privacy notice - investors
Here, you can read about how we handle your personal data as a shareholder or potential shareholder (“Investor”) of kompasbank a/s, valid from 1 March 2024.
We are committed to protecting and respecting your data and your privacy. When you become an Investor of kompasbank, we are the data controller (“dataansvarlig”) processing your personal data.
This Privacy Notice applies to you as a private individual either directly buying shares in kompasbank, as a beneficial owner of an Investor, an advisor of an Investor or a PEP (“Politically Exposed Person”) with relations to the Investor and describes several matters concerning our processing of your personal data.
1. What is personal data?
When we say ‘personal data’, we mean information which may be used to identify you as an individual (for example, a combination of your name and postal address).
2. How do we process your personal data? At kompasbank, we process your personal data confidential and, of course, in compliance with the Danish Data Protection Act, the General Data Protection Regulation (‘GDPR’), the Danish Data Protection Agency's guidelines and other relevant legislation.
We collect and process general (non-sensitive) personal information as stated below:
Name, address, telephone number, birth date, information about beneficial owners and email are general personal data that we process, just as we process information about your possible status as a Politically Exposed Person (PEP) or a close relative of a PEP as well as percentage of shares and sanctions-check.
The personal information is primarily gathered from you. Furthermore, we can collect information from adverse media (i.e. Google and Experian).
3. Purpose of processing and the legal basis
We process your personal data for the following purposes:
Investing in kompasbank
Compliance with applicable law
We do not ask for information beyond what is necessary and relevant to fulfil the above purposes.
We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis will be one of the following:
Legitimate interests (GDPR art. 6, no. 1, litra f): Information such as your name and contact information, we collect and process because we have a legitimate reason to use it, and this is reasonable when balanced against your right to privacy Legal obligations (GDPR art. 6, no. 1, litra c): In some cases, we have a legal responsibility to collect and store your personal data, ie. in order to report and comply with the company law regarding keeping shareholder register and sanction screening regulation, and this is why we collect etc. birthdates.
4. How long will you keep my personal data for?
If you do not become an Investor in kompasbank, we will keep your personal information for no more than 6 months. If you become an Investor, we will keep your personal data 5 years after you are no longer an investor unless legislation or special circumstances necessitate a longer storage, e.g. meeting a legal claim.
5. Protection of your personal data
We have established several technical and organisational measures to ensure that your personal data is not accidentally or illegally deleted, published, made known to unauthorised persons or misused.
6. The right to information and other rights
You have the right to access the information we have collected about you and get incomplete or inaccurate personal data about you corrected or deleted.
You also have the right to request restrictions on how we may process your information. Sometimes, you have the right to object to our processing of your personal data based on our legitimate interest. In the event of an objection, we will assess whether the processing can continue or your situation means your objection can be met. Finally, you have the right to have your information transferred to you or another company (data portability). You can read more about your rights in the Danish Data Protection Agency's guide on data subjects' rights, which you can find at www.datatilsynet.dk.
We keep records that we have complied with (or possibly rejected) your request to use one of your rights for two years.
You make use of your rights by contacting our data protection responsible. See the contact information below.
7. Transfer of information (including third-country transfers)
We share your personal information with the following recipients: Lawyers, authorities, other shareholders when providing access to the shareholder register and courts when this is necessary in law cases
We also use third parties (data processors) for storage and processing of data, i.e. processing and storage of your personal information in our IT systems provided by private companies. They process information solely on our behalf and are prohibited from using it for their own purposes.
We only use data processors and/or sub-processors in the EU or in countries that can provide your information with satisfactory protection.
8. Duty of confidentiality
You have a duty of confidentiality. This means that information about you, including your personal data, will not be unjustifiably passed on to third parties.
9. Data controller
We, kompasbank a/s, CVR.no. 38803611, Frydenlundsvej 30, 2950 Vedbæk, are Data Controller regarding the personal information we collect.
10. Data Protection Responsible
We have appointed a Data Protection Responsible (“DPR”) who is responsible for ensuring that kompasbank complies with the relevant data protection regulation. You can always contact our DPR with inquiries or questions regarding our processing of personal information:
kompasbank a/s Att. Data Protection Frydenlundsvej 30 2950 Vedbæk Phone +45 38 42 33 00 Email: databeskyttelse@kompasbank.dk
11. The Danish Data Protection Agency (Datatilsynet)
If you are unhappy with the way we process your personal information, you can always submit a complaint to the Danish Data Protection Agency. You can find the contact information at www.datatilsynet.dk.
12. Changes to the Privacy Notice
We may change our processing of personal data at any time to reflect changes in our use of your information and comply with applicable legal obligations and decisions of relevant authorities. We encourage you to regularly review this Privacy Notice in order to keep updated on how we use your personal information.
Latest review: March 2024.