Here you can read about how CEJ processes personal data.
We process personal data on behalf of our clients (property owners, and cooperative-, owners- and landowners associations). The client is the data controller and CEJ is the data processor. CEJ has entered into processor agreements with all our clients. The agreement ensures the clients (data controller) that CEJ (data processor) is obliged to comply with the rules on the processing of personal data.
Why CEJ processes personal data
We process a variety of personal data to manage and operate the properties and residences in accordance with the management agreement. We also do this to comply with the law and our contract with you. We have your contact details so we can communicate with you, and we know your heating consumption in order to administrate heating expenses for the whole property. We ask you for your Danish CPR number if we e.g. need to pay your directors’ remunerations or return a deposit to your Nemkonto.
Regarding employees (property caretakers), we process data to manage the employment relationship, meet legal requirements, pay wages and indemnities, apply for reimbursement, etc.
We only collect and process necessary and relevant personal data. In fact, we want to limit the amount of personal data we collect, so we delete it if we don’t need it.
If we need to use personal data for a purpose other than that for which it was originally collected, you will be informed and may be asked to give your consent.
We usually get the information from you. In some cases, the data comes from other sources – e.g. former property managers, estate agents providing information on the sale/purchase of a flat, public authorities, or other residents, e.g. due to a complaint.
When finalising your tenancy contract, you consent to CEJ processing your personal data and, in the case of shareholders and owners, we notify you of the data processing in our welcome letters.
Categories of Registered Persons
Below is a list of individuals whose personal data we might store.
Categories of personal data
Here, you can see the personal data categories we process. We rarely have comprehensive information, but usually we have the following:
Sometimes, we also have the following information if you have provided it to us:
In rare cases we have:
Generally, we do not process sensitive personal data or information on criminal offences.
In connection with e.g. disputes, claims for damage, complaints, recovery and extinctions for tenants and owners, and in management of employees on properties, CEJ may – in exceptional cases – process sensitive personal data or information on criminal offences, if the processing is necessary to safeguard CEJ’s and/or the client’s rights in the case. We delete the information when it is no longer needed.
Often, our processing of your personal data occurs on a legal and legitimate basis that does not require your explicit consent. We therefore obtain your consent only in rare cases when it is necessary to process personal data for a specific purpose. This could be e.g. in connection with accessibility improvements in your home if you have a disability. Your consent is voluntary and can be withdrawn at any time.
Disclosure of personal data
We are required to disclose certain personal information about you in order to administer the property and comply with Danish law. This includes e.g. disclosing information to the property’s accountant and lawyers, to your estate agent regarding the sale of your flat, and to dispute bodies such as rent control boards and legal courts. We are also obliged to report personal data to the tax authorities and municipalities in connection with wages and housing benefits.
For the preparation of utility bills as well as ongoing information about your consumption, it is necessary to disclose information about your name, email address and on-account payments to the energy company for the preparation of utility bills for the property.
If you need a maintenance worker to repair something in your flat, we’ll give them your contact details so you can arrange a convenient time. The same is true for construction matters concerning the property, when workers need to coordinate with you and your neighbours about when they can enter each flat.
Nets receives information about your name, address and payments for the purpose of sending you a rent collection.
If you live in a property with a tenants’ association, we must pass on relevant information about tenants and rental properties to them.
In some rent control board cases, comparable rental properties must be shown, which means that tenancy contracts from comparable rental properties must be shown and the rent control board must also occasionally inspect the rental properties. We may therefore provide your tenancy contract in anonymised form to an external lawyer for the purpose of comparing rental properties in a rent control board case that does not concern you. The lawyer may need to get in touch with you, so we will provide them with your email address and phone number if we have them.
If the property is sold, or if the owner of the property (the data controller) does not want CEJ to manage the property anymore, CEJ is obliged to transfer all the property’s data, including personal data, to the new property manager, who will then be the data processor. If you live in a rental property that is covered by the legal duty to offer housing, after which tenants have the option to buy the property and form a cooperative, we are also obliged to provide copies of all tenancy contracts etc. in accordance with the law.
We always anonymise personal data whenever possible.
CEJ Property Management Ltd. and CEJ Aarhus Ltd. do not transfer or receive personal data to or from third countries and international organisations. Should a legitimate need arise, you will be informed in advance.
If we use other companies to process personal data, we also enter into data processing agreements that further regulate the company’s processing of personal data on our behalf.
CEJ has entered into agreements with a number of data sub-processors – e.g. we have a data processing agreement with Unik System Design, which is responsible for our administration system – this is where all personal data is entered. Our sub data processors must also comply with our security requirements and must not use personal data they receive from us for other purposes.
Technical and organisational measures
We have implemented technical and organisational measures to protect your personal data from destruction, loss, unauthorised disclosure and unauthorised access.
We use firewalls, encryption, passwords, ban on USB-sticks, etc. We also use Data Discovery to identify specific types of information from large data sets and determine if the data are in places they shouldn’t be
Personal data are encrypted before being transmitted. The IT security of CEJ Property Management Ltd. and CEJ Aarhus Ltd. is documented with a ISAE 3402 certificate.
Training of CEJ employees
Our employees receive ongoing training on how to handle personal data responsibly. In addition, we have a comprehensive “Engine Room” with processes and instructions describing how personal data are to be handled, archived, deleted, etc.
Our legal department keeps an eye on changes in legislation so we can adapt accordingly.
Our employees are trained in how to store your personal data and we have an archive plan that shows where information is stored. Our archiving is based on an assessment of how we can best protect your personal data. E.g., if we have your full CPR number, the vast majority of employees cannot see the last four digits – only a select few have access.
We also have a deletion guide so that everyone can see when data, including personal data, is to be deleted. Most deletions are centrally initiated.
In order to comply with general Danish law, including the Accounting Act, the Rent Act, the Money Laundering Act, etc., and to fulfil our contractual obligations, we store personal data for five years after the resident has moved out. We then anonymise the resident, which means that we delete the vast majority of information about you. However, in order to comply with the Rent Act, the following documents are not deleted :
You have a number of rights regarding your personal data:
If you want to know what personal data we store, please write to our main email firstname.lastname@example.org.
You also have the opportunity to complain about our processing of personal data. Complaints should be submitted to the Danish Data Protection Authority, Borgergade 28, 1300 Copenhagen K.