Personal data policy

The majority of the processing of personal data that takes place at Business Academy Aarhus has a well-defined purpose, which stems from the fact that the Academy, as a data controller educational institution, is authorised (allowed) to comply with a legal obligation in the processing or that the processing may fall under the public authority functions. To fulfil the various requirements of the educational institution, it is necessary to collect and process personal data, and therefore, there may be cases where the processing of data about you is mandatory, for example, when allocating a place on a programme or course.

In some cases, Business Academy Aarhus may disclose personal data to third parties for processing, but the responsibility for the processing remains with the Academy as data controller.

The Academy may need to collect personal data that is not covered by the legal basis. In these cases, we must request your consent before collecting and processing your personal data. Your consent must be voluntary, specific and informed so that you can give consent on an informed basis, and you can always withdraw your consent.

If you have any questions about your consent, please contact persondata@baaa.dk.

We only process your personal data for as long as there is a legitimate purpose for it. When this purpose is no longer applicable, the processing of your personal data will be stopped and the data will be deleted.

However, there are certain situations where the purpose still applies even though you stop being a student or employee. For example, financial data may need to be stored for a longer period of time, and for students, personal data needs to be stored so that diplomas can be recreated for at least 30 years.

Depending on the nature of your enquiry, you can contact the following 3 recipients:
If you have any questions about the processing of your personal data, you are welcome to contact the Academy's GDPR group:

• GDPR group
• persondata@baaa.dk 

If you have any questions about the legality of the processing of your data, you are welcome to contact the Academy's DPO Team (Data Protection Officer):

• The joint DPO function
• gdpr@efif.dk 
• Phone: +45 8936 3280
• Sønderhøj 28, 8260 Viby J

If you want to complain about the Academy's processing of your personal data, you can contact:

• Danish Data Protection Agency
• dt@datatilsynet.dk 
• Phone: +45 3319 3200
• Borgergade 28, 5th floor, 1300 Copenhagen K

When Business Academy Aarhus collects personal data from students, employees, applicants, stakeholders or partners, this is either done directly via the person concerned or by transferring personal data from a third party, e.g. via optagelse.dk or when applying for a job. In all cases, you will be informed about the purpose of the data collection.

When your personal data is processed by Business Academy Aarhus, you have the right to the disclosure of information on what personal data we process about you. If you want access, you must contact persondata@baaa.dk and specify what you want access to and identify yourself by name and your CPR number. Your request for access will usually be answered within one month.

As a data controller, the Academy is responsible for the accuracy of the personal data processed. If you become aware of errors in your personal data that the Academy processes, you have the right to have your personal data rectified. Contact persondata@baaa.dk if you wish to rectify your personal data.

You have the right to have your personal data deleted if there is no longer a legitimate purpose to keep it, if you have withdrawn your consent, or if it is not treated per the EU’s Data Protection Act. Contact persondata@baaa.dk if you want personal data deleted. Your request for deletion will normally be answered within one month.

Your rights are described in Regulation (EU) 2016/679 of the European Parliament and of the Council, section 3. If you have any questions about the legality of the processing of your personal data, please contact:

• The joint DPO function
• gdpr@efif.dk 
• Phone: +45 8936 3280
• Sønderhøj 28, 8260 Viby J

Personal data can be categorised into 3 different types:

• General personal data, e.g. name, address, contact information, etc.
• Special information, e.g. CPR, marks, criminal offences, significant social conditions
• Sensitive information, such as health information

The Academy may process personal data in all three categories, but the vast majority of it is general personal data. There must always be a legitimate purpose for processing personal data, regardless of which category it belongs to.

You can contact persondata@baaa.dk if you want to know which categories of your personal data are processed.

For inquiries concerning personal data at Business Academy Aarhus, for the vast majority of cases, you must send an email to persondata@eaaa.dk

If you need to contact our Data Protection Officer, Business Academy Aarhus’ DPO (Data Protection Officer) team has these contact details:

The joint DPO function
Email: gdpr@efif.dk 
Telephone:  +45 8936 3280
Address: Sønderhøj 28, 8260 Viby J

You can read more about your rights and appeals on the Danish Data Protection Agency's website datatilsynet.dk/english, or submit a complaint to:

Data Protection Authority, Borgergade 28, 5th floor, 1300 Copenhagen K
Phone: 3319 3200
Email: dt@datatilsynet.dk