If you have general questions about data protection at AAU or your rights, or if you wish to complain to the DPO about AAU's processing of your personal data, you can contact our DPO here: dpo@aau.dk 

Please note: When you contact AAU's DPO, AAU processes the following personal data about you for administrative purposes, cf. The General Data Protection Regulation art. 6 (1) (e) and art. 39: Name, email, phone no. and the information you may provide about yourself in the inquiry. This information is passed on to AAU's DPO, who is externally attached. 

In addition to storing personal data on local servers at AAU, we use suppliers of IT systems such as Microsoft and KMD WorkZone for general processing of personal data. We have entered into data processing agreements with the suppliers. This means, among other things, that the suppliers are subject to instructions from AAU, confidentiality and compliance with the data protection rules and other relevant legislation. 

The information is stored for as long as the case is current and for 3 years after the conclusion of the case, after which the information is archived in accordance with the rules of the Archives Act.  Archiving your personal data under the Danish Archives Act means that AAU, as a government authority, in some cases may be obliged to file and/or submit the information to the Danish National Archives. When the information is submitted to the Danish National Archives, the rules of the Danish Archives Act apply, and among other conditions, permission from the Danish Data Protection Agency is required for the disclosure of personal data.

Aalborg University (AAU) is one of Denmark’s eight universities, and we collect and process personal information about various individuals. As a rule, Aalborg University will record and process your personal data if you are or have been employed or enrolled as a student, if you have attended a conference, if you have collaborated with the University or if you subscribe to any of the University’s web services.  Furthermore, the University processes personal data in connection with research projects. In all of such cases, Aalborg University is the data controller.

Aalborg University's personal data policy applies to the personal data that Aalborg University collects and processes. References in this personal data policy to 'AAU, the university, we, us or our' refer to Aalborg University.

Aalborg University’s official contact details:

Aalborg University
Fredrik Bajers Vej 7K
DK - 9220 Aalborg East

Tel.: +45 9940 9940
aau@aau.dk 
www.en.aau.dk   
CVR No.: 29102384   

Aalborg University is obliged, pursuant to Articles 13 and 14 of the General Data Protection Regulation, to provide you with information about how we process your personal data. You can read more about that on this page. 

You can find information about how we process your personal data by first selecting whether you are a current or former employee, under recruitment, student, business partner, supplier or website visitor (cookies). Then you select the tab with the topic to which the processing of your personal data relates. For example, if you want to know how we process your personal data about you as an employee on maternity leave, you will find the information at "Recruitment, current and former employee" under "Maternity leave". 

You can report a security incident here: Security incidents - Aalborg University

When you report a security incident to AAU, we need to process the following personal data about you for the purpose of handling the case, in accordance with the General Data Protection Regulation art. 6(1) (c) and Art. 33: Name, email, phone number, and any information you may provide to us in connection with your report.

If your personal data is covered by a security incident, you can read more about how we process your personal data in connection with the handling of the incident under 'Handling of security incidents' under the tab for employees, students and external parties, suppliers, etc. below. 

Aalborg University treats all personal data as confidential. All personal data are processed and stored in the University’s own case administration systems. When the University no longer uses the data for the purposes for which they were collected, the data will be erased or archived in Aalborg University’s filing system. However, the University may need to comply with other legislation which may require us to store personal data for shorter or longer periods.  

We value security and have introduced a number of security measures that help us protect both your personal data and our business. In this respect, we have increased security through the introduction of various strategies, controls, policies and technical measures. We protect your personal data through the application of encryption methods and other security measures, such as firewalls and password protection. We continuously seek to increase security and ensure that our staff members are well equipped for the ever-changing technical opportunities.

You can find more information on your rights at the Danish Data Protection Agency website, specifically the guidelines on the rights of data subjects, which you find at https://www.datatilsynet.dk/english 

Data subjects have the right to submit a complaint about how their personal data is processed to the Danish Data Protection Agency at dt@datatilsynet.dk or by post to Datatilsynet/the Danish Data Protection Agency, Borgergade 28, 5., 1300 Copenhagen K.

However, you are encouraged to contact Aalborg University's Data Protection Officer at dpo@aau.dk in advance, as the case may be resolved or clarified.

When AAU collects and uses the personal data of individuals, we are required to provide the following information to such individuals:

• AAU’s contact details and the contact details of AAU’s data protection officer where relevant
• AAU’s purposes for processing your personal data and the lawful basis for the processing
• The categories of personal data obtained and how they have been obtained
• The recipients or categories of recipients to whom the personal data have been or will be transferred, including recipients in third countries or international organisations
• The retention periods for the personal data
• The rights of data subjects
• The right to lodge a complaint with the Danish Data Protection Agency or another supervisory authority
• The existence of automated decision-making, including profiling
• Whether AAU plans to use personal data for a new purpose

This right to be informed applies regardless of whether AAU has collected the personal data directly from the data subject or obtained the personal data from a third party.

Exceptions 

AAU is not required to comply with the obligation to inform data subjects where it is clear that the data subject is already familiar with the above information; similarly, the right to be informed does not apply in such cases when personal data must remain confidential or when the University has a statutory obligation to process personal data.

The right of access provides individuals with the right to make a subject access request to obtain information on what happens to their personal data.

The right of access provides you with the right to obtain confirmation as to whether AAU processes personal data about you; if this is the case, you have the right to request access to your personal data and you have the right to request access to the following information:

• The purposes for which your personal data are processed
• The categories of personal data obtained and how they have been obtained
• The recipients or categories of recipients to whom the personal data have been or will be transferred, including recipients in third countries or international organisations
• The retention periods for the personal data
• The rights of data subjects
• The right to lodge a complaint with the Danish Data Protection Agency or another supervisory authority
• Where the personal data are not collected from the data subject, any available information as to their source
• The existence of automated decision-making, including profiling

Deadlines 

When you make a subject access request, AAU must respond as soon as possible and no later than a month after having received your request. This deadline will apply whether you request to receive general or more specific information about your personal data. However, AAU may extend the time limit to respond to subject access requests if a request is particularly complex. If special circumstances apply, we may send a preliminary response to you, stating the reasons for the delay.

Submitting a subject access request

There are no specific requirements as to how you should submit a subject access request. You can request access via email, by post, over the telephone or by contacting us in person. However, we kindly ask you to follow the steps below as this makes it easier for us to respond to your request.

You are not required to state your reasons for requesting access.

If you are making a subject access request for yourself, please use this subject access request form.

If you are making a subject access request on behalf of someone else of which you have legal authority to act (e.g. power of attorney, parental authority or guardianship), please use the subject access request form for subject access request via a third party.

Since the subject access request forms contain confidential information, we recommend that you send these to AAU using secure email via e-Boks or borger.dk, select ‘AAU post’. You can also send your request by email to the department at AAU that processes your personal data according to this policy. Alternatively, you can write to dpo@aau.dk

Responding to subject access requests 

Before responding to your subject access request, we must be able to verify your identity, and we will therefore forward the requested information to you via e-Boks/Digital Post. If you do not wish to receive the response via e-Boks/Digital Post, you must collect the information in person at the University; on collecting the response in person, you will need to present a valid photo ID. By only responding to your subject access request by way of the above methods, we ensure that such responses do not fall into the wrong hands.

Upon complying with your subject access request, AAU must always consider whether this may infringe the rights of other individuals or organisations. This may constitute an infringement of the rights and freedoms of other individuals or an infringement of trade secrets or intellectual property rights. In such cases, we will blur any information that may breach the rights of other data subjects before submitting the response to you.
 

Refusal of subject access requests

In the event that AAU cannot comply with your subject access request, you will receive a refusal of your subject access request along with the reasons for refusal within one month.

Your subject access request may be refused if your right of access does not apply to how we process your personal data, if we are not processing your personal data or if we cannot verify your identity.

The right of access does not apply to personal data used as part of research projects. Therefore, if you have submitted your personal data to AAU via a research project, you do not have a right of access to such information.

If the personal data that AAU is processing about you are inaccurate, you have the right to have your data rectified.

Similarly, you have the right to have incomplete personal data completed if the missing data are relevant to the purpose of the processing.  

AAU is obliged to rectify your personal data without undue delay.

If you wish to have personal data that AAU processes about you corrected or supplemented, you must download, fill out and send the request form for rectification to AAU at https://www.ansatte.aau.dk/regler/organisation/anmodning-om-sletning-indsigt-berigtigelse-indsigelse-eller-begraensning to the address dpo@aau.dk with a reference to the information in question.

Exceptions

The right to rectification does not apply if your personal data are processed exclusively for scientific or statistical purposes.

Notification obligation

If AAU corrects personal data about you and this information has previously been disclosed, AAU must notify all recipients of the correction. However, this does not apply if the notification is impossible or disproportionately difficult.

Furthermore, AAU is obliged to inform you of these recipients upon request.

According to the General Data Protection Regulation, AAU is obliged to erase personal data without undue delay where one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• AAU is processing your data based on your consent and you withdraw your consent, and AAU has no other legal ground for the processing.
• You object to the processing of your personal data according to art. 21 of the GDPR.
• Your personal data have been unlawfully processed (i.e. without legal basis in the General Data Protection Regulation, Chapter II).
• AAU has a legal obligation to erase your personal data according to law.

If you wish to have personal data that AAU processes about you erased, you must download, fill in and send the request form regarding deletion to AAU at https://www.aaudxp-cms.aau.dk/media/u1gez4on/anmodning-om-sletning_skema.docx to the address dpo@aau.dk with a reference to the information in question.

Exceptions 

The right to erasure of personal data does not apply in the following cases:

• If the processing is necessary for exercising the right of freedom of speech and information.
• If the processing is necessary for compliance with a legal obligation to which AAU is subject.
• If the processing is carried out in order to carry out a task in the public interest or a public authority task.
• If the processing is necessary for reasons of public interest in the area of public health.
• If the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• If the processing is necessary to establish, exercise or defend a legal claim.

Since AAU is both a university and a public authority, the above stated exceptions to the right to erasure mean that, in most cases, you will not be able to have your personal data erased. This is due to the fact that public authorities must always be able to demonstrate the basis on which a decision is based. However, if you learn that AAU is processing incorrect or incomplete data about you, you have a right to rectification, cf. section 5.3.

Notification obligation

If AAU erases personal data about you and this information has previously been disclosed, AAU must notify all recipients of the deletion. However, this does not apply if the notification is impossible or disproportionately difficult.

Furthermore, AAU is obliged to inform you of these recipients upon request.

In some cases, you have the right to restrict the processing of your personal data. Restriction of processing means that the stored personal data are labelled for the purpose of restricting the future processing of that data. During the period of restriction, AAU may only store the personal data. Thus, the data may not be accessed, used or disclosed. 

You have the right to obtain restriction of processing where one of the following applies: 

• You contest the accuracy of the personal data. AAU will restrict the processing while verifying the accuracy of the personal data.
• The processing is unlawful, but you oppose the erasure of your personal data and instead request the restriction of their use.
• AAU no longer needs to process the personal data, but they are required to establish, exercise or defend a legal claim.
• You have objected to the processing of your personal data. AAU will restrict the processing while verifying whether AAU’s legitimate grounds override yours.

If you wish to restrict AAU's processing of your personal data, you must download, fill in and send the request form regarding restriction to AAU at https://www.aaudxp-cms.aau.dk/media/pzkfznyq/anmodning-om-begraensning_skema.docx to the address dpo@aau.dk with a reference to the information in question.

Exceptions

Even if the processing of your personal data has been restricted, AAU may nevertheless process your data in the following cases:

• If you have given your consent to the processing.
• If the processing is carried out to establish, exercise or defend a legal claim.
• If the processing is carried out to protect a person or a company.
• If the processing is carried out for reasons of public interest.
• Furthermore, the right to restriction does not apply if your personal data are processed exclusively for scientific or statistical purposes.

If you have obtained restriction of processing, AAU must notify you before the restriction is lifted.

Notification obligation

If AAU restricts the processing of personal data about you and this information has previously been disclosed, AAU must notify all recipients of the restriction. However, this does not apply if the notification is impossible or disproportionately difficult.

Furthermore, AAU is obliged to inform you of these recipients upon request.

You can request to exercise one or more of the above rights by contacting AAU here: dpo@aau.dk 

Why we process your personal data

When you submit a request to exercise one or more of the above rights, we process your personal data for administration, handling and response as well as documentation. 

We process this information about you

We process all the information that we may have registered about you that you wish to exercise your rights regarding and the information that you provide in your request. We process the data in accordance with Article 1 of the General Data Protection Regulation art. 6(1) (c) and art. 13-22.

How we store your personal data

We store your personal data securely and confidentially in accordance with applicable information security regulations. Only employees who have a work-related need have access to process the personal data.

In addition to storing personal data on local servers at AAU, suppliers of IT systems such as Microsoft and KMD use WorkZone for general processing of personal data. We have entered into data processing agreements with the suppliers. This means, among other things, that the suppliers are subject to instructions from AAU, confidentiality and compliance with the data protection rules and other relevant legislation. 

For how long do we process and store your personal data

We will store the documents containing your personal data with regard to the request case for as long as the case is being processed and for 5 years after the decision has been made. We then archive your personal data (in accordance with the Danish Archives Act).

Archiving your personal data under the Danish Archives Act means that AAU, as a government authority, may in some cases be obliged to file and/or submit the information to the Danish National Archives. When the information is submitted to the Danish National Archives, the rules of the Danish Archives Act apply, which requires permission from the Danish Data Protection Agency for the disclosure of personal data.  

We disclose your information in these cases and to these recipients

We may lawfully disclose your personal data (or parts of your personal data) to specific recipients for purposes that are not incompatible with the original purposes and in accordance with applicable law. In some cases, we may be required by other public authorities to disclose personal data about you in accordance with sector-specific legislation (GDPR art. 6(1) (e)) for the use of statistics, surveys, political work, access to documents and other societal tasks that are imposed on us.

A cookie is a small data file that is stored on your computer, tablet or mobile phone. A cookie is not a programme that can contain malicious programmes or viruses.

Website use of cookies

Cookies may be necessary to make the website work. Cookies also help us get an overview of your visit to the website so that we can continuously optimise and target the website to your needs and interests. Cookies remember, for example, what you have added to a shopping cart, whether you have previously visited the site, whether you are logged in and what language and currency you would like to see on the website. We also use cookies to target our ads to you on other websites. Overall, we use cookies as part of our service to display content that is as relevant as possible to you.

How long are cookies stored?

How long a particular cookie is stored on your devices and browsers varies. The lifetime of a cookie is calculated based on your last visit to the website. When the lifetime of the cookie expires, it is automatically deleted. See the expiration time for each cookie in the complete list of cookies below.

We use cookies in the following categories: necessary, functional, statistical and marketing. See details below.

Necessary cookies

Necessary cookies help make a website usable by enabling basic features such as page navigation and access to secure areas of the website. The website cannot function optimally without these cookies.

Functional cookies

We collect information about your preferred settings and choices on the website. We do this in order to show you the version of the website that suits your preferences. The information is used to determine which region and language you prefer for displaying videos and other visual elements on the website.

Statistical cookies

We collect information about how you interact with the website, including how often you visit the site and what pages you look at. We do this in order to optimise design and ease of use and to improve the efficiency of the website. In addition, we use the information to provide you with personalised content and prepare market analyses. For this we use our own cookies as well as Google Analytics. We have no interest in how you specifically use our web pages; we are only interested in overall behaviour patterns such as how many people visit a given page during a given period of time, where traffic comes from, what type of device is used, etc.

Marketing cookies

We collect information about your interests, including which pages and ads you click on, which products or services you show interest in or register for on this and other websites. We do this to show you ads that are relevant to you and your interests. In order to show you targeted ads on this and other websites, such as Facebook, Linkedin and Adwords, we work with other companies sharing information with them. We also use third-party services from e.g. Google. In this context, third parties receive information about your browser, IP address and the pages you visit on aau.dk. If you are logged into Google at the same time as your visit, this data can be linked to your profile on this service. This is beyond AAU's control and is therefore solely a relationship between you and third parties.

On some pages, such as news pages, Aalborg University allows you to share content on social media platforms like Facebook, Twitter, Instagram and LinkedIn. In addition, Aalborg University shares social media feeds on our website. Finally, there may be a few aau.dk pages with posts integrated with social media, which means that social media platforms, via Aalborg University's website, put their own cookies on your device in order to be able to target and personalise ads for you. In this context, you should be aware that this cookie policy does not cover the use of cookies by social media, and you should therefore instead orient yourself in the cookie or privacy policies of the individual social media platform.  

Unclassified cookies

Unclassified cookies are cookies that we are in the process of classifying in conjunction with the providers of the individual cookies.

See complete list of cookies below.

You can always reject cookies completely by changing the settings in your browser on your computer, tablet or phone. However, you should be aware that if you reject all cookies, there will be features and services on the website that you cannot use as these are dependent on cookies.

You can opt out of cookies from Google Analytics here.

How to delete cookies

Cookies you have previously accepted can easily be deleted. How you delete these cookies depends on the browser you are using (Chrome, Firefox, Safari, etc.) and which device (mobile, tablet, PC, mac).
Cookies can be deleted typically under Settings - Security and Privacy, but this can vary from browser to browser. Click on the appropriate link for the device/browser you use:

• Internet Explorer
• Microsoft Edge
• Mozilla Firefox
• Google Chrome
• Opera
• Safari
• Flash cookies
• Apple
• Android
• Windows 7

Remember: If you use multiple browsers, delete cookies in all of them.

Changing your consent

You can change your consent in a particular browser either by deleting cookies from the specific browser or by changing your original selection by clicking inside the cookies pop-up message.

When you visit aau.dk, AAU processes the following categories of personal data:

• Name, address, email
• IP addresses

Purposes of processing personal data

When you visit aau.dk, AAU processes personal data about you for the following purposes:

• To ensure that you view the website correctly
• ​To optimise and improve the website based on your behaviour on the website
• To ensure that, if you have consented to receive newsletters or information material, you receive the newsletters and information material that you have consented to.
• To customise ads on Aalborg University's website and on Aalborg University partners’ websites so that ads are tailored to you and your interests.

Basis for processing of personal data

We process the personal data collected on aau.dk based on your consent, which you can withdraw at any time. See more on this under the "Your rights" section of the privacy policy above.

Storage of personal data

Information collected on the basis of your consent will be stored until you withdraw your consent. Information collected and related solely to viewing aau.dk will be deleted when you leave the website.

Questions

If you have questions about the processing of your personal data or your rights under the General Data Protection Regulation, please contact dpo@aau.dk.