, pay wages and indemnities, apply for reimbursement, etc.
We only collect and process necessary and relevant personal data. We limit the amount of personal data we collect and delete data we no longer need.
If we need to use personal data for a purpose other than that for which it was originally collected, you will be informed and requested to consent to the new processing of your data.

Data collection

We usually get the information from you. In some cases, the data comes from other sources – e.g. former property managers, estate agents providing information on the sale/purchase of a flat, public authorities, or other residents, e.g. due to a complaint.

When finalising your tenancy contract, you consent to CEJ processing your personal data and, in the case of shareholders and owners, we notify you of the data processing in our welcome letters.

We usually get the data/information from you. In some cases, the data comes from other sources – e.g. former property managers, estate agents providing information on the sale/purchase of a flat, public authorities, or other residents, e.g. due to a complaint.

When finalizing your tenancy contract, you consent to CEJ processing your personal data and, in the case of shareholders and owners, we notify you of the data processing in our welcome letters.

Categories of registered persons

Below is a list of individuals whose personal data we might store.

• Potential, current, and former clients (owners of properties for whom CEJ Property Management Ltd. and CEJ Aarhus Ltd. e.g. manage properties, parking lots or courtyard committees).
• Commercial tenants (current and former)
• Residential tenants and users of other properties, such as car parks (current and former)
• Shareholders (current and former)
• Commonhold owners (current and former)
• Subtenants (current and former)
• Members of the boards of cooperatives and owners’ associations (current and former)
• Property managers, caretakers and similar (present and retired)
• Applicants for waiting list (current and former)
• Relatives of tenants and owners (current and former)
• Suppliers, e.g. craftsmen and contractors (current and former)
• Individuals addressing the controller or processor

Examples of personal data

Here, you can see examples of personal data we process. We rarely possess comprehensive information, but usually we have the following:

• Name
• Address
• Phone number
• Email address
• Lease number information about the property, including consumption data (heating & water), laundry cards, passkeys/key cards, complaints, notices, housing assistance, subletting conditions, collateral, easements, registrations, and rights of pledge.
• Billing information, including account number, arrears, bankruptcy petitions, cooperative attachments, and deposits.

Sometimes, we also have the following information if you have provided it to us:

• CPR number
• Title, profession, and educational background (mainly suppliers & partners)
• Credentials (mainly commercial tenants and board members cf. the Money Laundering Act).

In rare cases we have:

• Date of birth
• Marital status (in cases of separation, divorce)
• TV surveillance (only in properties with TV surveillance that is recorded)
• Car registration number, for parking management.
• Personal health data, e.g. in connection with applications for accessibility improvements

Generally, we do not process sensitive personal data or information on criminal offences.

In connection with e.g. disputes, claims for damage, complaints, recovery and extinctions for tenants and owners, and in management of employees on properties, CEJ may – in exceptional cases – process sensitive personal data or information on criminal offences, if the processing is necessary to safeguard CEJ’s and/or the client’s rights in the case. We delete the information when it is no longer needed.

Often, our processing of your personal data occurs on a legal and legitimate basis that does not require your explicit consent. We therefore obtain your consent only in rare cases when it is necessary to process personal data for a specific purpose. This could e.g. be in connection with accessibility improvements in your home if you have a disability. Your consent is voluntary and can be withdrawn at any time.

Disclosure of personal data

We are required to disclose certain personal information about you in order to administer the property and comply with Danish law. This includes e.g. disclosing information to the property’s accountant and lawyers, to your estate agent regarding the sale of your flat, and to dispute bodies such as rent control boards and legal courts. We are also obliged to report personal data to the tax authorities and municipalities in connection with wages and housing benefits.

For the preparation of utility bills as well as ongoing information about your consumption, it is necessary to disclose information about your name, email address and on-account payments to the energy company for the preparation of utility bills for the property.

If you need a maintenance worker to repair something in your flat, we’ll give them your contact details so you can arrange a convenient time for the work to be done. The same applies for construction matters concerning the property when workers need to coordinate with you and your neighbors about when they can enter each flat.

Mastercard (Nets) receives information about your name, address, and payments for the purpose of sending you a rent collection.

If you live in a property with a tenants’ association, we must pass on relevant information about tenants and rental properties to them.

In some rent control board cases, comparable rental properties must be shown, which means that tenancy contracts from comparable rental properties must be shown, and the rent control board must also occasionally inspect the rental properties. We may therefore provide your tenancy contract in anonymized form to an external lawyer for the purpose of comparing rental properties in a rent control board case that does not concern you. The lawyer may need to get in touch with you, so we will provide them with your email address and phone number if we have them.

If the property is sold, or if the owner of the property (the data controller) does not want CEJ to manage the property anymore, CEJ is obliged to transfer all the property’s data, including personal data, to the new property manager, who will then be the data processor. If you live in a rental property that is covered by the legal duty to offer housing, after which tenants have the option to buy the property and form a cooperative, we are also obliged to provide copies of all tenancy contracts etc. in accordance with the law.

We always anonymize personal data whenever possible.

CEJ Property Management Ltd. and CEJ Aarhus Ltd. do not transfer or receive personal data to or from third countries and international organizations. Should a legitimate need arise, you will be informed in advance.

If we use other companies to process personal data, we also enter into data processing agreements that further regulate the company’s processing of personal data on our behalf.

Data sub-processers

CEJ has entered into agreements with a number of sub data-processors – e.g. we have a data processing agreement with Unik System Design, which is responsible for our management system – this is where all personal data is entered. Our sub data processors must also comply with our security requirements and may not process personal data for a purpose other than that for which it was collected.

Technical and organizational measures

We have implemented technical and organizational measures to protect your personal data from destruction, loss, unauthorized disclosure, and unauthorized access.

We use firewalls, encryption, passwords, ban on USB-sticks, etc. We also use Data Discovery to identify specific types of information from large data sets and determine if the data are in places they should not be.

Personal data are encrypted before being transmitted. The IT security of CEJ Property Management Ltd. and CEJ Aarhus Ltd. is documented with a ISAE 3402, type 2 certificate.

Training of CEJ employees

Our employees receive ongoing training on how to handle personal data responsibly. In addition, we have a comprehensive “Engine Room” with processes and instructions describing how personal data are to be handled, archived, deleted, etc.

Our legal department keeps up to date on changes in legislation so we can adapt accordingly.

Storage and deletion of your personal data

Our employees are trained in how to store your personal data and we have an archive plan that shows where information is stored. Our archiving is based on an assessment of how we can best protect your personal data. E.g., if we have your full CPR number, the vast majority of employees cannot see the last four digits – only a select few have access.

We also have a deletion guide so that everyone can see when data, including personal data, is to be deleted. Most deletions are centrally initiated.

In order to comply with general Danish law, including the Accounting Act, the Rent Act, the Money Laundering Act, etc., and to fulfil our contractual obligations, we store personal data for five years after the resident has moved out. We then anonymize the resident, which means that we delete the vast majority of information about you. However, in order to comply with the Rent Act, the following documents are not deleted:

• tenancy contracts including appendices and annexes
• rental notices and improvement increases
• board decisions and rulings
• move-in reports

Your rights

You have several rights regarding your personal data:

• Right to be informed about data processing and data collection
• Right of access to personal data we store
• Right to rectification of personal data
• Right to deletion if not needed by us
• Right to restriction of processing
• Right to be notified of rectification, deletion, restriction, and security breaches
• Right to data portability (supply of data)
• Right to objection

If you want to know what personal data we store, please write to our main email cej@cej.dk.

You also have the opportunity to complain about our processing of personal data. Complaints should be submitted to the Danish Data Protection Authority, Borgergade 28, 1300 Copenhagen K.