Processing of personal data in CEJ
We process personal data on behalf of our clients (property owners, and cooperative-, owners- and landowners associations). The client is the data controller and CEJ is the data processor. CEJ has made agreements about data processing with all our clients. The agreement ensures our clients (data controllers) that CEJ (data processor) is obliged to comply with the conditions in processing of personal data.
Why CEJ processes personal data
We process a variety of personal data to manage and operate the properties and residences in accordance with the management agreement. We do this to comply with the law and our contract with you. We store your contact information so we can communicate with you. Furthermore, we collect and store information about your heating consumption in order to administrate heating expenses for the whole property. We ask you for your Danish CPR-number if we e.g. need to check you in Experian (RKI) and to pay you a board fee or return a deposit to your NemKonto.
Regarding employees (property caretakers), we process data to manage the terms of employment, meet legal requirements, pay wages and indemnities, apply for reimbursement, etc.
We only collect and process necessary and relevant personal data. We limit the amount of personal data we collect and delete data we no longer need.
If we need to use personal data for a purpose other than that for which it was originally collected, you will be informed and requested to consent to the new processing of your data.
Collecting data
We usually get the data/information from you. In some cases, the data comes from other sources – e.g. former property managers, estate agents providing information on the sale/purchase of a flat, public authorities, utility company or other residents, e.g. due to a complaint.
When finalizing your tenancy contract, we inform you of CEJ’s processing of your personal data and, in the case of shareholders and owners, we notify you of the data processing in our welcome letters.
Categories of data subjects
Below is a list of individuals whose personal data we might store.
Examples of personal data
Here, you can see examples of personal data we process. We rarely possess comprehensive information, but usually we have the following:
Sometimes, we also have the following information, if you have provided it to us:
In rare cases we have:
Generally, we do not process sensitive personal data or information on criminal offences.
In connection with e.g. disputes, claims for damage, complaints, recovery and extinctions for tenants and owners, and in management of employees on properties, CEJ may – in exceptional cases – process sensitive personal data or information on criminal offences, if the processing is necessary to safeguard CEJ’s and/or the client’s rights in the case. We delete the information when it is no longer needed.
Often, our processing of your personal data occurs on a legal and legitimate basis that does not require your explicit consent. This is because the processing of your personal data is necessary for the data controller and CEJ to fulfill our agreement with you, handle your inquiries and pursue a legitimate interest cf. Data Protection Regulation art. 6, subsection 1, letters b and f.
We therefore obtain your consent only in rare cases when it is necessary to process personal data for a specific purpose. This could e.g. be in connection with accessibility improvements in your home if you have a disability. Your consent is voluntary and can be withdrawn at any time.
Disclosure of personal data
We are required to disclose certain personal information about you in order to administer the property and comply with Danish law. This includes e.g. disclosing information to the property’s accountant and lawyers, to your estate agent regarding the sale of your flat, and to dispute bodies such as rent control boards and legal courts. We are also obliged to report personal data e.g. to the tax authorities and municipalities in connection with wages and housing benefits.
For the preparation of utility bills as well as ongoing information about your consumption, it is necessary to disclose information about your name, email address and on-account payments to the energy company for the preparation of utility bills for the property.
If you need a maintenance worker to repair something in your flat, we’ll give them your contact details so you can arrange a convenient time for the work to be done. The same applies for construction matters concerning the property, when workers need to coordinate with you and your neighbors about when they can enter each flat.
Mastercard (formerly Nets) receives information about your name, address and the amount of the collection of rent, cooperative fees or common costs issued by Mastercard.
If you live in a property with a tenants’ association, we must pass on relevant information about tenants and rental properties to them.
In some rent control board cases, comparable rental properties must be shown, which means that tenancy contracts from comparable rental properties must be shown, and the rent control board must also occasionally inspect the rental properties. We may therefore provide your tenancy contract in anonymized form to an external lawyer for the purpose of comparing rental properties in a rent control board case that does not concern you. The lawyer may need to get in touch with you, so we will provide them with your email address and phone number if we have them.
If the property is sold, or if the owner of the property (the data controller) does not want CEJ to manage the property anymore, CEJ is obliged to transfer all the property’s data, including personal data, to the new property manager, who will then be the data processor. If you live in a rental property that is covered by the legal duty to offer housing, after which tenants have the option to buy the property and form a cooperative, we are also obliged to provide copies of all tenancy contracts etc. in accordance with the law.
We always anonymize personal data whenever possible.
CEJ Property Management Ltd. and CEJ Aarhus Ltd. do not transfer or receive personal data to or from third countries and international organizations. Should a legitimate need arise, you will be informed in advance.
Disclosure of data to EjendomDanmark
This section only applies to tenants in properties where the landlord (currently Danica Ejendomme P/S, the Pears group and Danmarks Lærerforening) has chosen to report data to the industry organization EjendomDanmark for use in preparing market statistics. If you are a tenant in one of these properties, you have received a message that data is being passed on.
The information that is passed on to EjendomDanmark is property-related information, such as tenant number, rental address, size, rent, move-in date, etc.
No information about the tenant’s name, CPR number, e-mail or telephone number is passed on.
The information is general, non-sensitive personal data and the processing is necessary to pursue a legitimate interest, cf. data protection regulation art. 6, subsection 1, letter f.
You can read more about the processing of personal data in connection with EjendomDanmark’s market statistics, which can be found here.
Data sub-processers
CEJ has entered into agreements with a number of sub data-processors – e.g. we have a data processing agreement with Unik System Design, which is responsible for our administration system – this is where all personal data is entered. Our sub data processors must also comply with our security requirements and may not process personal data for a purpose other than that for which it was collected.
Technical and organizational measures
We have implemented technical and organizational measures to protect your personal data from destruction, loss, unauthorized disclosure and unauthorized access.
We use firewalls, encryption, passwords, ban on USB-sticks, etc. We also use a Data Discovery program to identify specific types of information from large data sets and determine if the data are in places they shouldn’t be.
Personal data are encrypted before being transmitted. The IT security of CEJ Property Management Ltd. and CEJ Aarhus Ltd. is documented with a ISAE 3402, type 2 certificate.
Training of CEJ employees
Our employees receive ongoing training on how to handle personal data responsibly. In addition, we have a comprehensive “Engine Room” with processes and instructions describing how personal data are to be handled, archived, deleted, etc.
Our legal department keeps up to date on changes in legislation so we can adapt accordingly.
Storage and deletion of your personal data
Our employees are trained in how to store your personal data and we have an archive plan that shows where information is stored. Our archiving is based on an assessment of how we can best protect your personal data. E.g., if we have your full CPR number, the vast majority of employees cannot see the last four digits – only a select few have access.
We also have a deletion guide so that everyone can see when data, including personal data, is to be deleted. Most deletions are centrally initiated.
In order to comply with general Danish law, including the Accounting Act, the Rent Act, the Money Laundering Act, etc., and to fulfil our contractual obligations, we store personal data for five years after the resident has moved out. We then anonymize the resident, which means that we delete the vast majority of information about you. However, in order to comply with the Rent Act, the following documents are not deleted:
Your rights
You have a number of rights regarding your personal data:
If you want to know what personal data we store, please write to our main email cej@cej.dk.
You also have the opportunity to complain about our processing of personal data. Complaints should be submitted to the Danish Data Protection Authority, Carl Jacobsens Vej 35, 2500 Valby.
Calls to our main number (tel. +45 33 33 82 82) will not be answered on December 23rd and will only be answered between 10 am and 12 pm on December 27th and 30th.